--- title: "Stop Copilot Audit Gaps: Retain Chats with Purview" description: "Retain Copilot prompts and responses for an audit. Scope a Purview policy to Microsoft Copilot experiences, then prove the chats in eDiscovery." canonical: "https://adamtheautomator.com/retain-copilot-chats-purview-audit/" --- # Stop Copilot Audit Gaps: Retain Chats with Purview > Retain Copilot prompts and responses for an audit. Scope a Purview policy to Microsoft Copilot experiences, then prove the chats in eDiscovery. Source: https://adamtheautomator.com/retain-copilot-chats-purview-audit/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Stop Copilot Audit Gaps: Retain Chats with Purview](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b811abe48f654e457f7e2/690ce33be28df06aba492262db9a7509c7621c624fe455abff00c8b5b3edb0b4.webp) # Stop Copilot Audit Gaps: Retain Chats with Purview [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)20 October 202612 min. read Categories: [Information Security](/category/infosec/) Tags:[Microsoft 365 Copilot](/tag/microsoft-365-copilot/)[eDiscovery](/tag/ediscovery/)[Security](/tag/security/)[Microsoft 365](/tag/microsoft-365/) Table of Contents * [Prerequisites: Billing, Licensing, and Two Separate Role Sets](#prerequisites-billing-licensing-and-two-separate-role-sets) * [Turn On Pay-As-You-Go Billing First](#turn-on-pay-as-you-go-billing-first) * [Split the Work Across Two Role Groups](#split-the-work-across-two-role-groups) * [Where Copilot Stores the Prompts and Responses](#where-copilot-stores-the-prompts-and-responses) * [Pages Follow File Retention](#pages-follow-file-retention) * [Item Classes Identify the Interactions](#item-classes-identify-the-interactions) * [Choose the Copilot Location, Not the Legacy Teams One](#choose-the-copilot-location-not-the-legacy-teams-one) * [Create the Retention Policy in the Purview Portal](#create-the-retention-policy-in-the-purview-portal) * [Walk the Wizard](#walk-the-wizard) * [Decide the Duration From Your Own Requirement](#decide-the-duration-from-your-own-requirement) * [Build the Same Policy in Security and Compliance PowerShell](#build-the-same-policy-in-security-and-compliance-powershell) * [Connect to the Compliance Endpoint](#connect-to-the-compliance-endpoint) * [Create the Policy and the Rule](#create-the-policy-and-the-rule) * [Keep Preservation Lock Off](#keep-preservation-lock-off) * [Confirm Distribution Before You Test Anything](#confirm-distribution-before-you-test-anything) * [Retention Is Not a Hold, and a Hold Wins](#retention-is-not-a-hold-and-a-hold-wins) * [Deletion Is Asynchronous Too](#deletion-is-asynchronous-too) * [Prove the Retained Chats in Microsoft Purview eDiscovery](#prove-the-retained-chats-in-microsoft-purview-ediscovery) * [Build the Search Query](#build-the-search-query) * [Read the Preview Before You Export](#read-the-preview-before-you-export) * [Export the Evidence Package an Auditor Will Accept](#export-the-evidence-package-an-auditor-will-accept) * [When the Chats Do Not Appear](#when-the-chats-do-not-appear) * [What a Copilot Policy Does Not Cover](#what-a-copilot-policy-does-not-cover) * [Third-Party AI Has Its Own Locations](#third-party-ai-has-its-own-locations) * [Content Capture Is the Missing Step](#content-capture-is-the-missing-step) Answer an auditor’s Copilot question by scrolling through a user’s chat history and you will hand over the one view of the data that proves nothing. Chat history is a client convenience. It clears when the user deletes a conversation, it says nothing about what the backend kept, and it cannot show that a prompt reached a compliance copy. Get that wrong inside a regulatory review and your claim that Copilot interactions are retained turns into a remediation plan with a date on it. You are going to build the durable answer instead. One pilot user, a handful of synthetic prompts, one Microsoft Purview retention policy scoped to the Microsoft Copilot experiences location, and a PowerShell path for admins who will not click through a wizard twice. Then you wait for distribution to settle and prove the retained prompts and responses inside an eDiscovery search, because the mailbox copy is the copy an auditor accepts. ## Prerequisites: Billing, Licensing, and Two Separate Role Sets If you want to follow along hands-on, you need the items below. Each one blocks a specific step. | Requirement | What it blocks | | --- | --- | | Purview pay-as-you-go billing association | The AI locations stay unavailable in the policy wizard | | [Microsoft 365 Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/) license on the pilot user | No interactions exist to retain | | A license granting Purview retention rights on that mailbox | The policy has no mailbox to write a compliance copy into | | Compliance Administrator role group | Policy creation and configuration | | eDiscovery Manager role group | Case creation, search, preview, and export | | Global Administrator, used once | Enabling the billing model | ### Turn On Pay-As-You-Go Billing First Microsoft won’t let you create the policy until the tenant carries a Purview pay-as-you-go billing association. The [data lifecycle management getting-started page](https://learn.microsoft.com/en-us/purview/get-started-with-data-lifecycle-management) states the rule without hedging: “You must set up pay-as-you-go billing to create retention policies that include the locations Microsoft Copilot experiences, Enterprise AI apps, and Other AI apps. There’s no charge for Microsoft 365 Copilot interactions.” A pilot that only retains Microsoft 365 Copilot chats still needs the pay-as-you-go billing association. The meter reads zero for Copilot interactions, and the billing association is what unlocks the locations. But non-Microsoft AI does bill: each prompt and each response counts as a separate interaction under the [Purview billing model](https://learn.microsoft.com/en-us/purview/purview-billing-models). Enablement needs a Global Administrator, an Azure subscription in the same tenant, a resource group, and a service plan of `MIP_S_Exchange` or `EXCHANGE_S_FOUNDATION`. Select the rocket icon beside **Settings** in the Purview portal, choose **Get Started**, then pick the subscription and resource group. Allow a few hours for the AI locations, per the [enablement guide](https://learn.microsoft.com/en-us/purview/purview-payg-subscription-based-enablement). ### Split the Work Across Two Role Groups The policy author and the person who produces evidence hold different permissions, and keeping them apart is part of the audit answer. * **Compliance Administrator** creates and configures the policy. Microsoft recommends this role group as the least-privilege path, and a custom role group carrying Retention Management also works. Reviewers who only read policy state belong in View-Only Retention Management. * **eDiscovery Manager** creates the case, runs the search, previews results, and exports them. eDiscovery Administrator sees every case in the tenant, which matters when the audit team sits outside the group that built the policy. The Compliance Administrator and eDiscovery Manager role groups are both documented in the [Purview permissions reference](https://learn.microsoft.com/en-us/purview/purview-permissions). One administrator who both builds the policy and exports the evidence leaves auditors asking who checked the export. ## Where Copilot Stores the Prompts and Responses You need to know which backend the policy writes to, because that decides the location you pick. Copilot interactions are copied into the Exchange Online mailbox of the user who ran the prompt, and that mailbox must carry a `RecipientTypeDetails` value of `UserMailbox`, so shared mailboxes can’t be the target. Prompts, responses, and the memories that personalize later answers sit in hidden folders there; memories are stored as contact entries, which is why they appear under `IPM.Contact` in a search. The [Copilot retention reference](https://learn.microsoft.com/en-us/purview/retention-policies-copilot) covers the mailbox storage path, and the [eDiscovery AI data search guidance](https://learn.microsoft.com/en-us/purview/edisc-search-copilot-data) documents the `IPM.Contact` class for memories. ### Pages Follow File Retention A `.page` file lives in SharePoint, OneDrive, or a SharePoint Embedded container owned by Loop, so it follows file retention instead of the interaction location, as the [Copilot Pages eDiscovery guidance](https://learn.microsoft.com/en-us/microsoft-365/loop/copilot-pages-ediscovery?view=o365-worldwide) describes. If your scope includes the pages a user built with Copilot, add a SharePoint location in a separate policy. The interaction policy won’t collect them. ### Item Classes Identify the Interactions Each interaction carries a MAPI item class, which is what separates a Copilot prompt from an ordinary email in the same mailbox: * `IPM.SkypeTeams.Message.Copilot.Word` and `.Excel` for the Office hosts * `IPM.SkypeTeams.Message.Copilot.Outlook` for Outlook * `IPM.SkypeTeams.Message.Copilot.Teams` and `.Loop` for those hosts Because the compliance copy lives in the mailbox, every proof step later in this post runs in Purview rather than in the Copilot client. ## Choose the Copilot Location, Not the Legacy Teams One Location selection is where most pilots go wrong, because the older combined location is still visible. | Location | What it captures | When to use it | | --- | --- | --- | | Microsoft Copilot experiences | Microsoft 365 Copilot, Security Copilot, Copilot in Fabric, Copilot Studio | The audit scope here | | Enterprise AI apps | Third-party AI onboarded through Entra registration, Foundry, or a connector | ChatGPT Enterprise or Claude Enterprise traffic | | Other AI apps | Unmanaged generative AI reached in a browser, with content capture enabled | Consumer ChatGPT or Gemini use | | Teams chats and Copilot interactions (legacy) | The combined store from before the split | Existing policies only | Microsoft separated Copilot from the Teams location. Legacy combined policies still run but cannot take on new capabilities, and the [retention policy configuration guide](https://learn.microsoft.com/en-us/purview/create-retention-policies) is clear that new policies use the AI locations. Retire a legacy policy only after the AI policy is verified, so no gap opens between the two. ## Create the Retention Policy in the Purview Portal The Purview retention policy wizard shows which locations the billing association unlocked. ### Walk the Wizard 1. Sign in to the Microsoft Purview portal as an account in the Compliance Administrator role group. 2. Go to **Solutions** > **Data Lifecycle Management** > **Policies** > **Retention policies**, then select **New retention policy**. 3. Name the policy `Copilot-Pilot-Retention`. Decide now, because the name cannot be changed later. 4. Choose **Static** scope. Adaptive scopes need an existing scope object and a license tier that supports them. 5. On **Choose locations**, select **Microsoft Copilot experiences**, clear the locations you are not testing, then add the pilot user under **Exchange mailboxes**. 6. Choose retain-only or retain-then-delete. An audit policy usually retains with no deletion action. 7. Review and submit. The wizard view below shows the location checklist that decides the policy. ![Choosing policy locations](https://adamtheautomator.com/wp-content/uploads/publisher/73541b4d3080aaa1c9849f60dba08e334847b7e5f8393265158d98c2ce5f0e87.jpg) ### Decide the Duration From Your Own Requirement Set the retention period from what your legal or records owner signs off on. Microsoft publishes no default or recommended duration for Copilot interactions, so any specific number quoted for this content type came from someone else’s policy decision. The [retention policy creation steps](https://learn.microsoft.com/en-us/purview/create-retention-policies) put the duration and the end-of-period action on the **Decide if you want to retain content, delete it, or both** page. ## Build the Same Policy in Security and Compliance PowerShell A portal policy can’t be rebuilt identically in a second tenant. Both `AppRetention` cmdlets exist only in [Security and Compliance PowerShell](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps). The commands below were validated against the current cmdlet reference before publishing, with the `New-AppRetentionCompliancePolicy` parameter sets checked on 2026-10-18. Each block assumes Security and Compliance PowerShell with the [ExchangeOnlineManagement module](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps) loaded. Module builds ship often, so read the build in front of you before you pin a script: `Get-Module -ListAvailable ExchangeOnlineManagement` prints the version installed. ### Connect to the Compliance Endpoint ```powershell Connect-IPPSSession -UserPrincipalName admin@contoso.com ``` `Connect-IPPSSession` authenticates against the compliance endpoint. Use `Connect-ExchangeOnline` here and the `AppRetention` cmdlets won’t resolve. ### Create the Policy and the Rule For Microsoft Copilot experiences, `-Applications` takes one string containing six values, and the [cmdlet reference for New-AppRetentionCompliancePolicy](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-appretentioncompliancepolicy?view=exchange-ps) says of that value set: “You must use all of the following values at the same time.” Two of the six (`CopilotinBusinessApplicationplatformsSales` and `SQLCopilot`) have no current effect, and the reference still requires both. ```powershell New-AppRetentionCompliancePolicy ` -Name "Copilot-Pilot-Retention" ` -Applications "User:M365Copilot,CopilotForSecurity,CopilotinFabricPowerBI,CopilotStudio,CopilotinBusinessApplicationplatformsSales,SQLCopilot" ` -ExchangeLocation "pilot.user@contoso.com" ``` `-ExchangeLocation` scopes the policy to the pilot mailbox. It accepts a mailbox, a distribution group, a mail-enabled security group, or `All`, and `All` cannot be combined with anything else. The policy alone retains nothing. A rule binds the duration and the action, and it references the policy by name. ```powershell New-AppRetentionComplianceRule ` -Name "Copilot-Pilot-Retention-Rule" ` -Policy "Copilot-Pilot-Retention" ` -RetentionDuration 365 ` -RetentionDurationDisplayHint Days ` -RetentionComplianceAction Keep ``` `365` is a placeholder for this pilot run, not a recommendation. Replace it with the approved duration. `-RetentionComplianceAction Keep` retains without deleting at the end of the period, which is what an audit policy usually wants. The [rule reference](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-appretentioncompliancerule?view=exchange-ps) lists the other actions. ### Keep Preservation Lock Off Preservation Lock removes your ability to back out, so the pilot policy leaves it alone. * * * _**Warning: Never add -RestrictiveRetention $true to a pilot. Preservation Lock cannot be undone by anyone, including a Global Administrator, and afterward you may only add applications or extend the duration.**_ * * * ## Confirm Distribution Before You Test Anything A submitted policy distributes asynchronously, and Microsoft documents up to seven days for a policy to be applied. Testing on day one is the most common false alarm in this workflow. ```powershell Get-AppRetentionCompliancePolicy -Identity "Copilot-Pilot-Retention" -DistributionDetail | Select-Object Name, DistributionStatus, DistributionResults ``` `-DistributionDetail` is the switch that returns per-location results; without it you get configuration and no delivery state. When a status contains an error, `Select-Object -ExpandProperty DistributionResults` lists the individual failures, which the [retention troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/purview/retention/identify-errors-in-retention-and-retention-label-policies) walks through. ```powershell Set-AppRetentionCompliancePolicy -Identity "Copilot-Pilot-Retention" -RetryDistribution ``` `-RetryDistribution` forces a fresh sync to the locations and is the documented fix for a stuck policy. Design decisions freeze at creation as well: the name, the scope type, and every retention setting except the period cannot be changed afterward, per the [configuration guide](https://learn.microsoft.com/en-us/purview/create-retention-policies). ## Retention Is Not a Hold, and a Hold Wins Audit pilots collide with active investigations, and that is where precedence questions start. Retention manages lifecycle across a mailbox; a hold preserves specific content for a legal matter. Microsoft’s guidance on [creating holds in eDiscovery](https://learn.microsoft.com/en-us/purview/edisc-hold-create) sends readers to retention policies and labels for preservation that is not tied to an investigation, which is the separation to carry into your runbook. Purview resolves conflicts between retention policies with four rules: 1. Retention beats deletion, so a seven-year policy outranks a one-year deletion policy. 2. Among competing retention policies, the longest duration applies. 3. For deletion conflicts, an explicit inclusion outranks an implicit one: a retention label’s delete action beats any policy’s, and a policy scoped to specific users beats an org-wide policy. The period itself still comes from rule 2, whatever the scope. 4. When only deletion policies apply, the shortest deletion period wins. An eDiscovery hold outranks all four retention precedence rules. Content under an active hold is not deleted when a retention rule’s deletion action comes due, and the hold keeps applying until it is released or the case closes. Two details catch admins here. Microsoft’s [eDiscovery hold documentation](https://learn.microsoft.com/en-us/purview/edisc-hold-create) gives a new hold up to 24 hours to take effect, and every user whose content is preserved needs an eligible license. Office 365 F1 and F3 don’t include hold rights. ### Deletion Is Asynchronous Too A deletion action doesn’t erase a Copilot item when the retention clock runs out. The item moves to a hidden SubstrateHolds folder in the same mailbox, waits at least a day, and is purged on the next pass of an Exchange timer job that runs every one to seven days. A deletion due date marks the start of that run, so a result that survives its due date is expected behavior and isn’t a broken policy. ## Prove the Retained Chats in Microsoft Purview eDiscovery Classic Content Search, classic eDiscovery Standard, and classic eDiscovery Premium were retired on August 31, 2025, so the current path is eDiscovery inside the Purview portal, covered in [Learn about eDiscovery](https://learn.microsoft.com/en-us/purview/edisc). Create a case, add the pilot mailbox as a data source, and add a hold policy on the **Hold policies** tab if the audit has to survive a later investigation. ### Build the Search Query An unfiltered mailbox search returns every email the pilot user sent, which buries the Copilot items. Scope the query to the item class family: ```text ItemClass:IPM.SkypeTeams.Message.Copilot.* ``` The `ItemClass:IPM.SkypeTeams.Message.Copilot.*` wildcard covers the Word, Excel, PowerPoint, Outlook, Loop, Teams, BizChat, Fabric, and Studio classes, since they share the prefix. The [AI data search guidance](https://learn.microsoft.com/en-us/purview/edisc-search-copilot-data) lists the classes outside it, including `IPM.SkypeTeams.Message.TeamCopilot.AiNotes.Teams` for Facilitator AI notes. ### Read the Preview Before You Export Prompts and responses are separate mailbox items, so a raw result list reads as disconnected messages even though each Copilot chat produced both. Preview a few hits and confirm three things: the result holds both a prompt and its response, the item class matches the family you meant to capture, and the date range covers chats you deleted in the client on purpose. That last check turns the pilot into proof, since a conversation deleted in the Copilot interface and still present in the search is the strongest artifact you can produce. The search preview below shows the query, the pilot mailbox as its data source, and a retained prompt paired with its response. ![Previewing a retained chat](https://adamtheautomator.com/wp-content/uploads/publisher/1c4980a1f26e7b637adaec8d7da57a6b1009f5f425b598ed0a696fba354dc134.jpg) ## Export the Evidence Package an Auditor Will Accept Export is a search action, and the options you select decide whether the package is readable. Enable **Include Teams and Viva Engage conversations** to pull the messages posted within a 12-hour window before and after each responsive item. Enable **Organize conversation into HTML transcript** so the contextual chat messages are threaded into an HTML transcript instead of scattered item files. Search export packages expire 14 days after creation and are then deleted with no recovery, per the [export guidance](https://learn.microsoft.com/en-us/purview/edisc-search-export). Download or copy the package into your evidence store inside that window. Review set exports follow different rules, so do not assume the same expiry. Tie the export to the audit trail before you file it. Microsoft Purview Audit records a `CopilotInteraction` event for each interaction, described in [Purview controls for Copilot](https://learn.microsoft.com/en-us/purview/ai-m365-copilot). Three independent facts point at one interaction once the exported message sits beside the `CopilotInteraction` audit record and the policy distribution detail: an event, a content copy, and the policy that explains why the copy still exists. The event expires first. Audit (Standard) keeps the `CopilotInteraction` event for [180 days](https://learn.microsoft.com/en-us/purview/audit-log-retention-policies), so a package filed in year two has two facts and no event unless a custom audit log retention policy extends the window. ## When the Chats Do Not Appear Most [missing-chat tickets](https://adamtheautomator.com/purview-missing-ai-prompts/) trace to one of five causes, and the five below are the ones a retention pilot creates. * **Wrong cmdlet family.** A policy built with `New-RetentionCompliancePolicy` targets older locations. Rebuild it with `New-AppRetentionCompliancePolicy`. * **Legacy location selected.** A combined Teams and Copilot policy will not pick up the newer capabilities. Build the AI policy alongside it. * **Distribution still running.** Up to seven days is normal. Check `-DistributionDetail` first. * **Response never finished.** Interactions still in progress are excluded from the compliance copy. * **Search filter too narrow.** A date range that starts after the synthetic chats looks exactly like a retention failure. But a departed user isn’t a failure case. If the pilot account is deleted, the interactions stay in the inactive mailbox and remain searchable for the retention period, per the [retention policy reference for Copilot interactions](https://learn.microsoft.com/en-us/purview/retention-policies-copilot). Convert the mailbox deliberately rather than letting the license lapse. ## What a Copilot Policy Does Not Cover A policy scoped to Microsoft Copilot experiences retains Microsoft’s own Copilot interactions. It does not archive [an employee’s ChatGPT usage](https://adamtheautomator.com/stop-shadow-ai-microsoft-purview/), and treating those as one question is how an audit response ends up wrong. ### Third-Party AI Has Its Own Locations Enterprise AI apps covers applications onboarded through Entra registration, [Microsoft Foundry](https://learn.microsoft.com/en-us/azure/foundry/), or a Purview connector, with its own value set: `"User:Entrabased3PAIApps,ChatGPTEnterprise,AzureAIServices"`. Other AI apps covers unmanaged browser-based sites, with `"User:CloudAIAppChatGPTConsumer,CloudAIAppGoogleGemini,BingConsumer,DeepSeek"`. All three AI value sets are marked in preview in the [cmdlet reference](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-appretentioncompliancepolicy?view=exchange-ps), so confirm the current strings before pinning them in a production script. ### Content Capture Is the Missing Step Retaining AI content outside Microsoft’s own apps depends on a separate collection setup that plenty of tenants never turn on. * * * _**Reality Check: Selecting an AI app in a policy does not preserve its prompt text. Without a collection policy that has content capture enabled, you get a record that an interaction happened and no conversation to review.**_ * * * The [collection policy reference](https://learn.microsoft.com/en-us/purview/collection-policies-policy-reference) describes the content capture requirement, and the endpoint side is real work: the Purview browser extension on onboarded Windows devices, Edge for Business, or a network path through [Global Secure Access](https://learn.microsoft.com/en-us/entra/global-secure-access/). Unmanaged AI sites also change endpoints, so capture gaps appear until Microsoft updates site detection. Four artifacts close the pilot: * The retention policy configuration, naming the location and the pilot user. * The distribution detail showing every location succeeded. * The eDiscovery case, its query, and a preview of a deleted conversation that still exists. * The export package, downloaded inside the 14-day window, with HTML transcripts enabled. Hand over the four artifacts with the duration your records owner approved. A reviewer who re-runs the search reaches the same result. A hold that hasn’t finished its 24-hour activation window still leaves the search short, so re-run it before you call the package final. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fretain-copilot-chats-purview-audit%2F&text=Stop%20Copilot%20Audit%20Gaps%3A%20Retain%20Chats%20with%20Purview)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fretain-copilot-chats-purview-audit%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fretain-copilot-chats-purview-audit%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8179a90ac78068758b8e/a73d28e0d4b237b4d869f4d1e51a24f3720c1bc819ff3ef01894ea81641429d2.jpg) ### [Stop Copilot Summarizing Confidential Files with Purview DLP](/exclude-confidential-files-copilot-dlp/) Build a Purview DLP policy that stops Microsoft 365 Copilot processing labeled files, then probe the citations and prompt uploads that still leak. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b81db9b78e52704dbd111/3650a0b7acbaf739069578f880254f978fe1383bc1b0453cd800afd989ff19ef.png) ### [Stop Copilot Web Searches from Leaking Sensitive Data](/stop-copilot-web-searches/) Block Microsoft 365 Copilot from sending sensitive prompt text to external web search with a Purview DLP rule, then prove the block in the audit log. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b812193d4cc7a6d4be13d/1daf00385836df44b470b450d81ec18105c2ccff55f54f2fd2f72592fca6e34c.png) ### [Stop Impersonation: Verify Identity at Onboarding](/identity-verification-onboarding/) Prevent impersonation by verifying identity during onboarding. Why identity proofing must happen before provisioning access to new hires. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)