Copilot retention: check policy scope

A Copilot retention review starts with the records your business needs to keep. Microsoft 365 Copilot is Microsoft's workplace AI assistant. An interaction includes the prompt someone submits and the response they receive. If staff use those interactions for business work, the person responsible for records needs to know which interactions a retention policy covers and what evidence supports that conclusion.

A retention policy tells the service whether to keep content, delete it, or keep it for a period before deletion. Microsoft Purview is the Microsoft service used to manage these policies. The name of a Teams policy, an available Copilot chat window or a successful search does not answer every retention question.

Start with the proposed business use, the people involved and the records requirement. Ask your administrator to match those requirements to the actual product, licences, policy scope and authorised retrieval arrangements. This is a review of current product guidance, not a new October feature announcement or a universal deadline to replace existing policies.

Establish which policy and product you are reviewing

Microsoft's Copilot retention guidance describes a Microsoft Copilot experiences location separately from Teams chats. A location is the category of content selected in the retention policy. Selecting Teams chats in a new policy should not be treated as evidence that the separate Copilot content is covered.

Existing policies need a more careful reading. Microsoft's retention policy configuration guidance says existing policies using the combined Teams chats and Copilot interactions location continue to be supported. Once a tenant supports the separate locations, those existing combined policies cannot be edited. A tenant is the organisation's Microsoft cloud environment.

That distinction matters when a provider proposes replacing an older policy. Its age or combined label does not establish that it has stopped working. Equally, general support in public documentation does not certify a particular organisation's configuration. Ask the administrator to reconcile the actual settings and any applicable tenant notice before approving a change. Record which document or notice supports the proposed action and when it was checked.

Name the exact Copilot experience being assessed. Do not extend the Microsoft 365 Copilot findings to every AI tool with a similar name. Microsoft describes different collection requirements for other AI applications, so those need their own assessment.

Separate interaction records from the documents they mention

Microsoft says the retention policy covers user prompts and responses, including links and references in those responses. Its guidance describes copies of message data stored in hidden folders in the user's Exchange mailbox. Authorised compliance administrators use eDiscovery to search those copies. eDiscovery is the process and tooling used to find relevant electronic records.

The chat history a user sees is not an accurate indication of compliance retention or permanent deletion. A missing conversation in that interface does not establish that its compliance copy has been deleted. A visible conversation does not, by itself, establish that the intended retention policy covers it.

A response containing a link is also different from the document behind that link. If the business needs to establish exactly which document version informed a decision, it must assess that requirement separately. Do not assume that keeping the interaction preserves the referenced file version. An audit event is another distinct record; do not substitute it for the full prompt and response without checking what it actually contains.

The records owner should state what the business needs to explain later. For example, that may include the interaction, the approved source material and the final human decision. This article does not prescribe a legal retention period or establish that every interaction needs the same treatment.

Verify the relevant entitlement before promising coverage

The Microsoft Purview service description distinguishes general retention licensing from retention for Copilot interactions. Its Copilot-specific list includes Microsoft 365 E3 or E5 with Microsoft 365 Copilot, as well as stated E3 and add-on combinations with Copilot.

Business Premium appears in the general retention list. That alone is insufficient evidence of Copilot-specific entitlement. Ask the administrator or licensing supplier to identify the exact subscriptions, users benefiting from the feature and intended policy scope against the applicable product terms. Additional capabilities, including adaptive scopes and retaining exact shared-document versions, have their own listed requirements.

Check retrieval capability as well. An organisation needs the relevant eDiscovery entitlement and an appropriately authorised person to carry out the review. A user being able to open Copilot does not establish either. Keep licence evidence, policy configuration and search permissions separate so a gap in one cannot be hidden by a pass in another.

Work through a fictional records decision

Consider a fictional engineering consultancy that wants two proposal writers to use Microsoft 365 Copilot when preparing customer quotations. The director asks whether the organisation can retrieve the interactions needed to explain a quotation review. The consultancy already keeps its approved quotations and supporting documents through an established records process.

All people, configurations, records and results in this example are hypothetical. They illustrate how to assess evidence, not a customer inspection or a test performed by this business.

The operations manager initially says, "We retain Teams chats, so the Copilot work is covered." The director asks for evidence before approving the proposed use. The records owner defines the interaction records required for this task and points to the consultancy's approved retention schedule. The administrator identifies the product, relevant users, policy location, action, period and distribution status. The licensing supplier confirms the applicable entitlement for those users. A separately authorised compliance reviewer owns retrieval checks.

The review establishes that an existing combined policy is present in this fictional tenant. The administrator records it as an existing supported policy, rather than declaring it broken because the interface also offers separate locations. The director does not approve replacement solely to obtain a newer policy name.

The evidence pack includes an existing, approved, non-sensitive validation interaction associated with one of the proposal writers. The reviewer expects to find it through the authorised compliance search route. The first search returns no matching result.

Investigate an empty search before drawing a conclusion

The reviewer records the missing result as unresolved. The administrator and reviewer check the intended identity, product, date range, policy scope, search permissions and processing state. They retain the original search details so the investigation can explain why the first result differed.

Microsoft says retention policies can take up to seven days to apply and directs administrators to distribution status in the policy details. For a newly created or changed policy, review that status and timing before interpreting an early check. Waiting seven days alone would not prove that the correct users or content were included.

In this fictional case, the reviewer finds that the first search used a date range that excluded the validation interaction. Correcting that range returns the expected prompt and response. The investigation closes the search-scope error; it does not establish that every record has been retained or that permanent deletion will work as intended later.

The decision record distinguishes those findings.

If the corrected search had still failed, the reviewer would keep the result open and the administrator or provider would investigate through the supported route. The team would not remove a hold, shorten a period or delete production content to make the check easier.

Complete the business decision without overstating the evidence

The director withholds approval of the proposed customer-quotation use because the required source-version evidence remains unresolved. Staff continue the existing approved quotation and document process. The corrected search procedure becomes part of the review record, but it does not remove that outstanding acceptance condition.

The document owner must identify how the required source version will be preserved and retrieved. The records owner must accept that arrangement alongside the interaction evidence. The director will reconsider the proposed use when those findings are complete. Nobody reports the project as approved simply because the second search found a record.

This outcome also leaves lifecycle questions with the appropriate owner. Microsoft's guidance distinguishes retain-only, delete-only and retain-then-delete behaviour. Background processing can delay deletion, and other applicable retention policies or holds can suspend permanent deletion. A retrieval check cannot certify the eventual treatment of every copy. Any lifecycle validation needs an agreed, supported plan appropriate to the actual records requirements.

For a real review, retain the decision, named responsibilities, policy and licence evidence, search references, failed checks and unresolved conditions in a restricted location. Review the decision again when the product, user population, policy, licences or records requirement changes. The ICT supplier risk management guide can help assign the questions your provider has not yet answered. For who can use a connector, the separate Copilot access review addresses that different control question.

My IT compliance consulting can help review control gaps, organise evidence and agree responsibilities for a prioritised improvement plan. Discuss your Copilot records review with the proposed business use and the evidence you cannot yet establish. Technical administration, licensing confirmation and any legal retention advice need their own agreed responsibilities.