Quick answer. Microsoft 365 Copilot prompts and responses are kept or deleted by whatever Purview retention policy applies to them, a hold suspends their permanent deletion, and eDiscovery searches them until they are permanently deleted, because Microsoft stores them in a hidden mailbox folder. Counsel and records management decide how long.
If counsel, compliance or records management has asked you whether Copilot interactions are kept, whether they can be held and whether they can be produced, what they need from IT is how the platform behaves. The retention period and the records position are theirs to set; the mechanism below is what they will be deciding about.
Two Different Things Get Called the Copilot Record
If someone asks whether Copilot use is being recorded, separate the audit record from the interaction content before answering. Microsoft’s Considerations to manage Microsoft 365 Copilot and Channel Agent in Teams for security and compliance page, read on 2026-09-22, states that “Auditing captures the Microsoft 365 Copilot activity of search, but not the actual user prompt or response,” and it points to eDiscovery for the prompt and response themselves. The audit side, including how long audit records are kept, is covered in Is Your Microsoft Environment Ready for Copilot? What Must Be True First. Retention policies, holds and eDiscovery act on the content, which is the subject here.
Where Copilot Interactions Are Stored
If you look for Copilot history in the Copilot window, you are looking at what the user sees, not at what compliance keeps. Microsoft’s Learn about retention for Copilot & AI apps page, read on 2026-09-22, states that “Data from generative AI messages is stored in a hidden folder in the mailbox of the user who runs the AI app.” Microsoft adds on the same page that the folder “isn’t designed to be directly accessible to users or administrators, but instead, store data that compliance administrators can search with eDiscovery tools.”
Microsoft also warns on that page that “Messages visible in your AI apps are not an accurate reflection of whether they are retained or permanently deleted for compliance requirements.” Its considerations page notes that “Retention policies for Copilot interactions don’t inform users when messages are deleted as a result of a retention policy.” For Microsoft 365 Copilot in Teams, Microsoft’s considerations page lists an exception: “If transcripts are turned off, the capabilities for auditing, eDiscovery, and retention aren’t supported.”
When a user leaves and their Microsoft 365 account is deleted, Microsoft’s retention page says “their Copilot and other AI app messages that are subject to retention are stored in an inactive mailbox.” Microsoft states on the same page that “The messages remain subject to any retention policy that was placed on the user before their mailbox was made inactive, and the contents are available to an eDiscovery search.”
What a Retention Policy for Copilot Does
If your organization set up retention for Teams chats in the past, check which location your Copilot policy uses. The same Microsoft retention page states: “Previously, messages from Microsoft 365 Copilot and Microsoft 365 Copilot Chat were automatically included in the retention policy location named Teams chats and Copilot interactions because they were retained and deleted by using the same mechanisms.” Microsoft states on the same page that “Retention policies for Microsoft 365 Copilot and Microsoft 365 Copilot Chat are now separate from Teams chats,” and it lists three groups of locations for newly created policies: Microsoft Copilot experiences (Microsoft 365 Copilot, Security Copilot, Copilot in Fabric and Copilot Studio), enterprise AI apps, and other AI apps, the last two including third-party and consumer generative AI apps.
Security Copilot carries settings of its own beyond any records policy, and an organization planning its first agent can begin setting up Security Copilot governance by reviewing the owner settings, while every owner and contributor still has access to the preinstalled plugins until someone restricts them to owners.
What the policy covers depends on the app. Microsoft’s retention page states that “Retention policies for AI apps include user prompts and responses for Microsoft 365 Copilot and Copilot Studio, and also user prompts and responses for other Microsoft Copilots and generative AI apps when they have a collection policy with the setting to capture content.” Microsoft’s Microsoft Purview data security and compliance protections for generative AI apps page, read on 2026-09-22, says to “Use retention policies to automatically retain or delete user prompts and responses for AI apps,” and the retention page describes three shapes of policy: retain and then delete, retain only, and delete only.
If you expect a short delete setting to remove interactions quickly, Microsoft’s own timing says otherwise. According to Microsoft’s retention page, “The timer job typically takes 1-7 days to run,” and expired items move to a second hidden folder, SubstrateHolds, before they are permanently deleted. Microsoft states that “Until messages are permanently deleted from the SubstrateHolds folder, they remain searchable by eDiscovery tools,” and its worked example concludes that “a delete action after 1 day could take 16 days before the message is permanently deleted so that it’s no longer returned in eDiscovery searches.”
Why a Hold Wins Over a Delete Policy
When a hold and a delete policy both reach the same mailbox, Microsoft’s rule is that preservation wins. In Microsoft’s words on its retention page for Copilot and AI apps, “permanent deletion from the SubstrateHolds folder is always suspended if the mailbox is affected by another retention policy for the same location, Litigation Hold, delay hold, or if an eDiscovery hold is applied to the mailbox for legal or investigative reasons.” Microsoft’s Purview page on generative AI apps adds that “if more than one policy for the same location applies to a user, the principles of retention resolve any conflicts,” and Microsoft gives the example that “the data is retained for the longest duration of all the applied retention policies or eDiscovery holds.”
A short delete policy therefore does not remove interactions from a mailbox that a hold or a longer retention policy for the same location also covers. Whether and when a hold is placed or lifted is a decision for counsel, and nothing in the mechanism answers it.
Searching, Holding and Exporting Copilot Interactions
If counsel asks whether Copilot interactions can be produced, the mechanism is the one used for other mailbox content. Microsoft’s Purview protections page for generative AI apps states: “Because user prompts and responses for AI apps are stored in a user’s mailbox, you can create a case and use search when a user’s mailbox is selected as the source for a search query.” Microsoft describes a Copilot activity condition in the eDiscovery query builder and says on the same page that “This query condition includes all Copilot and other AI application activity.” Microsoft states on that page that “After the search is refined, you can export the results or add to a review set.”
In results, Microsoft’s Search for and delete AI application data in eDiscovery page, read on 2026-09-22, says each Microsoft 365 Copilot interaction is stored as an individual item in the user’s Exchange Online mailbox, and that its headers show the user’s address on one side and “The Copilot application identity” on the other.
The same Microsoft page describes a search-and-delete capability that is “intended to be an event-response tool,” and Microsoft states on that page: “Before you can delete Copilot or other AI application data from a mailbox, you have to remove any hold or retention policy that is assigned to a target mailbox.” Because using that tool means removing preservation first, it is a decision for counsel, not a routine clean-up.
Five Decisions to Take to Counsel and Records Management
Before anyone configures a policy, five decisions need an owner, and each one can be written down and signed:
- Records decision. Whether Copilot and other AI-app interactions are records for your organization, decided by counsel and records management.
- Scope decision. Which of Microsoft’s AI-app locations are in scope: Microsoft Copilot experiences, enterprise AI apps, other AI apps, or a subset.
- Period decision. How long interactions are kept and whether the policy deletes at the end of that period, knowing that a hold or another retention policy for the same location suspends permanent deletion.
- Access decision. Who may search interactions in eDiscovery, and who may approve removing preservation before any deletion.
- Evidence decision. How the signed position is recorded alongside an export of the configured policy and its locations, so the policy can be shown to match the decision.
The records decision outranks the other four: until counsel and records management settle whether interactions are records, the period, scope and access decisions have nothing to rest on.
When an Outside Architect Is Worth It
If the five decisions sit between IT, counsel and records management with nobody translating the mechanism, an outside architect can map what your tenant does today against what they decide. Delivery is senior and US-based. The ongoing program that follows, and who runs it, is covered in Hire a Firm for Microsoft 365 Copilot Governance After Deployment, within Embedding Governance into How the Enterprise Operates and Scales. If Purview itself is not yet in place, Microsoft Purview Technology Readiness Services covers getting ready.
Key Takeaways
- According to Microsoft, Copilot prompts and responses are stored in a hidden folder of the user’s mailbox, and what the user sees in Copilot does not show whether a message is retained.
- Audit records and interaction content are different things; retention, holds and eDiscovery act on the content.
- According to Microsoft, newly created retention policies use Copilot and AI-app locations that are separate from Teams chats.
- According to Microsoft, deletion under a retention policy is not immediate because it runs on a timer, and a hold or another retention policy for the same location suspends permanent deletion.
- Five decisions belong to counsel and records management: the records decision, the scope decision, the period decision, the access decision and the evidence decision. The records decision outranks the other four.
Frequently Asked Questions
How long are Microsoft 365 Copilot prompts and responses retained, and can they be placed on legal hold?
If your organization applies a Microsoft Purview retention policy to the Microsoft 365 Copilot location, Copilot prompts and responses are kept or deleted according to that policy, for the period counsel and records management set. According to Microsoft, permanent deletion is suspended when the mailbox is under Litigation Hold, an eDiscovery hold or another retention policy for the same location, so interactions can be preserved for a legal matter.
Where are Copilot interactions stored?
If you need to find them for compliance, look in the mailbox, not the Copilot window: according to Microsoft, messages from Copilot and other generative AI apps are kept in a hidden folder inside the mailbox of the user who ran the app. Microsoft says the folder is not designed for users or administrators to open directly and is searched with eDiscovery tools.
Can eDiscovery search Copilot prompts and responses?
Yes, when the user’s mailbox is the search source: according to Microsoft, prompts and responses for AI apps are stored in the user’s mailbox, so an eDiscovery case can search them, and Microsoft describes a Copilot activity condition for narrowing the search. Microsoft also says results can be exported or added to a review set.
Does deleting a Copilot chat delete the record?
Not necessarily, if a retention policy or a hold applies: according to Microsoft, what a user sees in an AI app does not reliably show whether a message has been retained or permanently deleted for compliance. Microsoft says messages remain searchable by eDiscovery tools until they are permanently deleted from a hidden folder, and a hold or another retention policy for the same location suspends that permanent deletion.
Talking Through Your Copilot Records Position
If counsel has asked a question about Copilot interactions that only the platform can answer, the next step is a conversation about how your tenant is set up today.
