Copilot M365: Administration events and audit logs

Dear David Moreno Garcia,

Thank you for your detailed update.  

After I research internal documentation and Microsoft Learn resources, here's a detailed breakdown of how this works I suggest for you: 

Firstly, Microsoft 365 Copilot activities - including those performed by IT administrators - are logged and accessible through the Microsoft Purview compliance portal, specifically via the Unified Audit Log (UAL). 

So, help me make sure some information: 

• Audit logging must be enabled in Microsoft Purview. This is typically on by default for Microsoft 365 tenants.
• The admin user must have a valid Microsoft 365 license assigned to ensure their actions are logged.
• The user must have appropriate permissions (e.g., Global Admin or Compliance Admin) to access and search the audit logs.

After that, I suggest you the following types of activities are captured: 

• Copilot Studio interactions: Includes changes to agents, settings, and user interactions.
• Security Copilot logs: Captures user and system events, accessible via Purview.
• Admin Center Copilot actions: While Copilot itself doesn’t make configuration changes, any admin-initiated actions (e.g., enabling features, managing licenses) that result from Copilot suggestions are logged if executed through standard admin interfaces.

And here is how to perform an audit search: 

1. Go to Microsoft Purview: https://compliance.microsoft.com
2. Navigate to Audit > Audit Search.
3. Use filters such as:  
   1. Activities: Filter by “CopilotInteraction”, “AdminAction”, or specific service names like SharePoint, Teams, etc.
   2. Users: Specify the admin account.
   3. Date Range: Choose the relevant time window.
4. Optionally, use PowerShell for advanced queries.

Here are some examples of events you might want to filter for: 

These are mapped in Microsoft’s documentation and can be filtered through the Purview portal. 

Admins can also collect feedback logs from users via the Admin Center: 

• Go to Copilot > Diagnostic Logs
• Select a user and choose up to 30 recent conversations
• Review and optionally scrub the logs before submission

If the user's Copilot activities (based on the actions outlined above) don't appear in your audit logs despite proper configuration, you'll need to raise a support ticket through https://admin.microsoft.com/#/support/requests because our technical team can contact you directly via call or meeting to troubleshoot issue faster. 

As a forum moderator, I don’t have access to backend systems or internal diagnostic tools, but I’ll do everything possible to guide you with the information and resources available to me. 

We appreciate your time and look forward to resolving this for you.  

Best regards, 

Vicky-I - MSFT | Microsoft Community Support Specialist

Good morning,

I have already checked the links indicated but the operations performed as IT administrator user in M365 are not reflected in the audit search.

I need to know the operation required to perform IT admin user in admin copilot M365 to be registered in log.

I need knowledge of an action or actions required to be performed by an IT administrator in Admin console in Copilot M365 to perform the specific audit search operation.

The PureView audit search option is correct for the collection of events by an admin user in console? what are the relevant events in such a search? would it be interesting to know the examples needed to perform the correct action and operation of audit searches in the search system, as they are currently multiple?

Greetings,

Hi David, 
It has been a while and I am writing to see how things are going with this issue. Have you had a chance to check the replies provided? Any update would be appreciated. If you think my reply is helpful to you, please remember to mark it as an answer.  
Warm Regards,
Vicky-I-MSFT | Microsoft Community Support Specialist

Dear David Moreno Garcia,  

Thank you for your detailed question regarding audit logging for Copilot M365 administration activities. I tried my best to help you research some references that I hope can be helpful for you. You can check it out and let me know if you want me to support you more: Audit logs for Copilot and AI applications | Microsoft Learn  

You can also check through this Microsoft Purview Community that has many discussions on it relevant to your context or create a question by yourself on this: Category: Microsoft Purview | Microsoft Community Hub  

Additionally, if you need further and deeper step by step assistance, I recommend you submit a Support Ticket (if you are admin or you can contact your IT admin) to escalate this to Microsoft via https://admin.microsoft.com/#/support/requests because our technical team can contact you directly via call or meeting to troubleshoot issue faster.  

I hope you understand that as a moderator, I’ll do everything within my capabilities to assist you with this issue. So again, let me know if you want me to support anything you need more!  

Best regards,  

Vicky-I - MSFT | Microsoft Community Support Specialist