---
name: Agent Audit Trail and Forensics Investigation
description: Extracts and analyses Microsoft 365 Copilot and Copilot Studio agent actions from the Purview unified audit log to reconstruct what an agent did, what data it accessed, and who authorised each action during a security investigation.
---

# Agent Audit Trail and Forensics Investigation

> **TL;DR:** This skill extracts Microsoft 365 Copilot and Copilot Studio agent action events from the Purview unified audit log, reconstructs the action timeline for a specific agent or user, and produces a forensic report suitable for a security incident investigation or eDiscovery response.

## What does the agent audit trail and forensics investigation skill reconstruct?

When a security incident, data breach, or regulatory inquiry involves an AI agent, the investigator needs a complete action timeline: every file the agent accessed, every prompt submitted, every external message sent, and every API call made — correlated with the human user who initiated the session, the agent identity used, and the timestamp. Microsoft 365 Copilot and Copilot Studio agent actions are captured in the Microsoft Purview unified audit log under Copilot-specific event types. This skill provides the query framework, event taxonomy, and analysis template to extract, correlate, and present agent action data from the audit log for forensic investigation. It is directly applicable to eDiscovery holds, regulatory response under the Privacy Act 1988 (notifiable data breaches), and IRAP assessment evidence of audit log completeness.

## When should you run this skill?

- "Investigate what a Copilot agent did during an incident"
- "Extract agent actions for an eDiscovery hold"
- "Show me everything this agent accessed in the last 48 hours"
- "Produce a forensic timeline for a suspected data exfiltration via Copilot"
- "Audit agent actions for a Privacy Act notifiable data breach response"
- "Demonstrate audit log completeness for IRAP evidence"

## How this skill works, step by step

1. Confirm the review scope: agent name or ID (or user UPN if investigating a user's Copilot sessions), date range, and incident context
2. Open the Microsoft Purview portal → Audit → New search
3. Set activity filter to Copilot activities: CopilotInteraction, AgentActionTaken, AgentActionApproved, AgentActionRejected, FilesAccessedByAgent, ExternalMessageSentByAgent
4. Set date range to cover the investigation window plus 24 hours either side
5. If investigating a specific agent, also filter by the agent's service principal ID in the ObjectId field
6. Export the results to CSV and load into the analysis template
7. Correlate each agent action with the initiating user session: match CopilotInteraction event (user) to subsequent AgentActionTaken events (agent) by session identifier
8. Identify the files accessed: extract FileId, SiteUrl, and ItemType from FilesAccessedByAgent events; resolve sensitivity labels
9. Flag any ExternalMessageSentByAgent events — these indicate the agent communicated outside the organisation
10. Build the chronological timeline of actions
11. Assess evidence of anomalous behaviour: actions outside business hours, files accessed outside the user's normal SharePoint permissions, external messages to domains not in the organisation's partner list
12. Produce the forensic timeline and summary below

## Output format

### Agent action timeline

| Timestamp (UTC) | Event Type | Agent | Initiated By | Resource Accessed | Sensitivity Label | Anomaly Flag |
| --- | --- | --- | --- | --- | --- | --- |
| 2026-06-10 02:14:37 | FilesAccessedByAgent | Travel-Booking-v2 | `user@org.com` | /sites/ExecComms/Strategy2026.docx | Highly Confidential | Yes — outside business hours, outside user's normal site |
| 2026-06-10 02:14:52 | ExternalMessageSentByAgent | Travel-Booking-v2 | `user@org.com` | external-domain.com | — | Yes — external recipient not in approved partner list |

### Forensic summary

- Investigation window: [start] to [end]
- Agent(s) in scope: N
- Total agent actions: N
- Files accessed by agent: N (Highly Confidential: N, Confidential: N, No label: N)
- External messages sent by agent: N
- Anomalous actions flagged: N
- Recommended escalation: [eDiscovery hold / privacy breach notification / incident response team]

## Scope and safety

Read-only — this skill does NOT:

- Modify, delete, or suppress audit log records
- Disable or pause agents under investigation (use Copilot admin centre for that action)
- Contact users, agents, or external parties

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Purview unified audit log with Copilot and agent event types | Microsoft 365 E5 Compliance or Microsoft Purview add-on |
| Audit log retention for 12 months (minimum for investigations) | Microsoft 365 E5 (audit retention) or Microsoft Purview Audit (Premium) |
| Advanced audit log (10-year retention for regulatory obligations) | Microsoft Purview Audit (Premium) add-on |

### Least-privilege roles

- Compliance Administrator (run audit searches and export results)
- Audit Logs (custom role) — minimum role for read-only audit log search without full Compliance Administrator access

### Microsoft Graph permissions (read-only)

- `AuditLog.Read.All` — query Copilot and agent action events via the Microsoft Graph audit API or the Purview portal
- `Files.Read.All` — resolve file metadata (name, site, sensitivity label) for files referenced in agent events
- `InformationProtectionPolicy.Read.All` — resolve sensitivity label names from label GUIDs in audit events

## Sources and compliance

- [Audit Copilot activities in the Microsoft Purview portal (Microsoft Learn)](https://learn.microsoft.com/en-us/purview/audit-copilot)
- [Purview Audit (Premium) — event retention and bandwidth (Microsoft Learn)](https://learn.microsoft.com/en-us/purview/audit-premium)
- Supports the Privacy Act 1988 (Cth) Notifiable Data Breach scheme — evidence that the breach was identified, scoped, and reported within 30 days
- Aligns with IRAP evidence requirement for audit log completeness (ISM Control 1405: Audit log contents)
- Pair with Admin Audit Trail Review for a complete audit assurance picture
- Output in Australian English