Copilot Data & Privacy Issues

How to Automatically Ingest Microsoft Copilot Logs into Microsoft Sentinel

Khadija Khan Oct 9, 2026 868 views

Question details

The user needs to configure Microsoft Sentinel to automatically pull and retain audit and activity logs from Microsoft Copilot.

How to Automatically Ingest Microsoft Copilot Logs into Microsoft Sentinel

Product: Microsoft Sentinel / Microsoft Copilot
Device & OS: not provided
Scenario: Setting up continuous security monitoring and audit log ingestion for enterprise Copilot usage.
Observed behavior: Users require specific data connectors or ingestion methods to capture Copilot events, which vary depending on the exact Copilot service in use.

Before you start

Ensure you have Microsoft 365 Global Administrator or Security Administrator permissions, as well as Contributor rights to the Microsoft Sentinel workspace where logs will be ingested.

Solution 1Recommended

Identify Connectors and Consult Sentinel Support

Determine the appropriate Microsoft 365 audit solutions for your specific Copilot product and leverage the Microsoft Sentinel community for targeted configuration guidance.

Because Microsoft Copilot encompasses multiple products (e.g., Copilot for Microsoft 365, Security Copilot, Sales Copilot), audit data sources vary. Direct ingestion relies heavily on existing Microsoft 365 audit logs and standard Sentinel data connectors.

Identify the Copilot Product and Events

Determine exactly which Copilot service you are monitoring (e.g., Copilot for M365) and define the specific log types, events, and desired data retention periods.

Check Microsoft Sentinel Data Connectors

Navigate to your Microsoft Sentinel workspace in the Azure Portal, select 'Data connectors' from the left menu, and search for 'Office 365' or 'Microsoft 365 Defender' to verify if the required audit logs are supported.

Post in the Microsoft Sentinel Community

If direct connectors for your required Copilot events are missing, post your specific scenario in the official Microsoft Sentinel Q&A community. Include your tenant setup, the Copilot service name, required events, and retention details so specialists can provide tailored ingestion scripts or Logic App architectures.

Identify Connectors and Consult Sentinel Support

Scope of Issue: Log ingestion into Microsoft Sentinel is an advanced SIEM configuration task that falls outside standard Microsoft 365 or Office application troubleshooting.

Free Microsoft Office alternative

Looking for a Secure, Privacy-Focused Office Suite? Try WPS Office

While enterprise IT teams manage complex log ingestion in Microsoft Sentinel, standard users and teams often just need a reliable, secure office suite. WPS Office provides a lightweight, free alternative to Microsoft Office, ensuring productivity without heavy enterprise deployment overhead.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Lightweight installation with exceptionally fast startup speeds.Strong local privacy controls for sensitive documents and enterprise data.Built-in PDF editing, document conversion, and secure cloud sharing tools.

Frequently Asked Questions

Which Microsoft 365 logs contain Microsoft Copilot activity?

Copilot for Microsoft 365 activity is typically logged in the Microsoft 365 unified audit log (UAL). These logs can be forwarded to Microsoft Sentinel using the standard Office 365 data connector.

Do I need a special connector for Microsoft Security Copilot?

Security Copilot integrates natively with Microsoft Sentinel and Microsoft Defender. However, you may need to configure specific diagnostic settings in your Azure workspace depending on your overall security architecture.

Why can't I see Copilot interactions in Microsoft Sentinel?

You must ensure that auditing is enabled in the Microsoft 365 Defender portal and that your Sentinel connector is actively polling the Office 365 Management Activity API for Copilot-specific schema events.

Microsoft Copilot Issues