Discovering, Retaining, and Deleting Copilot Actions with Microsoft Purview eDiscovery

At Alchemy Tech Group, we’ve built a workshop around Copilot that our customers love. One common question is whether actions and prompts from Copilot can be discovered, retained, and deleted. The answer is yes. In this blog, I’ll walk you through this process using standard and advanced eDiscovery in Microsoft Purview.

Storage and Roles

Before we get into the technical details, we must know how and where Copilot messages are stored and the roles required for eDiscovery searches. Copilot prompts and actions are stored in a user’s mailbox, similar to Microsoft Teams messages, and have their item classes. To perform eDiscovery searches and export data, an admin must be assigned either eDiscovery Manager or eDiscovery Administrator roles.

Item Classes for Copilot Messages:

• Excel: IPM.SkypeTeams.Message.Copilot.Excel
• Loop: IPM.SkypeTeams.Message.Copilot.Loop
• Microsoft 365 App: IPM.SkypeTeams.Message.Copilot.M365App
• Microsoft Copilot for Bing (Bizchat): IPM.SkypeTeams.Message.Copilot.BizChat
• Microsoft Forms: IPM.SkypeTeams.Message.Copilot.Forms
• OneNote: IPM.SkypeTeams.Message.Copilot.OneNote
• Outlook: IPM.SkypeTeams.Message.Copilot.Outlook
• PowerPoint: IPM.SkypeTeams.Message.Copilot.Powerpoint
• Teams Channel: IPM.SkypeTeams.Message.Copilot.Teams
• Teams Chat: IPM.SkypeTeams.Message.Copilot.Teams
• Teams Copilot Chat (Bizchat): IPM.SkypeTeams.Message.Copilot.BizChat
• Teams Meeting: IPM.SkypeTeams.Message.Copilot.Teams
• Teams Microsoft 365 Chat (BF): IPM.SkypeTeams.Message
• Whiteboard: IPM.SkypeTeams.Message.Copilot.Whiteboard
• Word: IPM.SkypeTeams.Message.Copilot.Word

eDiscovery Standard

1. 1. Access the Compliance Portal: Under solutions, expand eDiscovery and choose standard. (Note: Standard is available for M365 E3 customers, while advanced requires the eDiscovery add-on or M365 E5 SKU).
      
      

1. 1. Create a New Case: Once created, open the case.
      
      

1. 1. Create a New Search: Once the case is created, open it and create a new search
      
      

1. 1. Select Exchange Locations: Choose Exchange, as Copilot prompts and actions are stored in the user’s mailbox.
      
      

1. 1. Add Conditions: Add a condition, select type, and then choose Copilot interactions. If using the KQL editor, item classes will be displayed for more specific searches.
      
      
      
      
      Note: If you select the KQL editor radio button, the item classes will be displayed, and you can narrow down the search criteria to a specific class.
      
      
      

1. Review and Submit: Review and export the results once the search is complete.

eDiscovery Advanced

1. 1. Start with a New Case: Like eDiscovery Standard, create a new case.

1. 1. Assign Members: Select the users the case will target.
   2. Add a Custodian: This is usually a 1:1 relationship but shared mailboxes or SharePoint sites can be added if needed. For this blog, focus on the primary mailbox since Copilot actions and prompts are stored there.

Optional: This hold is optional and shown here for demonstration purposes.

1. 1. Review Custodian:

1. 1. Add to Collection:

1. 1. Complete Collection Details: Fill out the name, description, custodial data sources, and search query. Using the KQL editor, you can narrow the search by specific item classes.

Note: If you select the KQL editor radio button, the item classes are displayed, and you can narrow down the search criteria to a specific class.

1. Review and Submit: You can review and export the results once the search is complete.

Closing Thoughts

Navigating the complexities of eDiscovery with Microsoft Purview can seem daunting, but with the proper knowledge and tools, it becomes manageable. By understanding where Copilot data is stored and leveraging both standard and advanced eDiscovery techniques, you can efficiently manage, discover, and retain vital information. At Alchemy Tech Group, we’re committed to providing the insights and guidance needed to maximize your use of Copilot and Microsoft Purview. If you have any questions or need further assistance, our team is here to help.

Set Up a Microsoft Copilot Workshop

The Microsoft Copilot Workshop offered by Alchemy Technology Group is a structured, multi-phase program designed for Microsoft 365 users. It aims to educate participants on AI integration, prepare them for the implementation process, and support them through the deployment. The workshop provides practical insights into enhancing Microsoft 365 with AI, emphasizing data security, and customized strategy development for businesses seeking to leverage AI for efficiency and competitive advantage.

> Book Your Workshop Here

Set Up a Varonis Microsoft Copilot Readiness Assessment

The Varonis Microsoft Copilot Readiness Assessment emphasizes securing data in Microsoft 365 environments. Key features include a free assessment from Varonis to identify AI risks, guidance on limiting Copilot’s data access, and alerts for unusual activities. Microsoft recommends implementing proper access controls and policies to mitigate risks before deploying Copilot. The assessment focuses on classifying and labeling data, enabling DLP controls, reducing Copilot’s exposure, and monitoring its real-time activity, ensuring enhanced security and optimal use of Microsoft Copilot.

> Book Your Assessment Here