AI-powered assistant that helps security teams detect, investigate, and respond to threats
Microsoft 365 Copilot interaction data, including prompts and responses, is stored within user mailboxes and retained indefinitely by default unless an explicit Microsoft Purview retention policy is configured.
Prompts and responses are saved as chat items in hidden folders within the user's Exchange Online mailbox. Without custom retention rules, this data remains stored in Microsoft Graph indefinitely. Microsoft states that Copilot interaction data is encrypted at rest and is not used to train foundation LLMs.
For personal Microsoft Copilot accounts, conversation history is typically retained for up to 18 months unless manually deleted.
Administrators can use Microsoft Purview to configure dedicated data lifecycle and retention policies targeting Microsoft Copilot experiences separately from regular Teams chats.
When a deletion policy expires, items move to a hidden SubstrateHolds folder for at least one day before a backend timer job permanently deletes them, usually within 1 to 7 days.
Default audit logs capturing Copilot activity are retained for 180 days under standard auditing. This period can be extended through premium audit policies.
If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.
hth
Marcin