Copilot audit logs in Purview

Most people ask the wrong question about Copilot.

They ask “is it safe?” What they mean is “can it leak our stuff?” Fair worry. But it’s the wrong place to start.

The real question a client should be asking is “can you show me what Copilot has been doing?” Because if the answer is no, safe or not doesn’t matter. You’re flying blind.

Here’s the thing nobody tells you in the licensing pitch. Every Copilot interaction is already being recorded. You don’t have to buy anything. You don’t have to flip a switch. It’s been sitting in the unified audit log the whole time, waiting for someone to go look.

Most MSPs never do.

What is Copilot audit logging, really?

It’s the receipt for every conversation your users have with Copilot.

When someone asks Copilot in Word to summarise a document, or asks Copilot in Teams what they missed, that interaction writes a record into Microsoft Purview. Who did it. When. Which Copilot app. And — this is the part that matters — which files and resources Copilot reached into to answer.

This happens automatically as part of Audit (Standard), which is on by default for business tenants. If auditing is running, Copilot logging is running. Microsoft spells it out in the audit logs for Copilot and AI applications docs: no extra steps, no separate config.

That’s not a feature you enable. That’s a feature you’ve been ignoring.

Step-by-Step: finding Copilot activity in Purview

Open the Audit solution

Go to the Microsoft Purview portal at purview.microsoft.com, sign in, and pick Audit from the Solutions list on the left. If you’ve got the Audit Logs or View-Only Audit Logs role, you’ll land on the search page. If you don’t, that’s your first job — sort the permissions, per the search the audit log guidance.

Set your date range and activity

Pick a start and end date. Then in the activities filter, search for the Copilot record type.

RecordType: CopilotInteraction
Activity:   Interacted with Copilot

Notice what’s missing? No prompt text in that filter. The audit row tells you that a conversation happened and what files it touched — it doesn’t hand you the back-and-forth wording. That content lives elsewhere, retained for eDiscovery and Communication Compliance, not in the row you’re reading. Knowing that distinction is what separates someone who’s read the docs from someone who’s guessing.

Run the search and read the resources

Start the job. It keeps running even if you close the browser, and finished searches stick around for 30 days. Open a result and look at the AccessedResources field. That’s the gold. It shows the actual files Copilot pulled in to ground its answer.

This is where oversharing shows up. If Copilot is referencing a payroll spreadsheet for someone in the warehouse, you didn’t find a Copilot problem. You found a permissions problem Copilot just made visible.

Export when you need a paper trail

Push the results to CSV. Now you’ve got evidence, not anecdotes.

Why this actually changes the client conversation

Walk into a renewal with “Copilot is secure, trust me” and you sound like every other reseller.

Walk in with “here’s a report of every file Copilot accessed last quarter, and here are the three oversharing issues we caught and fixed” — that’s a different meeting. That’s you doing governance, not selling a licence.

“Wait, so I can actually prove Copilot isn’t quietly reading files it shouldn’t?”

Yes. And that single sentence is worth more to a nervous business owner than any feature slide.

One caveat worth knowing. Retention isn’t infinite and it isn’t equal. On most Business Premium tenants you’re looking at 180 days. On E5, key workloads stretch to a year, and you can build longer audit log retention policies if compliance demands it. If a client needs to answer “what happened nine months ago,” check the retention before you promise the answer exists.

This is the stuff cyber insurance forms ask about. It’s what SMB1001 and Essential Eight assessors want to see. Not “do you have Copilot.” But “can you account for what it did.”

Copilot doesn’t forget. Make sure you can read what it remembers.

If you’ve rolled Copilot out to a client and you can’t pull this report, you haven’t finished the rollout. You’ve just started the part nobody bothered to do.

Copilot in Outlook

Most people meet Copilot in Outlook through the Draft button. They click it, type “write a reply saying yes”, watch it produce three paragraphs of corporate waffle, and quietly decide the whole thing is overrated.

I get why. That’s the demo everyone shows. It’s also the least interesting thing Copilot does in your inbox.

The real value isn’t writing email faster. It’s reading it faster.

Think about where your time actually goes. It’s not composing. It’s the forty-message thread you got CC’d on at 4pm — the one you have to scroll to the bottom of and reconstruct before you can say anything useful. That’s the tax.

So before you write a single prompt, flip the question. Don’t ask “what can Copilot write for me?” Ask “what am I wasting time reading?”

What is Copilot in Outlook, really?

It’s two jobs wearing one badge.

The first job is Summarize. Open a long thread and there’s a “Summary by Copilot” card sitting at the top. One click boils the thread down to who said what and what’s still outstanding — with little numbered references back to the actual messages, so you can check it didn’t invent anything.

The second job is Draft. You give it an instruction, it writes the email, you fix the bits it got wrong. Tone and length are dials, not destiny.

Notice the order I put those in. Summarize first. For most people that’s eighty percent of the value — and nobody demos it.

Step-by-Step: getting actual value out of it

Summarise before you read

Open any thread more than a few replies deep. Click Summary by Copilot at the top of the message. Read the summary, then jump straight to the messages it references. You’ve just skipped the scroll.

Draft by pointing, not pleading

Here’s the prompt pattern that works:

Reply to the client agreeing to the Tuesday 2pm slot,
confirm I'll send the agenda by Friday, keep it short and warm.

Notice what’s missing? No “please write a professional email that…”. No throat-clearing. You point at the decision and the facts, and Copilot handles the wording. Vague in, vague out — every time.

Set the tone, then get out of the way

Before you generate, open the tone and length options. Pick direct and short for internal mail. Save formal for the email going to a client’s lawyer. Microsoft’s own walkthrough covers drafting an email with Copilot if you want the full button tour.

Always read it before you send

Copilot will confidently add a detail you never gave it. The draft is a starting point, not an outbox.

The shared mailbox trap that catches everyone

Here’s the one that generates support tickets.

Your client runs everything out of info@ or accounts@. They turn on Copilot, open the shared mailbox, hit Summarize… and nothing. The button’s missing, or it tells them it has no knowledge of that mailbox.

For a long time, Copilot in Outlook only worked on your primary mailbox. Shared and delegate mailboxes were off-limits — the single most common “is this thing broken?” question I get.

That’s finally changing. Microsoft now supports Copilot in shared and delegate mailboxes, but the fine print matters: the person using it needs the right level of access, the mailbox has to live in Exchange Online, and encrypted messages still can’t be read. So when a client says “it doesn’t work in our support inbox”, you can tell them why — and what to check — instead of shrugging.

That’s the difference between an MSP who resold Copilot and one who understands it.

Why this actually changes behaviour

“I’ll get to my inbox after lunch.”

That sentence is a productivity confession. Inbox triage gets deferred because it’s expensive — every thread is a small act of reconstruction before you can act.

Summarize makes that cost almost nothing. When reading a forty-message thread takes ten seconds instead of ten minutes, you stop quarantining email into a dreaded afternoon block and start clearing it in the gaps between meetings.

That’s not a feature. That’s a different relationship with your inbox.

Your inbox doesn’t pay you to read. It pays you to decide.

My recommendation? Teach clients Summarize first, Draft second. Draft is the headline. Summarize is the reason they’ll keep the licence.

If you’re not showing them both — and the shared mailbox gotcha — you’re leaving the best part of what they’re already paying for sitting in the box.

Consistency Doesn’t Show Up When Things Are Comfortable

A good month in an MSP can hide a lot. The pipeline is healthy, the techs are humming, the client tickets are getting closed, and Friday afternoon feels almost calm. In those weeks, every business looks disciplined. Every process looks tight. Every standard looks honoured.

That’s not consistency. That’s just a quiet stretch.

The real test arrives when something breaks — a bad migration, a difficult client, a tech walking out, a month where revenue doesn’t land. That’s when you find out whether your standards live in your head or live in the way your business actually behaves.

The discipline you don’t see in a good month

I’ve watched MSPs run beautifully for a quarter and then quietly drop the things that made them beautiful the moment work got heavy. The monthly client reviews stop. The patching cadence slips. The onboarding checklist becomes “we’ll get to that next week.” Nobody decides to lower the bar. It just happens, one small omission at a time, until what was a standard is now just a story you tell prospects.

What I’ve come to respect is the unglamorous stuff that keeps going regardless of mood. The same Monday standup at the same time every week. The same security baseline applied to every new tenant. The same call to a client at the same point in their lifecycle, even when there’s nothing wrong. Those rhythms only feel valuable when things get bumpy — and by then it’s too late to start them.

Build the rhythm, then defend it

This is where I think a lot of MSPs underuse what’s already sitting in their stack. A weekly cadence in Microsoft Planner with the same recurring tasks, surfaced through a Teams channel everyone actually opens, is more useful than a polished playbook nobody reads. A standing client review template in Word, kept in the same Teams tab month after month, builds a record that shows whether you actually turned up.

Copilot helps here in a way I didn’t fully appreciate until recently. Asking Copilot in Outlook to summarise a client’s last quarter of email before a review meeting takes ninety seconds and means the conversation starts with something real. Asking Copilot in Teams to recap the last three internal stand-ups before a leadership meeting means decisions don’t get re-litigated. Asking it to pull the highlights from a SharePoint site of project notes before a Monday catch-up turns ten minutes of digging into one minute of reading. The point isn’t the time saved — it’s that the rhythm becomes easier to maintain on the day you’d rather skip it.

Tools don’t create consistency. But the right ones lower the friction enough that you keep showing up on the days you don’t feel like it.

When nobody’s watching

The reason consistency is hard isn’t intelligence or capability. It’s that nobody claps for it. Doing the same review the same way for the eighteenth time in a row produces no dopamine. No client thanks you for the patches that didn’t cause an outage. No prospect signs because your internal documentation happens to be current.

But the MSPs I see growing steadily — not in spikes, but year after year — are almost always the ones doing the boring things on the bad days as well as the good ones. That’s the only kind of consistency that actually compounds, and it’s almost never visible from the outside until much later.

So the question I keep asking myself, and the one I’d put to anyone running an MSP right now, is simple. What did you still do well last month, when nothing was easy? That’s the answer that tells you who you actually are as a business.

Why "I Don’t Have a Good Idea" Is Almost Never the Real Problem

I have a conversation almost every week that goes the same way. Someone tells me they want to start their own thing. They want a bit more control over their time, a bit more income, a path that doesn’t rely on a payslip landing every fortnight. Then they sigh and say the same line: “I just don’t have a good idea.”

I used to nod along. Now I push back. Because in nearly every case, that’s not what’s actually going on.

The skills are already there

Sit with someone for half an hour and ask them what they’ve done in the last decade of work. You’ll hear about budgets they’ve cleaned up, teams they’ve coached, customers they’ve calmed down, processes they’ve quietly fixed without ever being asked. They’ve negotiated with suppliers, written training material on the fly, run projects with no formal authority, and kept things moving when the org chart said they shouldn’t have been able to.

That’s not a person without a good idea. That’s a person sitting on a stack of skills they’ve never priced.

The gap isn’t capability. The gap is translation — taking what they already do well and shaping it into something a stranger would happily pay for.

Why people freeze at the start

The freeze happens because “find an idea” is the wrong instruction. It sends people hunting for a thunderbolt — some clever niche nobody else has noticed, some product the world has never seen. So they wait. They scroll. They tell themselves they need to read another book or finish another course before they’re ready.

Meanwhile, the offer they could already build is sitting in plain sight: the thing colleagues keep asking them for help with, the problem they solved twice at their last job, the work they actually enjoy that most people genuinely struggle with.

The question isn’t “what’s a brilliant new idea?” The question is “what do I already do well that someone, somewhere, has a real problem paying to get done?”

Use the tools to pull the offer out of your head

This is where I think modern tooling — and Copilot in particular — earns its place for first-time business owners. Not because it hands you an idea, but because it pulls one out of you far faster than you could working alone with a blank notebook.

Open a fresh document in Word, switch on Copilot, and have it interview you. Ask it to walk you through your last five roles and pull out the recurring problems you solved. Ask it to draft three different one-page offers from those skills, each aimed at a different type of customer. Drop your LinkedIn profile into a Loop page and ask Copilot to suggest who would benefit most from the work you’ve already done. Then take the strongest lines into a Teams chat with someone whose judgement you trust and pressure-test them.

In an afternoon you can move from “I don’t have an idea” to three rough offers on a page. None of them have to be perfect. They just have to be concrete enough to test in a real conversation with a real person.

The shift that matters

Financial freedom rarely begins with a perfect idea. It begins with a good-enough offer, said out loud to the right person, then reshaped based on what they actually said back.

If you’ve been waiting for the lightning bolt, give yourself permission to stop. The idea you’re looking for is almost certainly already inside the experience you’ve already had. The job now is to get it out of your head, onto a page, and in front of someone who might say yes.

That’s a much smaller first step than most people think.

The Conversation I Keep Having About Copilot

Last week a manager asked me how to write the perfect prompt. She had a sticky note on her monitor with about thirty bracketed placeholders and a warning to always start with role, then context, then task. I asked her how often she actually used it. She laughed and said almost never — it felt like homework before the real work could start.

That moment captured something I’ve been thinking about for a while. The industry has spent two years training people to be better prompters, when the real productivity gains sit one layer up. With Copilot Cowork, the unit of leverage isn’t the prompt — it’s the skill.

Prompts Are Disposable. Skills Compound.

A prompt is a single instruction. You type it, you get something back, and then it’s gone. Tomorrow morning you start again. Even a brilliantly worded prompt only helps the person who wrote it, on the day they wrote it, for the task in front of them.

A Copilot Cowork skill is different. It’s a packaged way of working — a brief, a checklist, a structure, a tone — that anyone in your organisation can invoke by name. Once it exists, it doesn’t degrade. It doesn’t get lost in someone’s chat history. It runs the same way on a Tuesday morning as it does on a Friday afternoon, and it carries the thinking of whoever built it forward into every future use.

That is leverage. Prompt engineering is a craft. Skills are an asset.

Where the Productivity Actually Lives

The real productivity question in any business isn’t how do I get a better answer from Copilot today — it’s how do we stop solving the same problem from scratch every time. Skills are the answer to that question.

Think about what happens in a typical week. Someone needs to write a board update. Someone else has to brief a meeting. A third person is drafting a proposal that looks suspiciously like the last three proposals. In a prompt-engineering world, each of those people opens Copilot in Word or Outlook and tries to remember the magic incantation. In a skills world, they invoke a Board Update skill or a Meeting Brief skill and Copilot already knows the structure, the voice, the sources to pull from in SharePoint, and the people in Teams who usually need looping in.

The hours saved aren’t in the typing. They’re in not having to think the problem through again, hunt for the right template, or remember which version of the prompt actually worked last time.

The Shift Business Leaders Need to Make

If you’re leading a team, the question worth asking isn’t are my people good at prompts? It’s what work do we do over and over that should be a skill by now? The recurring report. The standard reply. The new-client onboarding sequence. The monthly review pack assembled from Excel, Outlook and a SharePoint folder no one can quite remember the path to.

Each of those is a skill waiting to exist. And the moment it does, the productivity gain isn’t a one-off — it accrues every time anyone in the business uses it.

What I’m Watching

I think the businesses that win the next stretch with Copilot won’t be the ones with the cleverest prompters. They’ll be the ones who treat their best ways of working as something to package, name, and share. Prompt engineering helps one person, once. A well-built skill helps the whole organisation, every time. That’s where the productivity actually shows up.

Copilot in PowerPoint

Most people type “make me a presentation about cyber security” into Copilot, watch it spit out ten generic slides, and decide the whole thing is a gimmick.

I don’t blame them. That output is rubbish.

But that’s not Copilot failing. That’s Copilot doing exactly what you asked — building from nothing, with no source, no structure, no brand.

Garbage in, garbage slides out.

Here’s the shift. Copilot in PowerPoint isn’t a “write my deck” button. It’s a converter. You already have the content — a Word doc, a PDF proposal, last quarter’s report. The job isn’t inventing slides. It’s turning what you’ve already written into something you can stand up and present.

What is Copilot in PowerPoint, really?

Think of it as the worst part of your week, automated.

You know the drill. The thinking is done. The report is written. The client signed off on the wording. Now you’ve got two hours of copy-pasting into slides, fighting text boxes, and nudging the logo a pixel to the left.

Copilot eats that two hours.

You point it at a file. It reads the structure, pulls the key points, and drafts slides — text, layout, the lot. You’re not staring at a blank slide anymore. You’re editing a first draft.

That’s the whole game. Not creativity. Removal of drudgery.

Step-by-Step: building a deck that doesn’t look generic

Open your template first

This is the step everyone skips, and it’s the one that matters most.

Before you touch Copilot, open your organisation’s PowerPoint template — your branded .potx, your client’s deck, whatever carries the right fonts and colours. Microsoft is explicit about this: start from your template and Copilot keeps the theme and reuses your existing layouts.

Skip it, and you get Microsoft’s house style. Every. Single. Time.

Reference your file, don’t describe it

Open the Copilot pane, then reference a file — click the paperclip, or just type / and pick the document. Word, PDF, Excel, a Loop page. Now Copilot reads the actual content instead of guessing at it.

Write a prompt that points, not pleads

Don’t ask for a slide “about the project”. Tell it exactly where to look:

Create slides from the attached proposal.
Use the "Scope" and "Pricing" sections only.
One slide per phase. Key points, not full sentences.

Notice what’s missing? Any mention of colours, fonts, or design. You don’t ask Copilot for those — your template already decided them. Ask once, point clearly, and let the template do the rest.

Review, then refine in place

Copilot drafts. You read. Then you tell it what’s wrong — “tighten slide three”, “drop the jargon”, “add a summary slide” — in plain English, right there in the pane. No re-prompting from scratch.

A couple of traps before you sell this to clients

Two things will bite you.

First, dense slides. Copilot tends to lift whole paragraphs straight off the page. If your source doc reads like a report, your slides will too. Fix it in the prompt — “bullet points, not sentences” — or trim after.

Second, the file has to be readable. Text-based PDFs work. Scanned images and password-protected files don’t. And keep source files under 24MB, or the results get flaky.

Old thinking: “I’ll block out the afternoon to build the deck.” New thinking: “I’ll point Copilot at the doc and spend the afternoon making it good.”

That’s not a small change. That’s where your hours go back.

Why this actually changes behaviour

Here’s the real win for anyone running this in a business.

Your team already produces the content. Proposals, reports, meeting notes — the substance exists. What kills them is the packaging. The deck that has to look right for the board, the client, the pitch.

Copilot collapses the gap between “we’ve written it” and “we can present it”. The expensive part — the thinking — stays human. The tedious part disappears.

And be straight about the cost. The file-referencing piece sits behind the paid Microsoft 365 Copilot add-on, not the base subscription. For a lot of SMB clients, this is the use case that justifies the licence. Not chatbots. This.

Show a client how an afternoon of slide-building becomes ten minutes, and the conversation about value is over.

If you’re running Microsoft 365 for clients and you’re not showing them this, you’re leaving real money — theirs and yours — on the table.

Copilot in PowerPoint isn’t there to make your slides.

It’s there to delete the part of the job nobody ever wanted.

The Quietest Cancellation You’ll Never Hear

The hardest clients to keep are the ones who never tell you they’re leaving.

I’ve been turning this over for a while. The clients who churn loudly — the ones who ring up annoyed, send the sharp email, ask for a refund — those are actually the easy ones. You know where you stand. You can fix something, part ways cleanly, or at least learn from it.

It’s the silent ones that hurt. The ones who stop replying to your monthly check-ins. Skip the review. Renew once out of inertia, then quietly don’t renew the second time. And somewhere down the track, you’ll hear from a friend of a friend that they felt burned by your business.

Nobody robbed them. They just never really bought.

Sold isn’t the same as bought

There’s a real difference between a client who bought and a client who was sold. Small word, big gap.

A client who bought made the decision. They walked in with a problem, recognised what you offered, and chose it. They own the outcome. Even when things get bumpy, they stay engaged because it’s their decision to defend.

A client who was sold went along with it. Maybe you were persuasive. Maybe they didn’t want to look uncertain in front of their team. Maybe the proposal looked sharp and they signed before they’d really thought it through. They never crossed the line from interested to committed — but on paper, the deal got done.

The first kind tells their friends about you. The second kind tells their friends about the business that talked them into something.

Where I see it most in MSP land

I see this constantly with Copilot rollouts right now. An MSP gets excited, runs a slick pitch, the client nods along, the licences get assigned in the Microsoft 365 admin centre, and then… nothing. Six months later the usage reports look flat. Nobody has Copilot pinned in Outlook. Nobody is asking it to summarise a Teams meeting they missed. Nobody is in Word using it to redraft a proposal or in Excel asking it to explain a column of numbers.

That client didn’t buy Copilot. They bought the meeting being over.

The same pattern shows up with backup uplifts, security stack changes, anything that lives behind a quote. If the conversation was about us getting the agreement signed instead of them understanding what changes on a Tuesday morning, the meter starts ticking on a quiet exit.

The signal isn’t loud. It’s a slower email reply. A “we’ll think about adoption training next quarter.” A skipped quarterly business review. By the time it shows up in your churn report, the relationship was over months ago.

Make them buy, don’t sell them

The fix isn’t softer language or better slides. It’s slowing the conversation down before the contract goes out. The best deals I’ve seen lately are the ones where the close was almost anticlimactic — because the buying decision had already been made out loud, by the client, weeks earlier.

I want the client describing the problem in their own words. I want them telling me what their inbox looks like on a bad day. I want them booking the adoption sessions before the deal is signed, not after. If they won’t put time in their calendar to actually use the thing, that’s the answer — and it’s better to hear it now than read it in a Google review later.

Selling closes a deal. Buying starts a relationship. One of those keeps the lights on this quarter; the other builds the kind of business worth referring.

Normal Is a Group Decision

I sat in a room recently with a group of MSP owners and listened to a conversation about pricing. Every person at the table was earning a decent living. Every person at the table was also quietly miserable about how hard they were working for it. Nobody was a bad operator. Nobody was lazy. They had simply, over years, settled into a shared idea of what “normal” looked like — and that idea was the ceiling.

That moment stuck with me, because I think most of us underestimate how much the people around us shape what we believe is possible.

Limited isn’t the same as bad

When something feels stuck — your business, your income, your role, your energy — the easy story is that someone is doing you wrong. A bad client. A bad supplier. A bad staff member. In my experience that’s rarely the real problem. The real problem is quieter. You’re surrounded by perfectly decent people who have made peace with a smaller version of the game than you secretly want to play.

Limited people aren’t villains. They’re warm, helpful, often very good at what they do. They just don’t think bigger than what they already have, and over time that becomes the air you breathe. You stop pitching certain projects. You stop charging certain prices. You stop applying for certain rooms. Not because anyone told you not to — because nobody around you is doing it either. The same thing happens with the clients you accept and the staff you hire. Like attracts like, and the average keeps quietly resetting itself downwards.

Audit the room

The room is bigger than you think. It’s the peer group you call when something goes sideways. It’s the chat you scroll while the kettle boils. It’s the three or four voices you hear most often inside your head when you’re making a decision. If those voices have all settled, you will too.

This is where I find Microsoft 365 quietly useful, in a way that has nothing to do with productivity. I use Copilot in Outlook to clear the noise faster, so the time I free up actually goes into conversations with sharper people — not back into more email. I use Copilot Chat to pressure-test my own thinking before I send a proposal: “argue against this”, “what would a more ambitious version look like”, “what am I leaving on the table”. It doesn’t replace good humans. It does stop me defaulting to the average opinion in my own head.

I also pay closer attention to which Teams communities and channels I actually show up in. If every conversation I’m part of is about doing the same thing slightly better, I’ve answered my own question about why my ceiling hasn’t moved. I keep a running Loop page of articles, podcasts and operators who think a level above where I am now, and I make myself read it before I make a decision I might otherwise rush.

Move the ceiling on purpose

You don’t have to fire your friends. You do have to be honest about what each room teaches you. Add one peer group that’s a level above where you are now. Subscribe to one voice who genuinely makes you uncomfortable in a useful way. Spend one hour a week somewhere your current “normal” would feel small.

The ceiling is invisible until you sit somewhere with a higher one. Then you wonder how you ever called the old one a roof.