Copilot Interactions, AI Monitoring and eDiscovery

Just because no one has a license for M365 Copilot doesn't mean you don't have eDiscovery concerns.

Photo by Solen Feyissa on Unsplash

Welcome back to 2025! I had a reasonably low-key holiday season, but it was a nice break from being online and putting out content for a few weeks.

The break allowed me to generate new ideas and investigate some of the new Copilot and AI compliance issues in a typical M365 environment.

One benefit of stepping away from the constant stream of new Copilot announcements was the opportunity to consider what is happening with Copilot and its impacts on eDiscovery.

There is a lot to consider here. I wanted to start by looking at DSPM for AI and seeing what information is available in the activity explorer.

It turns out there is a lot.

I entered one of the suggested prompts in Copilot and logged in to an M365 account to provide Enterprise Data Protection in an environment without paid Copilot licenses. I then added a couple of follow-up prompts and checked out the Activity Explorer.

There they are. Eventually, I figured out what Purview Role I needed to view the prompt. I could view the prompt but not the Copilot response. (This requires further investigation; the documentation wasn’t clear about why I couldn’t see it.)

This is where my brain started to wonder about eDiscovery because I can view the prompts here. (Albeit for only about a month, the TimeStamp search filter only goes back that far in the date selector.)

Here’s the conundrum. Do eDiscovery professionals understand two things about this new tool in Purview? One, it appears to have individual entries for prompts entered by all of my users, and two, it can be used to track prompts entered into other AI tools when a user is logged in to a Purview-registered computer.

Finally, how reasonable would it be to say that prompts entered into something like ChatGPT from a work device are discoverable? I can’t export a list of all prompts from the Activity Explorer. I can only see them in the tools, so I can at least take a screen capture of them. As this tool develops, I expect more information to become available, especially as I set up various DLP and IRM alerts that capture the prompts and pull them into cases for review.

This is all testing for a future day. There may be several newsletter issues.

BTW, I cannot enroll a device with my Developer tenant to see how this would work with prompts entered into other AI sites from my machine. Please drop me a line if you can test this and provide some feedback. (mike@mikemcbrideonline.com) I’m willing to offer a temporary paid subscription if you can provide some insight.

The other big thing about Copilot that I’m not sure enough people realize is that using the Copilot app or Biz Chat tool in the browser with an M365 work or school account stores your Copilot interactions the same way a paid license account would.

Let’s dig into how I collected and reviewed these prompts and responses using the eDiscovery tools. (Also, I will discuss a bug I found while using the new Purview eDiscovery interface with a search condition. Let me know if you know anyone at Microsoft who should have this information. I’ll happily send them the details from behind the paywall.)