Audit & Export M365 copilot interactions
- Yoav Crombie
- Agat Support
Following the three steps you can get copilot interactions and the
eDiscovery Premium
Start by going the the purview portal here:
https://purview.microsoft.com/ediscovery/advancedediscovery
Step 1: Create a case
A case is the high level entity containing the searced data.
Name the Case. (Add a meaningful description)
Default Settings: Proceed with the default settings unless specific adjustments are required.
Add Members.
Submit: Finalize the case creation process by clicking the submit.
Step 2: Create Collection
A collection is where data marked for preservation is collected into a secure repository
Access the Case: Navigate to the case you previously created within the platform or system.
Go to Collections Tab: Locate and select the "Collections" tab within the case interface.
Create New Collection: Click on the option to create a new collection.
Name the Collection: Provide a relevant name for the new collection to identify its purpose.
Select Custodial Data Sources: Choose to include all custodial data sources available for the collection. (Shown in the below screenshot) - Note: A custodian is an individual associated to the case, They play a crucial role in the eDiscovery process because they are responsible for preserving and providing access to their relevant electronic documents and data when requested by legal teams during litigation or investigations.
Additional location (choose 365 groups)
In the last step of creating a new collection, define the below query (As shown in the below screenshot)
Type - Equals any of - Copilot activity
Note : You can filter data at this point by users and/or date. This is also possible later before export, but doing this here will improve performance .
Step 3: Commit Collection to Review set
Select the Collection: Navigate to the collection you previously created within your case.
Commit Collection: Click on the option to "Commit collection".
Give a name to the Review set that you want to commit to:
Commit Process: The system will begin adding items from the collection to the review sets.
During the process you can see the status of adding the data here:When the status changes from (“Adding to review set” to “Committed”) this means the Review Set is ready.
Access Data: Once the commit process is complete, navigate to the review sets where you will find the data ready for review.
Step 4 : Exporting the Review Set
Assign the user with the appropriate permissions, which is eDiscovery Manager. You can follow the steps in this link to assign the right permissions. https://learn.microsoft.com/en-us/purview/ediscovery-assign-permissions#assign-ediscovery-permissions
In Microsoft Purview compliance portal, open eDiscovery case, select the review sets tab and then select the review set that you want to export.
In the review set, select the items to export. Select Action > Export
The Export tool displays the flyout page with the settings to configure the export.
This link explains the options in the fly out page.https://learn.microsoft.com/en-us/purview/ediscovery-export-documents-from-review-set#export-options
Once you configure the export options, click on Export to begin the process.
Go to the Exports section in the case to find and download the exported packages.
Optional : Filtering data in the Review Set before export
You can filter the review dataset using queries such as date, user, and other parameters. Above the review table, you'll find a filter option that allows you to create queries and search for specific data.
Below is an example of a filter query to get data between June.1, 2024 and June.2, 2024
Once filtering the review set, note to choose in the export configuration
Keep in mind that you can reduce the ZIP file size by including only the HTML prompts.
To obtain HTML data in a separate folder, select the "Loose files and PSTs (email is added to PSTs when possible)" output option shown in the screenshot below.
Importing into BusinessGPT for analysis
To analyze your Copilot data, upload the exported zip file from the Copilot data source to the dashboard.