As an organization owner, you need to provide your security team with a machine-readable record of Copilot-related administrative activity—such as when Copilot policies were changed and when seats were assigned or removed—so they can ingest it into their SIEM for long-term retention beyond the default retention window. Which approach best meets this requirement?