|
| 1 | +--- |
| 2 | +title: Auditing data agent interactions in Microsoft Purview (preview) |
| 3 | +description: Learn how to use DSPM for AI to govern AI interactions in Data Agent. |
| 4 | +ms.reviewer: mayurjain |
| 5 | +ms.topic: how-to |
| 6 | +ms.date: 04/28/2026 |
| 7 | +--- |
| 8 | + |
| 9 | +# Audit Logging for Fabric Data Agent with Microsoft Purview (Preview) |
| 10 | + |
| 11 | +Microsoft Purview Data Security Posture Management (DSPM) for AI enables organizations to **monitor, audit, and investigate AI interactions** across Fabric Data Agents and Copilot experiences. |
| 12 | + |
| 13 | +With audit logging enabled, **user prompts, AI responses, and interaction metadata** are captured and stored in Microsoft Purview through the Microsoft 365 audit pipeline. |
| 14 | + |
| 15 | +[!INCLUDE [feature-preview](../includes/feature-preview-note.md)] |
| 16 | +--- |
| 17 | + |
| 18 | +## Prerequisites |
| 19 | + |
| 20 | +Ensure the following configurations are enabled before using audit logging: |
| 21 | + |
| 22 | +### 1. Enable Purview Audit |
| 23 | +- From DSPM for AI (classic) > Overview, in the Get Started section, look to see if auditing is on for your tenant. If not, select Activate Microsoft Purview Audit. |
| 24 | + |
| 25 | +### 2. Enable DSPM for AI Policy |
| 26 | +- In Microsoft Purview: |
| 27 | + - Enable the policy: |
| 28 | + **DSPM for AI – Capture interactions for Copilot experiences** |
| 29 | +For more information about one-click policies, see [Considerations for DSPM for AI](https://learn.microsoft.com/purview/dspm-for-ai-considerations#one-click-policies-from-data-security-posture-management-for-ai) |
| 30 | + |
| 31 | +### 3. Enable Fabric Tenant Setting |
| 32 | +- In the Fabric Admin Portal: |
| 33 | + - Turn on: |
| 34 | + **Allow Microsoft Purview to secure AI interactions** |
| 35 | + |
| 36 | +For more information about this option, see [Tenant settings index](https://learn.microsoft.com/fabric/admin/tenant-settings-index#information-protection). |
| 37 | + |
| 38 | +--- |
| 39 | + |
| 40 | +## Viewing Data Agent Audit Logs |
| 41 | + |
| 42 | +When a user interacts with a Fabric Data Agent, a Copilot Interaction audit record is created for the request as well as the response. |
| 43 | + |
| 44 | +Each audit record includes: |
| 45 | + |
| 46 | +- Timestamp |
| 47 | +- User identity |
| 48 | +- Application and agent details |
| 49 | +- Associated resources and metadata |
| 50 | +- User prompt or AI response |
| 51 | + |
| 52 | +All records are stored in the **Microsoft 365 unified audit log**. |
| 53 | + |
| 54 | +To review audit logs: |
| 55 | + |
| 56 | +1. Go to **Microsoft Purview Portal** |
| 57 | +2. Navigate to **DSPM for AI** |
| 58 | +3. Open **Activity Explorer** |
| 59 | +4. Look for records labeled **Copilot Interaction** |
| 60 | + |
| 61 | +:::image type="content" source="./media/data-agent-governance/purview-activity-explorer.png" alt-text="Screenshot showing Activity Explorer in Purview DSPM for AI." lightbox="./media/data-agent-governance/purview-activity-explorer.png"::: |
| 62 | + |
| 63 | +Each record represents a single interaction between a user and the Data Agent. |
| 64 | + |
| 65 | +Use Activity Explorer filters to locate specific interactions: |
| 66 | + |
| 67 | +- **Timestamp** |
| 68 | + Narrow results to a specific time window |
| 69 | + |
| 70 | +- **Activity Type** |
| 71 | + Filter by `Copilot Interaction` |
| 72 | + |
| 73 | +- **User** |
| 74 | + Identify activity by specific users |
| 75 | + |
| 76 | +- **Application** |
| 77 | + Isolate interactions from: |
| 78 | + - Fabric Data Agent |
| 79 | + - Other AI apps |
| 80 | + |
| 81 | +### User Prompt |
| 82 | +For each interaction, Microsoft Purview captures and logs the full text of the user’s prompt. |
| 83 | + |
| 84 | +:::image type="content" source="./media/data-agent-governance/purview-da-prompt.png" alt-text="Screenshot showing user prompt in Fabric data agent." lightbox="./media/data-agent-governance/purview-da-prompt.png"::: |
| 85 | + |
| 86 | +### Data Agent Response |
| 87 | +For each interaction, the response returned by the Data Agent including the natural language answer and structured outputs such as generated queries or code are logged. |
| 88 | + |
| 89 | + |
| 90 | +:::image type="content" source="./media/data-agent-governance/purview-da-response.png" alt-text="Screenshot showing Data Agent response from M365." lightbox="./media/data-agent-governance/purview-da-response.png"::: |
| 91 | + |
| 92 | + |
| 93 | +--- |
| 94 | + |
| 95 | +## Licensing and Costs |
| 96 | + |
| 97 | +Microsoft Purview now offers a combination of entitlement-based (per-user-per-month) and Pay-As-You-Go (PAYG) pricing models. The PAYG model applies to a broader set of Purview capabilities—including Insider Risk Management, Communication Compliance, eDiscovery, and other data security and governance solutions—based on copilot for Power BI usage volume or complexity. Purview Audit logging of Copilot for Power BI activity remains included at no additional cost as part of Microsoft 365 E5 licensing. This flexible pricing structure ensures that organizations only pay for what they use as data flows through AI models, networks, and applications. |
| 98 | + |
| 99 | +--- |
| 100 | + |
0 commit comments