View Copilot Studio audit logs
Changes to the content and settings of a copilot can affect security and copilot behavior. It's important to audit such actions to help mitigate failures, help contain systems of security constraints, adhere to compliance requirements, and act on security threats.
This article lists and describes the Copilot Studio activities that are logged and available using the Microsoft Purview compliance portal.
Important
- Administrative activities for Copilot Studio are enabled by default on all tenants. You can't disable activity collection.
- At least one user with an assigned Microsoft 365 E5 or greater license, as required by Microsoft Purview. More information: Auditing solutions in Microsoft Purview
View Copilot Studio audit logs in Microsoft Purview compliance portal
You can find logs of Copilot Studio activities in the Microsoft Purview compliance portal. These logs are also accessible to developers via the Office 365 Management API.
Access the logs
Sign in to the Microsoft Purview compliance portal as a tenant admin.
In the left menu, select Show all.
Select Audit from the Solutions category.
Admins can filter for specific activities in the Activities list. Copilot Studio activities are listed here.
See audited events
All logging is done at the SDK layer, so a single action can trigger multiple logged events. Here's a list of events that you can audit.
| Category | Event | Description |
|---|---|---|
| Copilots | BotCreate |
The creation of a new copilot in Copilot Studio |
| Copilots | BotDelete |
The deletion of a copilot in Copilot Studio |
| Copilots | BotAuthUpdate |
Updating the authentication settings of a copilot in Copilot Studio |
| Copilots | BotIconUpdate |
Updating the copilot icon in Copilot Studio |
| Copilots | BotPublish |
Publishing of a copilot in Copilot Studio |
| Copilots | BotShare |
Sharing of a copilot to other users in Copilot Studio |
| Copilots | BotAppInsightsUpdate |
Updating the App Insights logging configuration of a copilot in Copilot Studio |
| Copilot Component | BotComponentCreate |
The creation of a component (such as a topic or skill) for a copilot in Copilot Studio |
| Copilot Component | BotComponentUpdate |
The update of a component (e.g. topic, skill, etc.) for a copilot in Copilot Studio |
| Copilot Component | BotComponentDelete |
The deletion of a component (e.g. topic, skill, etc.) for a copilot in Copilot Studio |
| AI Plugin | AIPluginOperationCreate |
Creating an AI Plugin for a copilot in Copilot Studio |
| AI Plugin | AIPluginOperationUpdate |
Updating an AI Plugin for a copilot in Copilot Studio |
| AI Plugin | AIPluginOperationDelete |
Removing an AI Plugin for a copilot in Copilot Studio |
| Environment Variable | EnvironmentVariableCreate |
Creating an environment variable for a copilot in Copilot Studio |
| Environment Variable | EnvironmentVariableUpdate |
Updating an environment variable for a copilot in Copilot Studio |
| Environment Variable | EnvironmentVariableDelete |
Deleting an environment variable for a copilot in Copilot Studio |
Get details on the base schema for logging
Schemas define the Power Automate fields that are sent to the Microsoft Purview compliance portal. Some fields are common to all applications that send audit data to Microsoft 365, while others are specific to Power Automate. The base schema contains these common fields.
Common audit fields
Schemas define which copilot fields are sent to the Microsoft Purview compliance portal. Some fields are common to all applications that send audit data to Microsoft Purview, while others are specific to Copilot Studio. The following are fields common to the Power Platform.
| Field display name | Logical name | Type | Mandatory | Description |
|---|---|---|---|---|
| Date | CreationTime |
Edm.Date |
No | Date and time when the log was generated in UTC. |
| Id | ID |
Edm.Guid |
No | Unique GUID for every logged row. |
| Result Status | ResultStatus |
Edm.String |
No | Status of the logged row. |
| Organization Id | OrganizationId |
Edm.Guid |
Yes | Unique identifier of the organization from which the log was generated. |
| Operation | Operation |
Edm.String |
No | Name of operation. |
| User | UserKey |
Edm.String |
No | Unique identifier of the user in Microsoft Entra ID. |
| User type | UserType |
Self.UserType |
No | The audit type (admin, regular, or system). |
Copilot Studio audit fields
In addition to the fields common to the Power Platform administrator activities, Copilot Studio includes the following fields.
| Name | Type | Mandatory | Description |
|---|---|---|---|
BotId |
Edm.String |
No | A unique identifier of the copilot |
BotSchemaName |
Edm.String |
No | A unique string identifying the copilot |
BotUpdateDetails |
Edm.ComplexType (Collection) |
No | Details of the properties updated on the copilot |
BotComponentId |
Edm.String |
No | A unique identifier of the copilot components, such as topics, entities |
BotComponentSchemaName |
Edm.String |
No | A unique string identifying the components of copilot, such as topics, entities |
BotComponentType |
Edm.String |
No | Type of the copilot component, such as topics, entities |
BotComponentUpdateDetails |
Edm.ComplexType (Collection) |
No | Details of the properties updated of the copilot component |
AIPluginOperationId |
Edm.String |
No | A unique identifier for the operation with the AI plugin |
AIPluginOperationName |
Edm.String |
No | Name of the operation with the AI plugin |
EnvironmentVariableDefinitionSchemaName |
Edm.String |
No | Schema name for the environment variable definition associated with the copilot |
EnvironmentVariableDefinitionId |
Edm.String |
No | A unique identifier for the environment variable definition associated with the copilot |