--- title: "Troubleshoot Missing AI Prompts in Purview Activity Explorer" description: "Find why Purview records AI activity without prompt text. Check audit settings, capture policies, and viewer permissions in a scoped test." canonical: "https://adamtheautomator.com/purview-missing-ai-prompts/" --- # Troubleshoot Missing AI Prompts in Purview Activity Explorer > Find why Purview records AI activity without prompt text. Check audit settings, capture policies, and viewer permissions in a scoped test. Source: https://adamtheautomator.com/purview-missing-ai-prompts/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Troubleshoot Missing AI Prompts in Purview Activity Explorer](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8157af67cfe805737c4c/d87a8e3ffd5988406606bd14f49a16ebbed72206f31a33a1f24372061a22b0e9.webp) # Troubleshoot Missing AI Prompts in Purview Activity Explorer [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)12 October 20269 min. read Categories: [Information Security](/category/infosec/) Tags:[Microsoft 365](/tag/microsoft-365/)[PowerShell](/tag/powershell/)[Security](/tag/security/)[Microsoft Exchange](/tag/microsoft-exchange/) Table of Contents * [Prerequisites](#prerequisites) * [Why AI Prompts Go Missing from Activity Explorer](#why-ai-prompts-go-missing-from-activity-explorer) * [Activity Records and Captured Content](#activity-records-and-captured-content) * [Which Apps Need What](#which-apps-need-what) * [Send a Synthetic Prompt First](#send-a-synthetic-prompt-first) * [Check 1: Is Auditing Turned On?](#check-1-is-auditing-turned-on) * [Confirm the Test Prompt Left a Record](#confirm-the-test-prompt-left-a-record) * [Check 2: Does a Collection Policy Keep the Content?](#check-2-does-a-collection-policy-keep-the-content) * [Find the Two Settings That Matter](#find-the-two-settings-that-matter) * [Check Prerequisites for Apps Beyond Microsoft 365 Copilot](#check-prerequisites-for-apps-beyond-microsoft-365-copilot) * [Check 3: Can Your Account Read the Text?](#check-3-can-your-account-read-the-text) * [See Which Roles Can Read Prompts](#see-which-roles-can-read-prompts) * [Add the Investigator](#add-the-investigator) * [Check 4: Gaps That Are Documented as Normal](#check-4-gaps-that-are-documented-as-normal) * [Match the Symptom to the Fix](#match-the-symptom-to-the-fix) * [Remove the Test Access When You Finish](#remove-the-test-access-when-you-finish) I show up in Activity explorer with a user, a timestamp, and an app name. The files I touched are listed right there. Where the prompt should be, I have nothing to read. What am I? You are looking at an AI interaction event whose text either never reached Microsoft Purview or reached it and sits behind a permission you don’t hold. You’ll send one harmless, synthetic prompt through Copilot, then run it through four checks in order: auditing, the collection policy, your own read permission, and the gaps Microsoft documents as normal. ## Prerequisites You can follow along with a lab tenant or a pilot user in production. You need: * A test user with a Microsoft 365 Copilot license and an Exchange Online mailbox, since a user [without that mailbox gets no prompt or response displayed](https://learn.microsoft.com/en-us/purview/data-security-posture-management-considerations). * An investigating account that can open [Activity explorer](https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer) in the Purview portal; the Compliance Administrator role is enough to browse, and Check 3 adds the role that reading prompts requires. * [Exchange Online PowerShell](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps) and the Audit Logs role for Check 1, which you can skip if you only plan to work in the portal. ## Why AI Prompts Go Missing from Activity Explorer [Purview records an AI interaction](https://learn.microsoft.com/en-us/purview/ai-microsoft-purview) in two separate ways that fail for different reasons. ### Activity Records and Captured Content Every Copilot interaction writes an audit record. Microsoft’s audit documentation says these records contain [details about which user interacted with Copilot, when the interaction took place, and where it occurred](https://learn.microsoft.com/en-us/purview/audit-copilot), plus references to the files the AI accessed. For each message, the documented `Messages` field carries a message ID, an `IsPrompt` flag, and a jailbreak flag. The prompt text itself is not among the documented properties. The text takes a second path into Activity explorer, and whether it arrives depends on the app type. The diagram below lays out both paths for a single prompt. ![Prompt capture path](https://adamtheautomator.com/wp-content/uploads/publisher/b2d23ceaef6715455bf4a8f61ca93207d95affdcbec5ea3888d5c06367cb33ab.jpg) Activity explorer can show the row without its text because the row comes from the top lane, while the text has to clear both gates in the bottom lane. ### Which Apps Need What Purview’s collection policy is the rule that decides which AI events get ingested and how much of their content is kept. The event description in Microsoft’s [Data Security Posture Management considerations](https://learn.microsoft.com/en-us/purview/data-security-posture-management-considerations) spells out the rules. It states: “For Copilot in Fabric and Security Copilot, and for non-Copilot AI apps, prompts and responses require a collection policy with content capture selected to capture these interactions.” | AI app | What puts the text in the row | | --- | --- | | Microsoft 365 Copilot and Copilot Chat | Auditing turned on | | [Copilot in Fabric](https://learn.microsoft.com/en-us/purview/ai-copilot-fabric) and [Security Copilot](https://learn.microsoft.com/en-us/purview/ai-security-copilot) | A collection policy with content capture selected | | Entra-registered enterprise AI apps | A collection policy with content capture selected | | Unmanaged AI apps in Edge | Text prompts only | Two naming details trip people up. The current Data Security Posture Management (DSPM) experience shows these events on an **AI activities** tab in Activity explorer. Microsoft labels [DSPM for AI (classic)](https://learn.microsoft.com/en-us/purview/dspm-for-ai-considerations) as replaced by the current version. Guides written for classic may show menus that look different from the ones in your portal. Every check below works from one test interaction you can pick out of the audit log. ## Send a Synthetic Prompt First Real employee prompts put private conversations on your screen. Sign in as the test user and ask Microsoft 365 Copilot Chat something harmless that contains a marker nobody else would type, for example `Reply with the word PURVIEW-TEST-7731.` If the missing prompts come from another app, send the same marker through it too, since Check 2 needs an interaction from the app the policy covers. * * * _**Pro Tip: Write the marker and the time you sent it in your notes. A unique string tells your test apart from everyone else’s traffic.**_ * * * Microsoft’s guidance for Microsoft 365 Copilot is to [“Wait at least a day for data to display for the reports on this page.”](https://learn.microsoft.com/en-us/purview/ai-m365-copilot) Send the prompt now and run Check 1 while that day passes. ## Check 1: Is Auditing Turned On? If auditing is off, no Copilot activity record exists, so no later setting can bring the text back. Microsoft’s guidance is that [audit logging is on by default for Microsoft 365 organizations](https://learn.microsoft.com/en-us/purview/audit-log-enable-disable). It also names the exceptions: “Auditing isn’t enabled by default for Small and Medium Business (SMB) licenses, including Microsoft 365 Business Basic, Business Standard, and Business Premium.” Connect to Exchange Online PowerShell and read the setting directly with the [Get-AdminAuditLogConfig cmdlet](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-adminauditlogconfig?view=exchange-ps): ```powershell Connect-ExchangeOnline Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled ``` `True` means auditing is on. Run this in Exchange Online PowerShell only. The same cmdlet exists in Security & Compliance PowerShell, where Microsoft’s [auditing setup guide warns the property is always `False`](https://learn.microsoft.com/en-us/purview/audit-log-enable-disable) even when auditing is on. * * * _**Warning: This changes an organization-wide setting, and auditing may be off on purpose. Confirm with whoever owns your compliance policy before running it.**_ * * * If you get `False`, turn it on: ```powershell Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true ``` Don’t judge the fix by an immediate search: the change [can take up to 60 minutes to take effect](https://learn.microsoft.com/en-us/purview/audit-log-enable-disable), and records can take longer than that to become searchable. ### Confirm the Test Prompt Left a Record With auditing confirmed, look for the interaction itself. Copilot activity is logged with the operation name `CopilotInteraction`. Filter on that and on your test user with the [Search-UnifiedAuditLog cmdlet](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/search-unifiedauditlog?view=exchange-ps) (replace the sample address with yours): ```powershell $records = Search-UnifiedAuditLog ` -StartDate (Get-Date).AddDays(-1).ToUniversalTime() ` -EndDate (Get-Date).ToUniversalTime() ` -UserIds testuser@contoso.com ` -Operations CopilotInteraction ` -ResultSize 50 $records | Select-Object CreationDate, UserIds, Operations $records[0].AuditData | ConvertFrom-Json | ConvertTo-Json -Depth 10 ``` The `Select-Object` line lists the matching events with their time and user. The last line prints the full record so you can find the `Messages` property and the `AppHost` that says where the prompt came from. Dates run through `.ToUniversalTime()` because the cmdlet reads a date without a time zone as UTC. `-ResultSize 50` caps the output below the default of 100, and `-Depth 10` stops `ConvertTo-Json` from cutting off the nested `AuditData` properties at its default depth of 2. Empty `$records` makes the last line fail with a null-index error. [Microsoft doesn’t commit to a specific delivery time](https://learn.microsoft.com/en-us/purview/audit-search) for audit records. If `$records` comes back empty right after the test, rerun the search later. This filter covers Microsoft’s own Copilot apps, including Security Copilot and Copilot in Fabric. Add `ConnectedAIAppInteraction` to `-Operations` when your missing prompts came from an [Entra-registered enterprise AI app](https://adamtheautomator.com/taming-ai-tool-sprawl-powershell-guide-auditing/); those apps [log under that operation](https://learn.microsoft.com/en-us/purview/audit-copilot). If the audit log has the record but Activity explorer has no row, check the filters and your administrative unit. Restricted administrators [see results only for users in their assigned administrative unit](https://learn.microsoft.com/en-us/purview/dspm-for-ai-considerations). For Microsoft 365 Copilot, rows without text go straight to Check 3, since that text depends on auditing alone. For every other app in the table, they go to Check 2. ## Check 2: Does a Collection Policy Keep the Content? Missing prompts from Security Copilot, Copilot in Fabric, or an enterprise AI app usually trace back to the collection policy. ### Find the Two Settings That Matter Open the policy list in the Microsoft Purview portal under **Solutions** > **Data Loss Prevention** > **Classifiers** > **Collection policies**. The one-click policies are named **DSPM for AI - Capture interactions for Copilot experiences** and **DSPM for AI - Capture interactions for enterprise AI apps**. Open the one that matches your app and look at two settings, which the image below marks. ![Content capture settings](https://adamtheautomator.com/wp-content/uploads/publisher/a38a35529dde9970e04389d69ce4f4152825ecb5449a2cf24afd047b53cc7451.jpg) The numbered callouts in the image above match the list below: callout 1 is the content capture option, and callout 2 is the classifier condition. 1. The content capture option has to be selected. Microsoft’s documentation says that [no prompt or response is displayed if the option to capture content isn’t selected](https://learn.microsoft.com/en-us/purview/data-security-posture-management-considerations). It gives a real example: the one-click policy **DSPM for AI - Detect sensitive info shared with AI via network** doesn’t select it when it’s created. 2. The classifier condition has to be set to All. The [collection policies overview](https://learn.microsoft.com/en-us/purview/collection-policies-solution-overview) states: “To capture AI content, you must have the Content contains classifiers condition set to All.” That rules out a policy scoped to a handful of [sensitive information types](https://adamtheautomator.com/microsoft-purview-dlp-policies/). Edit the policy, save it, and then send a new synthetic prompt from the test user through the app the policy covers. ### Check Prerequisites for Apps Beyond Microsoft 365 Copilot Apps outside Microsoft 365 Copilot carry prerequisites a collection policy can’t satisfy. For AI apps other than Microsoft 365 Copilot and [Microsoft Facilitator](https://learn.microsoft.com/en-us/purview/ai-teams-facilitator), the DSPM considerations page names [pay-as-you-go billing](https://learn.microsoft.com/en-us/purview/dspm-for-ai-considerations) as a prerequisite. Security Copilot also needs its own option to [allow Microsoft Purview to access its data](https://learn.microsoft.com/en-us/purview/ai-security-copilot) turned on before Purview can manage its interactions. ## Check 3: Can Your Account Read the Text? Capture can succeed on every word while Activity explorer still shows you nothing, because reading prompts is its own permission. [Microsoft’s guide to Copilot data security](https://learn.microsoft.com/en-us/purview/ai-m365-copilot) says the detail view shows “the prompts and response when you’re a member of the Microsoft Purview Content Explorer Content Viewer role group.” ### See Which Roles Can Read Prompts The [permissions table for DSPM](https://learn.microsoft.com/en-us/purview/data-security-posture-management-permissions) is blunter. For the activity “View the prompts and responses within AI Interaction events from activity explorer,” the Entra Compliance Administrator role, the Entra Global Administrator role, the Purview Compliance Administrator role group, and every view-only role are all marked as not supported. The extra membership it requires is **Content Explorer Content Viewer** or **Microsoft Purview Data Security AI Content Viewer**. * * * _**Reality Check: Grant this permission only to the person doing the investigation, after sign-off from whoever owns privacy for your organization, because it lets someone read employees’ conversations with AI.**_ * * * Both memberships fill the prompt pane, and they differ in how much else they open: | Membership | What it opens | Pick it when | | --- | --- | --- | | Microsoft Purview Data Security AI Content Viewer | View-only access “for AI interactions only” | The job is reading prompts and nothing else | | Content Explorer Content Viewer | AI interactions plus file contents in [Content Explorer](https://learn.microsoft.com/en-us/purview/data-classification-content-explorer) | You want the role group Microsoft’s Copilot guidance names | ### Add the Investigator To add the investigator, use an account with the Role management role: 1. Sign in to the Microsoft Purview portal and go to **Settings** > **Roles and scopes** > **Role groups**. 2. Select the role group and choose **Edit**. 3. Select **Choose users**, pick the investigator, and select **Select**. 4. Select **Edit expiration** to set an end date. Microsoft’s [permissions documentation](https://learn.microsoft.com/en-us/purview/purview-permissions) allows a minimum of one day. 5. Select **Next**, then **Save**. If the AI Content Viewer appears as a role rather than a role group in your tenant, add it to a custom role group, using the create steps on the same page. Now open Activity explorer, filter to the AI app category **Copilot experiences & agents**, and open your test user’s row. The image below shows the detail pane you are aiming for. ![AI interaction event](https://adamtheautomator.com/wp-content/uploads/publisher/2130c00035e371d2f7cc01496189c49d51a16fe0b5fd5f3ff46f513302dd095b.jpg) ## Check 4: Gaps That Are Documented as Normal If all three checks pass and some rows still have no text, compare the symptom against Microsoft’s known issues. The AI interaction event [doesn’t always display text for the prompt and response](https://learn.microsoft.com/en-us/purview/data-security-posture-management-considerations), and the causes it lists are these: * Consecutive entries can split a long exchange, with the prompt in one row and the response in the next. The neighboring row may hold the text you think is missing. * Microsoft Facilitator AI-generated notes show no prompt or response at all. * Users without an Exchange Online mailbox have no stored text to show, because prompts and responses for AI apps are stored in the user’s mailbox. * [Unmanaged AI apps](https://adamtheautomator.com/stop-shadow-ai-microsoft-purview/) in Edge include only the text prompt; the response is absent by design. Treat a prompt-only row from an Edge-based site as a complete capture. When an Edge session shows no captured content, Activity explorer can’t tell you whether anyone used an AI tool there. When you still need the original text, [eDiscovery can search the user’s mailbox](https://learn.microsoft.com/en-us/purview/ai-m365-copilot) for it. Before you open a case, check [retention policies for the **Microsoft Copilot experiences** location](https://learn.microsoft.com/en-us/purview/retention-policies-copilot), which can delete prompts and responses automatically. Create a case, choose the user’s mailbox as the source, and add the condition **Type** > **Contains any of** > **Copilot activity**. ## Match the Symptom to the Fix Each row below maps back to a behavior in Microsoft’s [known issues and prerequisites for DSPM](https://learn.microsoft.com/en-us/purview/data-security-posture-management-considerations): | What you see | Check | Fix | | --- | --- | --- | | No audit record for the test prompt | 1 | Confirm `UnifiedAuditLogIngestionEnabled` is `True`; check for an SMB license | | Audit record but no Activity explorer row | 1 | Check filters and administrative unit scope | | Row, no text, app is Security Copilot, Fabric, or an enterprise app | 2 | Select content capture and set classifiers to All | | Row, no text, you are a Global Administrator | 3 | Add the content viewer role for the investigator | | Row with only the prompt half | 4 | Read the next consecutive entry | | Edge site row with no response | 4 | Expected; Edge captures prompts only | ## Remove the Test Access When You Finish Take back the role you added; it reads private conversations. If you set an expiration in Check 3, the assignment [expires automatically](https://learn.microsoft.com/en-us/purview/purview-permissions) on that date. If you didn’t, remove the membership from [Security & Compliance PowerShell](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps) with the same Role management account you used to add it. Look up the role group’s name first (or use the custom role group you created), then pass it to `-Identity`: ```powershell Connect-IPPSSession -UserPrincipalName admin@contoso.com Get-RoleGroup | Where-Object DisplayName -like '*Content Viewer*' | Format-Table Name, DisplayName Remove-RoleGroupMember -Identity '' -Member investigator@contoso.com ``` Check the role group name in the confirmation prompt that `Remove-RoleGroupMember` shows before it removes anyone. Revert any policy edit you made only for testing, and write down the marker string and which check fixed your case. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fpurview-missing-ai-prompts%2F&text=Troubleshoot%20Missing%20AI%20Prompts%20in%20Purview%20Activity%20Explorer)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fpurview-missing-ai-prompts%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fpurview-missing-ai-prompts%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/06/featured_image-13.png) ### [Taming AI Tool Sprawl: A PowerShell Guide to Auditing and Governing Unauthorized AI Applications](/taming-ai-tool-sprawl-powershell-guide-auditing/) Detect and govern unauthorized AI tools with PowerShell, Microsoft Graph, Entra ID, and Defender for Cloud Apps. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b81db9b78e52704dbd111/3650a0b7acbaf739069578f880254f978fe1383bc1b0453cd800afd989ff19ef.png) ### [Stop Copilot Web Searches from Leaking Sensitive Data](/stop-copilot-web-searches/) Block Microsoft 365 Copilot from sending sensitive prompt text to external web search with a Purview DLP rule, then prove the block in the audit log. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b8198b651eec70c447ee1/bc27e65fd261774769a0da850c0fe0f594bb2c6ba5bfcf317eadea5471382804.jpg) ### [Find Expired Windows Certificates Instantly via PowerShell](/find-expired-certificates-powershell/) Use PowerShell to scan every certificate store across a Windows fleet, report expired and expiring certificates, and alert before authentication breaks. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)