MC1169075 – Microsoft 365 Admin Center: Admin Audit logs in Purview (archived)

Product:

Copilot, Entra, Microsoft 365 admin center, Purview, Purview Communication Compliance, Purview compliance portal

Platform:

Online, Web, World tenant

Status:

Launched

Change type:

New feature, User impact, Admin impact

Links:

498227

Details:

Summary:
Microsoft 365 now logs admin activities related to Copilot agent management in Microsoft Purview Unified Audit Logs, enhancing security visibility. This feature, enabled by default from late October to mid-November 2025, captures actions like deploy, update, and setting changes, accessible via the Purview Portal without extra configuration.

Details:
Updated October 28, 2025: We have updated the content. Thank you for your patience.
[Introduction]
Admin activity related to agent management will now be logged in Microsoft Purview Unified Audit Logs. This enhancement improves visibility and traceability for security teams managing Copilot agents across Microsoft 365 services.
This message is associated with Microsoft 365 Roadmap ID 498227.
[When this will happen:]
General Availability (Worldwide): Rollout will begin in late October 2025 and is expected to complete by mid-November 2025.
CategoryActionsRecord TypesRelease Timeline
Agent Management Block, Unblock, Deploy, Update, Remove AgentAdminActivityOctober
CategoryActionsRecord Types Release Timeline
Agent Management Publish, Reject, DeleteAgentAdminActivity November
Agent Tenant Settings Tenant agent setting, 1P, 3P and LOB ToggleAgentSettingsAdminActivity November

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability

Created:
2025-10-10

updated:
2025-10-28

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Increased Admin Oversight
The logging of admin activities related to Copilot agent management may lead to an overwhelming amount of data for admins to sift through, potentially causing delays in identifying critical issues.
   - roles: IT Admin, Security Officer
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=498227

Compliance Reporting
The new audit logs may require additional training for admins to effectively utilize the Purview Portal for compliance reporting, leading to a temporary decrease in productivity.
   - roles: Compliance Officer, IT Admin
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=498227

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft 365 has introduced a new feature that enhances the way admin activities are tracked, specifically focusing on the management of Copilot agents. Imagine you're a librarian who needs to keep track of every book that comes in and out of the library. Previously, you might have only noted down the most significant changes, like new book arrivals or major reorganizations. Now, with this new system, every action related to book management—such as lending, returning, or even shifting books between shelves—is recorded automatically. This means you have a comprehensive log of all activities, which can be invaluable for security and compliance purposes.

In this context, Microsoft Purview Unified Audit Logs act like a detailed ledger for IT administrators. From late October to mid-November 2025, Microsoft has started logging every admin action related to Copilot agents. This includes deploying, updating, or changing settings of these agents. Just like the librarian's detailed records, these logs provide a clear trail of what actions were taken, by whom, and when. This feature is automatically enabled, so administrators don't need to configure anything to start benefiting from this enhanced visibility.

The logs are accessible through the Purview Portal, which is like the librarian's digital catalog. Here, security teams can search and review all agent-related admin actions. This capability helps organizations ensure they are meeting regulatory standards and maintaining oversight of their digital environment, much like how a library ensures it is managing its collection responsibly.

In summary, this new logging feature in Microsoft 365 provides a more detailed view of admin activities, enhancing security and compliance. It's like moving from a simple guestbook to a sophisticated security system that tracks every movement within a building, ensuring that nothing goes unnoticed.