Forum Discussion

viralsoni07's avatar
viralsoni07
Copper Contributor
Aug 13, 2026

Unable to generate M365 Copilot audit events 284 and 373 – Record Types 328/383/384 also unavailable

Hello,

I am testing Microsoft 365 Copilot audit logging and need some clarification regarding several Copilot/AI audit Record Types.

Environment:

  • Microsoft 365 Business Premium
  • Microsoft 365 Copilot license
  • Unified Audit Log ingestion enabled:
    UnifiedAuditLogIngestionEnabled = True
  • Microsoft Purview Audit is enabled
  • We can successfully see Copilot audit events for Record Type 261 and 310–314

However, we are unable to generate/locate the following events:

Record Type 284 – AIAppInteraction
We performed AI application-related activities but cannot find the expected audit records.

Record Type 373 – OutlookCopilotAutomation
We created and executed a Copilot Workflow using Outlook and M365 Copilot. The workflow successfully processed emails and generated responses, but the corresponding 373 audit event is not visible in Purview Audit.

We also noticed that the following Record Types are not available in Purview Audit Search → Record Type filter:

  • 328 – ConnectedAIAppInteraction
  • 383 – CopilotForSecurityTrigger
  • 384 – CopilotAgentManagement

According to Microsoft's documentation, these Record Types exist in the Office 365 Management Activity API schema.

I would appreciate help with the following:

  1. What exact activity generates Record Type 284 (AIAppInteraction)?
  2. What exact Outlook/Copilot activity generates Record Type 373 (OutlookCopilotAutomation)?
  3. Is 373 supported with Microsoft 365 Business Premium + Microsoft 365 Copilot?
  4. Why are 328, 383 and 384 not available in the Purview Audit Search Record Type filter?
  5. Are these events generated only for specific Copilot/AI products, licenses, or scenarios?
  6. Is there a specific configuration or API query required to retrieve them?
  7. If anyone has successfully generated these events, could you please share the exact test activity/workflow used?

We have already confirmed that audit ingestion is enabled and that other Copilot events (261 and 310–314) are being generated successfully.

Any guidance or a known-good test procedure would be greatly appreciated.

Thanks!

microsoft 365 copilot
troubleshooting

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Aug 15, 2026

    Since types 261 and 310–314 appear, auditing works; the missing types have different producers. Record type 284, AIAppInteraction, covers interaction with third-party AI applications not deployed in your tenant and requires the applicable pay-as-you-go auditing to be enabled. Type 328 covers custom or third-party AI applications registered within the organization. Type 373 is Outlook backend automation without explicit user interaction, not an ordinary prompt or workflow. Type 383 is for Security Copilot agent triggers, while 384 records Copilot agent administration. Business Premium plus Microsoft 365 Copilot does not itself create those product-specific events. In Purview, search by the relevant activity or operation, export the results, and inspect RecordType offline. For the Management Activity API, retrieve Audit.General content and filter the returned records. If a documented matching activity still produces nothing after ingestion time, provide its timestamp and correlation data to Microsoft support.