Work Copilot chats are stored and searchable in Microsoft Purview. Here's what IT, compliance and your manager can and can't see.
Yes, in specific ways. If you use Microsoft 365 Copilot or Copilot Chat with your work account, your prompts and Copilot's responses are stored as organizational data. People in your organization with the right compliance roles can search and export them through Microsoft Purview eDiscovery.
That is not the same as your manager having a live feed of your chats. Access depends on roles, licensing, retention settings and a legitimate reason to look.
The better question is not "is Copilot private?" It is private from whom, in which Copilot, and under which controls? This guide answers that for Microsoft 365 Copilot and work-account Copilot Chat. Copilot used with a personal Microsoft account follows different rules.
Not by default. Being someone's manager in Microsoft 365 gives no access to their Copilot conversations, email or Teams chats. To reach the content of Copilot interactions, a person needs Microsoft Purview permissions such as eDiscovery roles or access to AI interaction details in Activity explorer. In most organizations, those roles sit with a small compliance, legal or security team, not with line managers.
If a concern is raised through HR or legal, an authorized investigator can retrieve your Copilot history as part of a formal process, the same way they could retrieve your work email.
Yes, at the activity level. Copilot usage reports in the Microsoft 365 admin center show who is licensed, who is active, and the last date someone used Copilot in apps such as Word, Outlook, Teams and Copilot Chat. They do not show what you asked.
By default, these reports hide usernames and display names. A Global Administrator can turn on a setting to show identifiable user information, and that change is itself recorded in the Purview audit log. Many organizations keep names hidden and look only at adoption trends.
Audit logs go a step further. Every Copilot interaction creates a CopilotInteraction audit record showing who used Copilot, when, in which app, and which files or resources were referenced. The record identifies the conversation, but it is not a transcript of the prompt and response.
Authorized compliance staff can. Microsoft stores Copilot prompts and responses in a hidden folder in the Exchange Online mailbox of the person who used Copilot. Users and regular admins can't browse that folder directly. It exists so compliance teams can apply retention policies and search the content with eDiscovery.
Retention policies decide how long these records exist. An organization can keep Copilot interactions for a set period, delete them after a set period, or both. If a mailbox is on legal hold, the records are preserved even if you delete your Copilot activity history from your account. When someone leaves the organization, retained Copilot messages move to an inactive mailbox and remain searchable.
Copilot visibility is not a single "view chats" switch. Each tool answers a different question and needs different permissions.
With the right Purview setup and licensing, admins get detailed audit trails across supported apps. Licensing also affects how long audit data is kept, with longer retention available in Audit (Premium).
Practical takeaway: being able to see that someone used Copilot does not, on its own, establish permission to read their conversations.
Everything above applies when you are signed in to Copilot with your work or school account. If you use the consumer Copilot app with a personal Microsoft account, those conversations are not stored in your employer's Microsoft 365 tenant, and your employer's Purview tools don't reach them. Your organization may still restrict or monitor personal AI tools through other policies, so check before putting work information into one.
This visibility exists for compliance and security, not surveillance. Microsoft 365 Copilot Chat is covered by enterprise data protection, so prompts and responses receive the same contractual protections as email in Exchange and files in SharePoint. That same protection means they are treated as business records.
Generative AI also makes it easier to surface sensitive content that was already overshared. IBM's 2025 Cost of a Data Breach report puts the global average cost of a breach at roughly $4.4 million. If SharePoint permissions are too broad, Copilot can surface sensitive material to people who technically have access, even when that access was never intended.
Strong governance reduces those risks by tightening access, monitoring AI activity and improving the quality of the data Copilot draws from. Use DSPM for AI to identify risky Copilot interactions.
Most employee anxiety about Copilot comes from not knowing the rules. A short, published policy removes the guesswork and protects adoption.
2toLead helps organizations set up Copilot governance that holds up to compliance review and still gets adopted. Book office hours with our team to talk through your policy.
Authorized compliance staff can search and export stored prompts and responses from work-account Copilot through Microsoft Purview eDiscovery. Access requires specific roles and is normally limited to formal investigations or legal requests.
Not directly. Managers have no default access to their team's Copilot conversations. Access sits with compliance roles in Microsoft Purview.
Yes. Usage reports and audit logs show when and where you used Copilot. Usage reports hide names by default, and neither shows the text of your prompts.
Possibly. Deleting your activity history removes it from your view, but a retention policy or legal hold can keep a copy that eDiscovery can still find.
No. Copilot used with a personal Microsoft account isn't stored in your employer's Microsoft 365 tenant.
Last reviewed: October 20, 2026
Join Our Newsletter
