Question

A regulated insurance company has deployed several Copilot Studio agents that access customer policy data. During a compliance audit, the risk officer asks the architect to demonstrate a complete, tamper-evident record of who interacted with the agents, what conversations occurred, and which administrative configuration changes were made to the agents over the past 90 days. The architect needs to identify the correct governance tooling to satisfy this requirement across both runtime interactions and admin activities. Which approach should the architect recommend?

Accepted Answer

Enable Microsoft Purview audit logging for Copilot Studio, which records agent audit events and admin/configuration activities in the unified audit log for retention and search (with conversation transcripts retained separately in Dataverse).

Answer

Rely on the Copilot Studio built-in analytics dashboard, which reports conversation volumes and satisfaction trends for the retention period.

Answer

Export Application Insights traces for the agents, since telemetry captures every user message and system response needed for the audit.

Answer

Configure a Power Automate flow to email a copy of each conversation transcript to the compliance mailbox for archival.