Can an administrator audit the web queries generated by Copilot?

Definition: Yes. Microsoft documents web search query logging for administrators. In Microsoft Purview, an administrator can audit the exact web search queries that Copilot derived from a user's prompt and can use eDiscovery for the related Copilot activity.

Key facts

• Copilot parses a prompt, identifies terms for which web information may help, and sends a generated query to Bing, according to Microsoft's web search privacy documentation.
• Microsoft says the system automatically logs Copilot user interactions as part of Audit (Standard), so an organization that enables auditing does not need an extra Copilot auditing configuration, according to Audit logs for Copilot and AI applications.
• In eDiscovery, all user prompts and responses from AI applications are stored in a user's mailbox, according to Microsoft's eDiscovery data guidance.
• The audit record uses AISystemPlugin.Id with the value BingWebSearch when Copilot requests public web data through Bing, as documented in the Copilot audit log reference.
• The Messages property identifies the prompt and response messages in a Copilot interaction, according to Microsoft's CopilotInteraction schema.

What does Copilot web search logging contain?

Microsoft's web search privacy documentation says that web search query logging lets administrators perform search, audit, and eDiscovery on the exact queries Copilot derived from a user's prompt. The generated query is different from the original prompt and consists of a few words informed by it.

The page also separates the administrator record from the user interface. Web search query citations show the exact queries sent to Bing in the linked citation section of a Copilot response. Those citations are available only in Microsoft Copilot Chat, and the queries remain available in that chat thread for 24 hours. Administrator logging is the mechanism documented for search, audit, and eDiscovery after that user-facing display window.

Activity explorer in Microsoft Purview Data Security Posture Management for AI can display the actual web search terms alongside the original prompt, the response, and supporting resources. This gives an administrator a view of the query and the interaction that produced it.

How can an administrator check Purview Audit?

Microsoft's Copilot audit log documentation directs administrators to the Microsoft Purview portal and its Audit solution. The system automatically generates audit records when a user interacts with Copilot. These records include the user, when the interaction took place, where it occurred, and references to files, sites, or other resources accessed to generate a response.

Use the documented audit path and fields:

Microsoft Purview portal > Audit
Activities - operation names
Operation | RecordType | Workload

To identify use of the public web, inspect AISystemPlugin.Id in the CopilotInteraction record. The reference gives BingWebSearch as the value for a request that uses the public web through Microsoft Bing. The same page says that administrators who need a specific AppIdentity value should first search and export relevant Copilot audit logs by operation name, then filter the exported results offline.

The schema's corresponding JSON shape is:

{"AISystemPlugin":[{"Id":"BingWebSearch","Name":"BuiltIn"}]}

The schema defines Messages as the IDs of the prompt and response messages in the Copilot interaction.

How does eDiscovery complement the audit log?

Microsoft's Purview eDiscovery guidance says that an administrator can create an eDiscovery case and search a user's mailbox for AI activity. For the broadest Copilot activity search, select the Item class condition and choose Copilot activity. The documentation says this condition includes all Copilot and other AI application data, with a date range or keywords available to narrow the investigation.

Each Microsoft 365 Copilot interaction is stored in the user's Exchange Online mailbox as an individual message-class item. eDiscovery can return these items in search results, review sets, or exports such as PST files, individual messages, and Microsoft Graph results. The interaction headers identify the user and the Copilot application identity as the two participants. For a browser-based Copilot WebChat interaction, the documented application identity is WebChat.

Creating the case and searching for AI activity requires membership in the eDiscovery Manager role group. Search And Purge is required for deletion.

Related terms

• Microsoft Copilot
• Where can the exact Bing query generated by Copilot Chat be inspected?
• Does Copilot Chat send the full prompt or file to Bing search?
• Where can web search be disabled in Copilot Chat?

FAQ

Does the audit record show that Copilot used Bing?

Yes. In a CopilotInteraction audit record, AISystemPlugin.Id contains BingWebSearch when Copilot requests public web data through Microsoft Bing.

Is the full user prompt sent to Bing?

Microsoft describes the generated query as a few words informed by the prompt. The entire prompt is excluded unless the prompt is very short, and entire Microsoft 365 files are not included in the generated query.

Can eDiscovery search prompts and responses?

Yes. Copilot prompts and responses are stored in a user's mailbox, and the eDiscovery Copilot activity condition includes Copilot and other AI application activity.

Does the 24-hour period apply to Purview records?

The 24-hour period documented by Microsoft applies to web search queries shown in the Copilot Chat thread. The pages used here do not state a single retention period for Purview audit records or eDiscovery items.

Sources

1. Microsoft Learn, "Data, privacy, and security for web search in Microsoft Copilot and Microsoft Copilot Chat", 2026-08-18
2. Microsoft Learn, "Audit logs for Copilot and AI applications", 2026-08-26
3. Microsoft Learn, "Search for and delete AI application data in eDiscovery", 2026-06-19
4. Microsoft Learn, "CopilotInteraction", 2023-11-09

---

Check how a page reads to answer engines. Open the GEO score analyzer