Collecting Microsoft 365 Copilot Data with Microsoft Purview eDiscovery

Data Type

Storage Location

Item Class

Collection Strategy

Copilot Prompts (user questions sent to M365 Copilot)

Exchange Online: Hidden folder in the user's mailbox. Compliance copies stored similar to Teams chats, but with unique item classes.

IPM.SkypeTeams.Message.Copilot.<AppName> (e.g., .Word, .Excel, .Outlook, .BizChat). Additional AI-related classes may also apply: IPM.SkypeTeams.Message.ConnectedAIApp*, IPM.SkypeTeams.Message.CloudAIApp*, IPM.SkypeTeams.Message.TeamCopilot*, IPM.SkypeTeams.TeamCopilot*

1. Add the user's Exchange mailbox as a data source to the search.

2. In the condition builder you can optionally filter the search to only return Copilot prompts by adding a condition of "Item class contains any of Copilot activity". This automatically applies all relevant M365 Copilot item classes as a condition of the search.

3. Add any further additional conditions such as date range or keywords to narrow results as required.

You can also use the Item Class condition to exclude M365 Copilot interactions from your collections when targeting a user’s mailbox.

Notes:

· Additional item classes may be added. The item class condition will be updated accordingly.

Copilot Responses (AI-generated answers)

Exchange Online: The same hidden folder in the user's mailbox as prompts.

The same IPM.SkypeTeams.Message.Copilot.<AppName> pattern as prompts

The same collection strategy used for prompts.

Copilot Memories (personalized saved information Copilot "remembers")

Exchange Online: Hidden CopilotMemory subfolder within the user's mailbox contacts. Stored as contact entries separate from prompts and responses.

IPM.Contact

Each memory item appears as a contact card within Exchange, which is distinct from the message-based item classes used for prompts/responses.

1. Add the user's Exchange mailbox as a data source to the search.

2. In the condition builder you can optionally filter the search to only return Contacts by adding a condition of "Item class contains any of Contacts".

Notes:

· Copilot memories will not be preserved under a legal hold or retention policy.

· This will return both Copilot memories stored in contacts as well as traditional contacts from the user’s Exchange mailbox.

Copilot Pages (AI-generated, user-editable documents)

SharePoint Online: Stored in a user-owned SharePoint embedded container (shared with Loop workspace content and Copilot Notebooks). File format is .page.

Not stored in the user's mailbox.

N/A

These are SharePoint files (not Exchange items), so no item class applies. Identify them in search results by the .page file extension.

1. Add the custodian’s SharePoint embedded site URL as a data source to the search. Alternatively, tenant-wide searches of all SPO sites will include all SharePoint Embedded containers

2. Optionally use the condition builder with conditions such as date range, keywords or file type to further filter results returned

Facilitator agent interactions in a Team meeting chat

Exchange Online:

Hidden folder in all meeting attendees’ mailboxes. Compliance copies stored as Teams chats

IPM.SkypeTeams.Message

1. Add the user's Exchange mailbox as a data source to the search.

2. In the condition builder you can optionally filter the search to only return Copilot prompts by adding a condition of "Item class contains any of Instant messages".

3. Add any further additional conditions such as date range or keywords to narrow results as required.

Facilitator agent meeting notes (loop)

SharePoint Online:

Facilitator meeting notes are stored as a .loop file in a OneDrive folder titled Meetings of the user who initiated Facilitator in Teams

N/A

These are SharePoint files (not Exchange items), so no item class applies. Identify them in search results by the .loop file extension.

1. Add the user's OneDrive URL as a data source to the search.

2. In the condition builder you can optionally filter the search to only return loop files by adding a condition of "File type equals any of loop".

3. Add any further additional conditions such as date range or keywords to narrow results as required.

Notes:

· With eDiscovery premium enabled cases you can follow the standard workflow for collecting Team meeting messages and select to include cloud attachments in your collection. This will automatically pull into the export or review set any Facilitator agent meeting notes.

Facilitator created word/loop documents

SharePoint Online:

When the facilitator agent is asked to create a word or loop document during a meeting they are stored in the requesters OneDrive in a folder called

N/A

These are SharePoint files (not Exchange items), so no item class applies. Identify them in search results by the .loop file extension.

1. Add the user's OneDrive URL as a data source to the search.

2. In the condition builder you can optionally filter the search to only return loop and doc files by adding a condition of "File type equals any of loop, docx".

3. Add any further additional conditions such as date range or keywords to narrow results as required.

Notes:

· With eDiscovery premium enabled cases you can follow the standard workflow for collecting Team meeting messages and select to include cloud attachments in your collection. This will automatically pull into the export or review set any Facilitator generated loop or word documents.

Facilitator generated and assigned tasks

Exchange Online:

When the facilitator agent creates and assigns a task to an individual, it is created as a to-do item in the assigned individual's Exchange Mailbox

IPM.Task

1. Add the user's Exchange mailbox as a data source to the search.

2. In the condition builder you can optionally filter the search to only return Tasks by adding a condition of "Item class contains any of Tasks".

3. Add any further additional conditions such as date range or keywords to narrow results as required.