Introduction

Copilot has roots in various Microsoft productivity applications that promised to keep workers on track with tasks, requests and events. Copilot is an AI assistant that uses public and private Large Language Models (LLMs) for generative search, predictive text, images and more. Users can draft/create documents and images within Word, PowerPoint, Loop and other M365 applications via prompts. M365 now logs these Copilot prompts via the audit log. Microsoft Purview compliance and eDiscovery applications can now search, alert, act and retrieve these Copilot prompts along with other enterprise content to support compliance requirements.

Copilot functionality and the resulting potential eDiscovery impact and Electronically Stored Information (evidence) are evolving rapidly. This page will initially highlight potential impact and coping strategies. Expect that this page will be updated or reorganized frequently as we learn more and see it play out in customer tenants.

Copilot Recall

May 20, 2024 Microsoft announced a new generation of AI enabled Copilot+ PC‘s that would run preloaded AI models locally and provide extended AI functionality at the endpoint. For eDiscovery and compliance professionals, the key new functionality of Windows Copilot Runtime is called Recall. From the limited information available the functionality captures screenshots of webpages, documents and applications into a UserActivity local index/database. The Recall application supports search, timeline view, Screenray interaction, purge and restart of the logged session. The goal is to enable users to return to prior ‘sessions’ via search, filter or timeline navigation to resume work. I am sure that every eDiscovery/compliance professional immediately recognizes the potential for this information to reconstruct every minute of a witness/suspect’s day. Other Copilot functions will automatically OCR and extract content for search.

Before you panic, Recall is ONLY available on the new generation of Copilot+ PC’s. The screenshots and UserActivity index/database is stored locally (no location given that I could find). By default the storage is limited to 10-15% of your total disk capability. That could still be months of screenshots and user history. I did not find any mentions of extending Purview access to Recall content, but if it is stored within the OneDrive synchronized folder it would be accessible to Purview compliance features.