Audit Logging for Fabric Data Agent with Microsoft Purview (Preview)

Microsoft Purview Data Security Posture Management (DSPM) enables organizations to monitor, audit, and investigate AI interactions across Fabric Data Agents and Copilot experiences.

With audit logging enabled, user prompts, AI responses, and interaction metadata are captured and stored in Microsoft Purview through the Microsoft 365 audit pipeline.

Important

This feature is in preview.

Prerequisites

Ensure the following configurations are enabled before using audit logging:

1. Enable Purview Audit

  • In DSPM, select Actions > Setup tasks. Check whether the Activate Microsoft Purview Audit setup task is complete. If not, select and complete it. For information on enabling audit, see Enable Audit Log.

2. Enable DSPM Policy

  • In Microsoft Purview, complete the Secure interactions in Microsoft Copilot experiences setup task. For more information about this setup task, see Setup tasks for DSPM.

3. Enable Fabric Tenant Setting

  • In OneLake catalog > Govern > Configurations > Tenant settings:
    • Turn on: Allow Microsoft Purview to secure AI interactions

For more information about this option, see Tenant settings index.

Viewing Data Agent Audit Logs

When a user interacts with a Fabric Data Agent, a Copilot Interaction audit record is created for the request as well as the response.

Each audit record includes:

  • Timestamp
  • User identity
  • Application and agent details
  • Associated resources and metadata
  • User prompt or AI response

All records are stored in the Microsoft 365 unified audit log.

To review audit logs:

  1. Go to Microsoft Purview Portal
  2. Navigate to DSPM.
  3. Open Activity Explorer
  4. Look for records labeled Copilot Interaction

Screenshot showing Activity Explorer in Purview DSPM.

Each record represents a single interaction between a user and the Data Agent.

Note

Copilot Interaction audit records capture user-facing interactions only: the prompt the user submits and the response the Data Agent returns. They don't capture internal orchestration steps, intermediate reasoning, or backend queries that the Data Agent runs but doesn't return to the user as part of the response.

Use Activity Explorer filters to locate specific interactions:

  • Timestamp
    Narrow results to a specific time window

  • Activity Type
    Filter by Copilot Interaction

  • User
    Identify activity by specific users

  • App
    Isolate interactions from Fabric-Data Agent

User Prompt

For each interaction, Microsoft Purview captures and logs the full text of the user's prompt.

Screenshot showing user prompt in Fabric data agent.

Data Agent Response

For each interaction, the response returned by the Data Agent including the natural language answer and structured outputs such as generated queries or code are logged.

Screenshot showing Data Agent response from M365.

Licensing and Costs

Microsoft Purview now offers a combination of entitlement-based (per-user-per-month) and Pay-As-You-Go (PAYG) pricing models. The PAYG model applies to a broader set of Purview capabilities—including Insider Risk Management, Communication Compliance, eDiscovery, and other data security and governance solutions—based on copilot for Power BI usage volume or complexity. Purview Audit logging of Copilot for Power BI activity remains included at no additional cost as part of Microsoft 365 E5 licensing. This flexible pricing structure ensures that organizations only pay for what they use as data flows through AI models, networks, and applications.

  • Last updated on