Microsoft 365 Copilot

The Microsoft 365 Copilot connector reads Copilot activity from your tenant through Microsoft Graph and the Microsoft Purview unified audit log. No traffic is intercepted. With it, PromptGlass reports who uses Copilot in which apps (Teams, Outlook, Word, Excel, PowerPoint, Copilot Chat), how seat licenses are used, and which interactions touched sensitive files.

What you get

Data	Source	Used for
Copilot interaction events (CopilotInteraction)	Purview audit log via Office 365 Management Activity API	Usage by user, app, time; referenced resources
Copilot usage reports	Graph reports endpoints	Active users, app-level adoption
License assignments	Graph users / subscribedSkus	Seat utilization, idle seats
Prompt and response content	Graph aiInteractionHistory (where available to your tenant and license)	Detection, topic clustering, efficiency
Sensitivity labels of referenced files	Audit record resource metadata	Risk: Copilot answers grounded on Confidential content

Permissions

Create an app registration in Entra ID (or use the PromptGlass multi-tenant app with admin consent):

API	Permission (application)	Why
Office 365 Management APIs	ActivityFeed.Read	Audit log subscription
Microsoft Graph	Reports.Read.All	Copilot usage reports
Microsoft Graph	User.Read.All, Organization.Read.All	License and seat data
Microsoft Graph	AiEnterpriseInteraction.Read.All	Prompt/response content (optional)

Auditing must be turned on in Purview. It is on by default for most tenants. If report names are concealed (Display concealed user, group, and site names in all reports is off), usage reports arrive pseudonymized. PromptGlass then joins them by object ID instead.

Set up

promptglass connectors add m365-copilot \
  --tenant-id 00000000-0000-0000-0000-000000000000 \
  --client-id <app-id> --client-secret-env M365_SECRET \
  --content true --backfill 30d

Or go to Connectors → Microsoft 365 Copilot → Connect to use the admin-consent flow.

Latency

Audit events usually arrive in PromptGlass within 30 to 90 minutes, depending on Microsoft’s audit pipeline. Usage reports refresh daily. Because the connector is observe-only, use policies to alert, open tickets or coach users after the fact. Prevention for Microsoft 365 Copilot belongs in sensitivity labels and Purview DLP, and PromptGlass reports where those controls are missing.

Typical findings

• Seats assigned to users with no Copilot interactions in 30, 60 or 90 days. See cost optimization.
• Teams whose Copilot use is growing fastest, and which apps drive it.
• Interactions that referenced files labeled Highly Confidential.
• Copilot Chat (web-grounded) use compared with work-grounded use.