---
name: Purview AI Activity Explorer
description: Audits AI interaction data in the Microsoft Purview AI Hub activity explorer, surfacing prompt and response events, sensitive data access, and policy violations across Copilot and third-party AI apps.
---

# Purview AI Activity Explorer

> **TL;DR:** This skill queries the Microsoft Purview AI Hub activity explorer to surface every AI interaction — prompts, responses, files referenced, and sensitivity labels accessed — across Microsoft 365 Copilot and connected AI apps, producing a risk-ranked report for compliance and incident investigation.

## How does the Purview AI Activity Explorer skill audit AI interaction data?

Microsoft Purview AI Hub reached general availability in June 2026. Its activity explorer ingests AI interaction events from Microsoft 365 Copilot, Copilot Studio agents, and connected third-party AI applications, recording each prompt, the grounding files referenced, sensitivity labels accessed, and any policy violations triggered. This skill queries that activity data, groups events by user, app, and sensitivity tier, identifies anomalous interaction volumes and sensitive-label access patterns, and produces a ranked summary for compliance review, eDiscovery preparation, and insider risk triage. It is a prerequisite for demonstrating AI governance evidence under the Australian Essential Eight and PSPF protective marking requirements.

## When should you run this skill?

- "Audit what users are asking Copilot"
- "Show me AI interactions involving sensitive or protected files"
- "Produce AI activity evidence for the compliance team"
- "Investigate a suspected data exfiltration via Copilot"
- "Map AI interaction risk for our eDiscovery hold population"
- "Demonstrate AI governance controls for IRAP assessment"

## How this skill works, step by step

1. Open the Microsoft Purview portal and navigate to AI Hub → Activity explorer
2. Set the date range to the review period (default: last 30 days)
3. Filter to activity types: PromptSubmitted, ResponseReceived, FilesAccessed, PolicyViolation
4. Group by user to identify the top 20 users by AI interaction volume
5. Apply a sensitivity label filter to isolate events involving Confidential, Highly Confidential, or PROTECTED labels
6. Export the filtered dataset to CSV and load into the analysis template
7. For each policy violation event, capture: user UPN, timestamp, app name, violation policy name, and the sensitivity label of the referenced file
8. Compute a risk score per user: (policy violations × 3) + (sensitive label events × 2) + (interaction volume)
9. Cross-reference high-risk users against the current insider risk population in Purview Insider Risk Management
10. Produce the ranked table and summary below

## Output format

| User | AI App | Interactions (30d) | Sensitive Label Events | Policy Violations | Risk Score | Action |
| --- | --- | --- | --- | --- | --- | --- |
| `user@org.com` | M365 Copilot | 412 | 38 | 4 | High | Review insider risk profile |

Summary:

- Total AI interaction events in period: N
- Distinct users active: N
- Events involving Confidential or above: N
- Policy violations triggered: N
- Users referred to Insider Risk Management: N

## Scope and safety

Read-only — this skill queries and reports AI activity; it does NOT:

- Suppress, delete, or modify AI interaction logs
- Change DLP or communication compliance policies
- Access prompt or response content beyond metadata (label, app, timestamp)
- Take action on identified users

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Purview AI Hub and AI activity explorer | Microsoft 365 E5 Compliance or Microsoft Purview add-on |
| AI interaction data from Microsoft 365 Copilot | Microsoft 365 Copilot licence per user |
| Policy violation correlation | Microsoft Purview Communication Compliance or DLP (included in E5 Compliance) |

### Least-privilege roles

- Compliance Administrator (read AI Hub activity, export logs)
- Insider Risk Management Analyst (cross-reference insider risk population)

### Microsoft Graph permissions (read-only)

- AI Hub activity explorer data is accessed through the Microsoft Purview portal; export is via portal UI or the Purview audit API
- `AuditLog.Read.All` — to query unified audit log for AI interaction events via Graph or PowerShell
- `InformationProtectionPolicy.Read.All` — read sensitivity label definitions for label-name resolution in reports

## Sources and compliance

- [Microsoft Purview AI Hub overview (Microsoft Learn)](https://learn.microsoft.com/en-us/purview/ai-microsoft-purview)
- [Secure data as AI scales: New Microsoft Purview innovations at RSA 2026](https://techcommunity.microsoft.com/blog/microsoft-security-blog/secure-data-as-ai-scales-new-microsoft-purview-innovations-at-rsa-2026/4503665)
- Supports Essential Eight ML2 evidence for Control 7 (user application hardening — AI application monitoring)
- Pair with DSPM for AI Remediation to address data access risks surfaced by this audit
- Aligns with PSPF Requirement 4 — access to OFFICIAL: Sensitive and above must be auditable
- Output in Australian English