Copilot Prompts are Investigation Gold

Custodian intent is often central to resolving internal investigations. Custodian’s Copilot chat queries have provided some of the best evidence of intent in recent complex investigations targeting knowledge workers who are highly aware that every email, Teams chat or meeting Recap may be monitored (i.e. they have good Operational Security). Even in civil discovery custodian’s Copilot prompts can demonstrate their contemporaneous understanding that memory often blurs over time. I thought I would take a moment to share Copilot knowledge on what is kept and how it can be retrieved.*

Copilot Prompts:

• Prompts and responses are currently stored in a hidden folder (TeamsMessageData) in the user’s mailbox.
• They are assigned Copilot-specific item classes based on the application source or surface that they were executed within. That source results in specific app/host values in the query.
  • I found the primary traditional Copilot query sources to be BizChat and WebChat, but Copilot is now integrated into almost every M365 app.
• Unless your tenant has added a retention policy targeting Copilot experiences location, chats are retained until deleted. CopilotInteraction log entries are retained for 180 days unless extended by policy (E5 up to one year). Audit log entries do not contain the prompt or response text, but a broad search of your custodians in the log can help you understand their potential usage quickly.
• Every Copilot chat may generate a few or a great number (50+) conversation segments and attachments that can be tricky to reassemble into a coherent narrative thread.

Copilot Chat Search:

• Presently, you should be able to target specific user mailboxes for Copilot chat. Copilot meeting activity (Recap), Copilot memories, agents, Security Copilot, Copilot Studio, Copilot Pages and Fabric are all outside of the scope for this discussion. If they are a pain point email me.
• The Purview merged date field has been reliable to far in testing in a few tenants.
• In my experience, the Purview eDiscovery Item Class merged “Copilot Activity” property generates a ton of noise compared to targeting fully qualified ItemClass values. Until you have run test searches on your own or known chats it is safer to run broad date limited searches and evaluate the resulting metadata in a Review Set (E5) or export report.
  • “Copilot activity” condition resolves to: ((ItemClass:IPM.SkypeTeams.Message.Copilot.*) OR (ItemClass:IPM.SkypeTeams.Message.ConnectedAIApp*) OR (ItemClass:IPM.SkypeTeams.Message.CloudAIApp*) OR (ItemClass:IPM.SkypeTeams.Message.TeamCopilot*) OR (ItemClass:IPM.SkypeTeams.TeamCopilot*))
• KeyQL of ItemClass:IPM.SkypeTeams.Message.Copilot.* is a broad search condition covering most common user apps. Teams Copilot Recap fails that and requires IPM.SkyTeams.Message.TeamCopilot.*.
• My most targeted testing results have come from: ((ItemClass:IPM.SkypeTeams.Message.Copilot.BizChat) OR (ItemClass:IPM.SkypeTeams.Message.Copilot.WebChat)).
• It can be worth the time to add search results to a Review Set (E5 required) for inspection before you export or finalize your searches. Grouping by conversations or families helps with navigation as does date sorting. Neither of these perfectly orders the results for an easy narrative flow. You will need to grouping enabled when running searches within a review set.
• As clunky as Purview tagging is, I found it helpful when finding investigation needles in custodial haystacks. Be aware that the export feature seems to default to all items in review set, so you want to add the Tag option to your reports.

That is as much time as I have from my prep for RelFest next week. My schedule has booked up, but drop me a note or flag me down if you want to talk shop or just introduce yourself.

*Disclaimer: The speed of Microsoft development means that you should ALWAYS check for updates and run tests in your own tenant prior to relying on anyone’s discovery guidance. Microsoft has recently moved the storage locations for 1-1 Team channel chat from participant mailboxes to the Team site mailbox. They may change the ItemClass or other key properties without obvious notice at any time.  

Supporting Microsoft documentation – AI generated

• Search for and delete AI application data in eDiscovery: item-class table, and the From/To convention in the section “How Copilot interactions appear in eDiscovery results”.
• Purview for Microsoft 365 Copilot & Copilot Chat: the Copilot activity condition and ItemClass guidance.
• Audit logs for Copilot and AI applications: Messages/IsPrompt, AppIdentity, AgentId, Contexts, the AppHost table, and offline AppIdentity filtering.
• Manage audit log retention policies: for the 180-day vs one-year check.
• eDiscovery condition builder.
• Graph aiInteractionHistory: getAllEnterpriseInteractions.
• Collecting M365 Copilot Data with Purview eDiscovery (Microsoft Tech Community, May 2026): exclusion KQL, HTML transcripts, memory and Pages caveats.
• Create a summary with Copilot in Word: auto-summary conditions.

Greg Buckles wants your feedback, questions or project inquiries at Greg@eDJGroupInc.com.  Reach out for a free 15 minute ‘Good Karma’ call if he has availability. He solves problems and creates eDiscovery solutions for enterprise and law firm clients.

Greg’s blog perspectives are personal opinions and should not be interpreted as a professional judgment or advice. Greg is no longer an investigative journalist and all perspectives are based on best public information. Blog content is neither approved nor reviewed by any providers prior to being published. Do you want to share your own perspective? Greg is looking for practical, professional informative perspectives free of marketing fluff, hidden agendas or personal/product bias. Outside blogs will clearly indicate the author, company and any relevant affiliations. 

Greg’s latest nature, art and diving photographs on Instagram.