Control 1.7 — Portal Walkthrough: Comprehensive Audit Logging and Compliance

Control ID: 1.7 — Comprehensive Audit Logging and Compliance Pillar: 1 — Security & Identity Last UI Verified: May 2026 Technical claims reviewed: 2026-10-16 against Microsoft Learn; tenant UI not tested. Estimated Time: 4–8 hours initial buildout (single tenant); 60–120 minutes per environment for Dataverse audit enablement; 30–45 minutes per quarterly evidence-pack refresh Audience: Purview Audit Admin, Purview Compliance Admin, Exchange Online Organization Configuration role holder, SOC Analyst, Power Platform Admin, Entra Security Admin, Azure Storage Account Owner Prerequisites: Microsoft 365 E5 (or Office 365 E5 / Microsoft Purview Suite / E5 eDiscovery & Audit add-on) per Copilot user; per-user 10-Year Audit Log Retention add-on for any user placed on a documented 10-year capture-window policy; Exchange Online PowerShell module v3.0+; Azure subscription for immutable blob storage (if WORM export is in scope); change-management ticket open for any tenant-wide audit ingestion change.

READ FIRST — Scope and Sibling Routing

This walkthrough operationalizes the capture plane of Control 1.7: how Microsoft 365 Audit (Standard, Premium, and the 10-Year Audit Log Retention add-on), Dataverse environment audit, and Entra agent sign-in telemetry are enabled, scoped, retained, and exported as evidence for FINRA, SEC, OCC, NYDFS, CFTC, and Federal Reserve examinations.

This walkthrough IS:

The portal-side procedure for verifying / enabling unified audit logging, validating per-user license entitlement, authoring Audit (Premium) custom retention policies that explicitly cover the Copilot record types, enabling pay-as-you-go (PAYG) collection for non-Microsoft AI app interactions, configuring Dataverse environment-level and Microsoft Copilot Studio per-table audit, capturing Entra agent sign-in telemetry, and exporting evidence to a Cohasset-attested 17a-4(f) preservation layer.
The point-in-time capture-trail runbook examiners walk during books-and-records examinations.

This walkthrough is NOT (route to the linked sibling):

Topic	Where it lives
Retrieving the prompt and response body for a `CopilotInteraction` audit record	Control 1.6 — DSPM for AI, Control 1.19 — eDiscovery (Premium) for Agent Interactions, Control 1.10 — Communication Compliance Monitoring
DLP policy authoring and sensitivity-label enforcement on Copilot data flows	Control 1.5 — DLP and Sensitivity Labels
Communications supervisory review of AI-generated messages for FINRA Rule 3110	Control 2.12 — Supervision and Oversight
Records-management retention/disposition labels distinct from audit retention	Control 1.9 — Data Retention and Deletion Policies and the Records Management retention label set documented in your firm's records schedule
Incident reporting and root-cause documentation when an audit gap is discovered	Control 3.4 — Incident Reporting and Root-Cause Analysis
Sentinel ingestion rules, KQL detections, and SIEM-side correlation	Control 3.9 — Microsoft Sentinel Integration

If your task maps to a row above, stop and route to the linked playbook. Continuing here will produce duplicate or conflicting evidence — and, worse, may give the false impression that the audit log alone preserves prompt and response content (it does not).

Capture vs Preservation — the central non-substitution warning

Microsoft 365 Audit (Standard, Premium, and the 10-Year Audit Log Retention add-on) is record-CAPTURE operational telemetry. It is not, by itself, a SEC Rule 17a-4(f)–compliant electronic recordkeeping system for the books-and-records record set. Broker-dealers, FCMs, swap dealers, and CPOs subject to SEC 17a-4 / FINRA 4511 / CFTC 1.31 must satisfy preservation through one of:

WORM-format storage of the books-and-records record set — for example, Azure immutable blob storage with a time-based retention policy in a locked state. Cohasset Associates has issued an attestation that this configuration meets the non-rewriteable, non-erasable storage requirements of SEC 17a-4(f), CFTC 1.31, and FINRA 4511. See Microsoft Learn: Immutable storage for Azure blob data.
The audit-trail alternative introduced by the SEC's October 2022 amendments to Rule 17a-4(f) (compliance date 3 May 2023), which requires the system to preserve original records and a complete time-stamped audit trail of all modifications and deletions, plus a Designated Executive Officer (DEO) representation or a Designated Third Party (DTP) undertaking, plus an independent records-management assessment.

A defensible 17a-4(f) program for AI agent communications typically combines three layers:

Microsoft 365 Audit (this control) — for activity capture and the join key.
DSPM for AI / eDiscovery (Premium) / Communication Compliance (Controls 1.6, 1.19, 1.10) — for content retrieval from the Microsoft 365 Substrate.
A 17a-4(f)-attested archive for preservation — either Azure immutable blob storage (Cohasset-attested) or a SEC 17a-4-attested third-party books-and-records vendor such as Smarsh Enterprise Archive, Global Relay Archive, Proofpoint Enterprise Archive, Mimecast Cloud Archive, Bloomberg Vault, or Veritas Enterprise Vault.cloud.

Do not rely on the 10-year audit retention add-on as your 17a-4(f) preservation layer. The 10-year add-on extends the audit capture window; it does not transform Microsoft 365 Audit into a non-rewriteable, non-erasable record store with an attached DEO/DTP undertaking.

Hedged-Language Reminder (Mandatory)

Throughout this playbook — and in any derivative runbook, ticket template, attestation memo, or examiner-response narrative — the following overclaim phrases must not appear:

"ensures compliance with..." → use "supports compliance with..." or "helps the organization meet..."
"guarantees..." → use "is designed to..."
"will prevent..." → use "is intended to reduce the likelihood of..."
"eliminates the risk of..." → use "helps mitigate..."

Microsoft 365 Audit, DSPM for AI, eDiscovery, and Communication Compliance reduce risk surface and produce evidence; they do not produce a legal compliance guarantee. Examiners and outside counsel read every audit narrative; an unhedged sentence in a 17a-4 attestation is the single fastest way to convert a routine inquiry into a finding. When in doubt, attach: "Implementation requires sustained operator discipline; organizations should verify configuration against current regulatory expectations and their own legal counsel's interpretation."

License Requirements

Audit retention beyond the 180-day Audit Standard default depends on per-user licensing. Verify entitlement before configuring retention policies — without the user-side license, retention silently caps at 180 days regardless of the policy you create.

Retention horizon	Required per-user license
180 days (Audit Standard default)	Any commercial M365 enterprise SKU
1 year for `AzureActiveDirectory` / `Exchange` / `OneDrive` / `SharePoint` only (non-modifiable default policy)	Microsoft 365 E5, Office 365 E5, Microsoft Purview Suite (formerly M365 E5 Compliance), or M365 E5 eDiscovery and Audit add-on
Custom audit retention policy covering any non-default workload (including all Copilot record types)	Same as above (Audit Premium entitlement)
Up to 10 years	All of the above plus the per-user 10-Year Audit Log Retention add-on
`AIAppInteraction` (non-Microsoft AI apps captured via network/browser DLP under the `AIApp` workload)	Audit pay-as-you-go (PAYG); explicit enablement; 180-day retention for PAYG records; consumption billed against an Azure subscription
Microsoft-built Copilot / Copilot Studio agent `CopilotInteraction` and `ConnectedAIAppInteraction` events	Included in Audit (Standard) at no incremental cost (verify per-workload scope on Microsoft Learn before assuming)

§0 — Coverage Boundary, Capture vs Content, and Portal-vs-PowerShell Decision Matrix

0.1 What Control 1.7 Owns vs. What It Doesn't

Control 1.7 owns operational telemetry capture for Microsoft 365 Copilot and agent activity: who invoked which agent, when, against what resources, with what model provider, and whether jailbreak / cross-prompt-injection (XPIA) detection fired. It also owns the retention of that telemetry inside Microsoft Purview Audit and the export / preservation of that telemetry into a 17a-4(f)-attested archive.

In scope for 1.7	Out of scope for 1.7 (linked control)
Verifying / enabling unified audit logging tenant-wide	Capturing the human supervisory review of AI-generated communications (2.12)
Authoring Audit (Premium) custom retention policies that explicitly include the Copilot record types	Authoring DLP policies that block sensitive data in Copilot prompts (1.5)
Enabling PAYG collection for `AIAppInteraction` (non-Microsoft AI apps via network/browser DLP)	Reviewing the prompt and response body text of a captured `CopilotInteraction` (1.6, 1.19, 1.10)
Enabling Dataverse environment-level audit and per-table audit on the six Copilot Studio entities	Authoring the Copilot Studio agent sponsorship and lifecycle workflow (Control 1.2)
Configuring Entra `agentSignIn` log forwarding to a Log Analytics workspace	Writing Sentinel KQL detection rules against the forwarded data (3.9)
Configuring Azure immutable blob storage for WORM export of audit artifacts	Drafting the Designated Executive Officer (DEO) representation or Designated Third Party (DTP) undertaking required by the 17a-4(f) audit-trail alternative
Reporting an audit-pipeline gap as a finding	Running the root-cause analysis on that gap (3.4)

0.2 Audit Record vs Conversation Content — Where the Text Actually Lives

This is the most consequential design distinction in the entire control. Get it wrong and the firm will wrongly tell an examiner that "the audit log preserves the AI conversation."

Layer	What it carries	Where it lives	Retrieval surface
Audit record (`CopilotInteraction`)	Timestamps, `UserId`, `AgentId`, `AgentName`, `AgentVersion`, `Messages[].ID`, `Messages[].IsPrompt`, `Messages[].JailbreakDetected`, `AccessedResources[].XPIADetected`, `ModelTransparencyDetails.ModelProviderName`. Not the prompt or response body text.	Microsoft Purview unified audit log (workload `Copilot`)	Purview Audit search; `Search-UnifiedAuditLog`; Audit Search Graph API; Office 365 Management Activity API
Conversation content	Full prompt text and full response text for Microsoft 365 Copilot interactions	Microsoft 365 Substrate — the per-user Copilot interaction history mailbox	DSPM for AI (1.6) for compliance-manager transcript view; eDiscovery (Premium) (1.19) for legal hold / collection / review; Communication Compliance (1.10) for FINRA Rule 3110 supervisory review

Compliance-design implication: the audit log is the evidence trail and the join key; the Substrate (via DSPM / eDiscovery / Comm Compliance) is the content store. A SEC 17a-4(b)(4) communications-retention program for Copilot must address both, and (for broker-dealers) export both into the firm's 17a-4(f)-attested preservation layer. §3 of this walkthrough shows how to navigate from a Purview Audit search hit to each of the three content-retrieval surfaces.

0.3 Portal-vs-PowerShell Decision Matrix

Task	Portal	PowerShell	Notes
Verify `UnifiedAuditLogIngestionEnabled`	⚠️ Not exposed	✅ Required	Must run from Exchange Online PowerShell — Security & Compliance PowerShell always returns `False`
Enable unified audit logging	✅ Audit solution banner	✅ `Enable-OrganizationCustomization`-gated	Portal is the simpler change-managed path
Author custom audit retention policy	✅ Audit > Policies	✅ `New-UnifiedAuditLogRetentionPolicy`	Portal for first-time setup, PowerShell for bulk lifecycle
Associate PAYG subscription for applicable AI collection	✅ Settings > Account details	Verify feature/policy separately	Initial association requires Entra Global Admin
Search and export	✅ Audit > Search	✅ `Search-UnifiedAuditLog -SessionCommand ReturnLargeSet`	Portal maximum window: 180 days; export: 50,000 rows Standard / 1,000,000 Premium. PowerShell has distinct 5,000-per-call / 50,000-per-session limits
Dataverse environment-level audit	✅ PPAC > Audit and logs	✅ Power Platform CLI / Dataverse Web API	Portal is the documented path
Per-table audit on Copilot Studio entities	✅ Maker portal > Tables	✅ Dataverse Web API	Portal preferred for the six-entity scope
Agent sign-in forwarding	✅ Entra > Diagnostic settings	✅ `New-AzDiagnosticSetting`	Select supported sign-in categories; `agentSignIn` is an event type, not a documented diagnostic category
Azure immutable blob policy	✅ Storage container > Access policy	✅ `Set-AzRmStorageContainerImmutabilityPolicy`; `Lock-AzRmStorageContainerImmutabilityPolicy`	Review before irreversible locking; verify state separately

Where this walkthrough invokes PowerShell, it does so for verification or for tasks the portal does not expose. Operational extraction at scale belongs in PowerShell Setup.

§1 — Pre-Flight Gates (Run Before Any Configuration Change)

1.1 Roles required for this walkthrough

Use the canonical short names from the role catalog. Verify role assignments in Entra ID > Roles & administrators and in the Exchange admin center role groups.

Task	Required role	Notes
Verify audit ingestion status	Purview Compliance Admin (with `View-Only Audit Logs`) or Entra Global Reader	Run `Get-AdminAuditLogConfig` from Exchange Online PowerShell
Enable unified audit logging	Purview Audit Admin (Exchange `Audit Logs` role)	Tenant-wide — change-managed
Search audit logs	Purview Compliance Admin or holder of `Audit Logs` / `View-Only Audit Logs`	Purview Audit solution
Author / modify audit retention policies	Exchange Organization Configuration role	Purview Compliance Admin alone is NOT sufficient for retention policy create/modify (per Microsoft Learn)
Enable Dataverse environment audit	Power Platform Admin (or Dynamics 365 Admin)	Per environment
Configure supported sign-in category forwarding for agents	Entra Security Admin	Tenant-wide diagnostic setting
Configure Azure immutable blob storage	Azure Storage Account Owner / Contributor	Subscription-level RBAC
Enable PAYG billing association	Entra Global Admin	Active Azure subscription and resource group in the same tenant; documented enablement

1.2 License inventory snapshot (mandatory first step)

Audit retention policies that exceed the entitlement of the underlying user silently fail open at 180 days. This is the single most common audit finding in US FSI tenants. Before authoring any retention policy:

Open https://admin.microsoft.com > Billing > Licenses.
Capture the assigned counts for each of: Microsoft 365 E5, Office 365 E5, Microsoft Purview Suite, E5 eDiscovery and Audit add-on, 10-Year Audit Log Retention add-on.
Cross-reference against the user list assigned a Microsoft 365 Copilot license (any user without one of the four Audit Premium SKUs above caps at 180 days; any user assigned to a documented 10-year capture-window policy without the 10-Year add-on caps at 1 year).
Export the user × SKU × add-on matrix to CSV; SHA-256 hash and add to the evidence pack as Control-1.7_{Tenant}_LicenseMatrix_{YYYYMMDD-UTC}.csv plus .sha256 sidecar.

1.3 Change-management gate

For any change to tenant-wide audit ingestion (§2), retention policy (§5), PAYG enablement (§6), or supported sign-in forwarding for agents (§8), open a change ticket that records:

The pre-change state (the PowerShell verification output captured in §2.1).
The intended post-change state.
The named approver (typically the FSI Compliance Officer or Records Officer).
The rollback step.
The post-change verification timestamp and result.

§2 — Verify (or Enable) Unified Audit Logging

2.1 Verify status first (do not assume)

Audit-on-by-default has applied to Microsoft 365 enterprise tenants since January 2019. It is not on by default for Business Basic / Business Standard / Business Premium SKUs or for unmanaged trial tenants. Before enabling, verify status:

# Run from Exchange Online PowerShell — NOT Security & Compliance PowerShell
Connect-ExchangeOnline -ShowBanner:$false
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

Expected for enterprise tenants: UnifiedAuditLogIngestionEnabled : True.
Capture this output as evidence even if no change is required: Control-1.7_{Tenant}_AuditConfig_{YYYYMMDD-UTC}.json plus SHA-256 sidecar.

The same cmdlet from Security & Compliance PowerShell always returns False

Per Microsoft Learn, Get-AdminAuditLogConfig exists in both Exchange Online PowerShell and Security & Compliance PowerShell, but UnifiedAuditLogIngestionEnabled is always reported as False from S&C PowerShell regardless of true tenant state. Always run this check from Exchange Online PowerShell, and verify your active connection URI before trusting the result:

(Get-ConnectionInformation | Where-Object State -eq 'Connected').ConnectionUri
# Expected: outlook.office365.com  (Commercial)
# Expected: outlook.office365.com (commercial)
# If URI is ps.compliance.protection.outlook.com, you are in S&C PowerShell — reconnect via EXO.

2.2 Enable if status is `False`

In the Microsoft Purview portal:

Open https://purview.microsoft.com.
From the left navigation, open the Audit solution.
If the "Start recording user and admin activity" banner is shown, click it.
Confirm the change in the §1.3 change-management ticket.
Wait up to 60 minutes for configuration propagation; ingestion of events into the audit log can take longer (Microsoft does not commit to a specific time).
Re-run the §2.1 verification and capture the post-change output as evidence.

§3 — Search the Audit Log and Navigate from Record to Content

3.1 Run a Copilot / agent audit search

In the Purview portal:

Open Audit > New search.
Set Date and time range (UTC) for the period of interest. The portal search window is capped at 180 days; for longer windows use PowerShell Search-UnifiedAuditLog -SessionCommand ReturnLargeSet paginated to completion, or the Audit Search Graph API (supported on both Audit Standard and Audit Premium).
In Record types, select the Copilot / agent types in scope:
- CopilotInteraction — Microsoft 365 Copilot interactions.
- ConnectedAIAppInteraction — Connected AI app interactions (Microsoft-built Copilot Studio agents at no incremental cost; some non-Microsoft AI app scenarios under this RecordType are PAYG-billable — see §6).
- AIAppInteraction — Non-Microsoft AI assistance events captured via network/browser DLP under the AIApp workload (PAYG-only — see §6; 180-day retention for PAYG records).
- PowerPlatformAdministratorActivity — Copilot Studio admin / agent lifecycle activity.
- Power Platform: PowerPlatformAdministratorActivity, MicrosoftFlow, PowerAppsApp (as applicable).
Optionally filter by Users, File, folder, or site, or Admin Units.
Enter a Search name (e.g., Q3-2026-FraudTriageAgent-Reconstruction).
Click Search. Searches run asynchronously, search jobs persist for 30 days, and there is a per-admin cap of 10 concurrent jobs (1 unfiltered). Refresh the search list to monitor completion.
When complete, Export results to CSV and immediately:
- Compute SHA-256 over the CSV; save the hash sidecar.
- Copy the CSV plus sidecar into the §10 immutable blob container within the search-job 30-day retention window.

PowerPlatformAdminActivity is NOT a valid RecordType

Use PowerPlatformAdministratorActivity, not PowerPlatformAdminActivity, for these authoring events. Check Get-Help Search-UnifiedAuditLog -Parameter RecordType and the current cmdlet reference; reject errors and verify a known event rather than treating empty results as proof of collection.

Activity vs operation vs record type

The Purview Audit search UI separates friendly activity names, operation names, record types, workloads, and the search name field. These are different fields with different valid values. Earlier drafts of this playbook listed activity-style names like AgentCreated, AgentModified, AgentInteraction — these are not in the published Microsoft Learn schema and will return zero results. Use the record-type names in step 3 above. To discover specific operation names, run a small RecordType search and inspect the Operation field of returned records.

3.2 From a `CopilotInteraction` audit record to the conversation content

The audit record carries metadata only. To retrieve the prompt and response body text, navigate to the appropriate content surface:

Navigation goal	Portal path	Sibling control
Compliance manager wants to view chat transcripts for `CopilotInteraction` events	`https://purview.microsoft.com` > DSPM for AI > Activity explorer — locate the matching event by user, agent, and timestamp; open the activity to view the linked transcript surface	Control 1.6
Legal needs to place hold, collect, and review Copilot interactions across custodians	`https://purview.microsoft.com` > eDiscovery > Premium > create case > add custodians > create hold > collection query targeting the Copilot interactions location for those custodians	Control 1.19
Designated supervisor needs FINRA Rule 3110 supervisory review of AI-generated communications	`https://purview.microsoft.com` > Communication Compliance > Policies — confirm a policy is scoped to Copilot interactions; review hits in the Pending review queue	Control 1.10

The audit record's Messages[].ID value is the join key the eDiscovery / DSPM surfaces use internally. Capture the audit record CSV alongside any content extract so the join is reproducible.

§4 — Audit Standard vs Audit Premium vs 10-Year Add-On vs PAYG

Feature	Audit Standard	Audit Premium (E5 / Purview Suite / E5 eDiscovery & Audit add-on)	10-Year Audit Log Retention add-on	Audit PAYG
Default retention	180 days (changed from 90 days on 2023-10-17; pre-October-2023 records still 90-day)	1-year non-modifiable default policy for `AzureActiveDirectory` / `Exchange` / `OneDrive` / `SharePoint` per E5 user	10 years for any record explicitly named in a custom retention policy, per-user-licensed	180 days for PAYG-captured records
Custom retention policies (other workloads, including all Copilot record types)	⛔ Not supported	✅ Supported (per-user license required)	✅ Required to extend any custom policy past 1 year	⛔ PAYG records use the 180-day fixed retention
Up to 10-year retention	⛔	⛔ (capped at 1 year without add-on)	✅	⛔
Audit Search Graph API	✅	✅	✅	✅
Higher-bandwidth Office 365 Management Activity API	Standard limit	Higher bandwidth per Learn	Same as Premium	Same as Premium
Intelligent insights / High-value events (e.g., `MailItemsAccessed`, `Send`)	⛔	✅	✅	n/a
Microsoft-built Copilot / Copilot Studio interaction events (`CopilotInteraction`, in-scope `ConnectedAIAppInteraction`)	✅ at no incremental cost (verify per-workload scope on Learn)	✅	✅	n/a
`AIAppInteraction` for non-Microsoft AI apps (network/browser DLP `AIApp` workload)	⛔	⛔ unless PAYG enabled	⛔ unless PAYG enabled	✅ — explicit enablement; 180-day retention; consumption billed against an Azure subscription
Per-user license required at event ingestion time	n/a (universal)	✅ Yes — without it, retention silently caps at 180 days	✅ Yes — without the add-on, retention silently caps at 1 year	n/a (PAYG fixed retention)

Native Audit retention durations include 3, 5, 7, and 10 years with the 10-Year add-on; there is no 6-year option. Use the record-class schedule as the governing rule — 3 years for communications, 6 years for financial/accounting or governance records, 5 years for CFTC records, and longer only where a specific rule or the firm's records schedule requires it. Select an available capture duration deliberately; the add-on name does not require a 10-year policy. See supported durations and licensing.

§5 — Create a Custom Audit Retention Policy

Required role: Organization Configuration

Authoring or modifying audit retention policies requires the Exchange Organization Configuration role. The Purview Compliance Admin role alone returns access denied on policy creation. Confirm role assignment before starting this step.

The default Audit (Premium) retention policy covers only four workloads

The platform default Audit (Premium) retention policy covers only AzureActiveDirectory, Exchange, OneDrive, and SharePoint. Copilot record types (CopilotInteraction, ConnectedAIAppInteraction, PowerPlatformAdministratorActivity, AIAppInteraction) silently fall back to 180 days unless a custom policy explicitly names them. This is a non-obvious default — verify against Microsoft Learn: Audit log retention policies before you assume otherwise.

In the Purview portal Audit solution, open Policies > Create audit retention policy.
Enter a descriptive Policy name that encodes the zone and intent (e.g., FSI-Zone3-Copilot-10y, FSI-Zone2-Copilot-1y).
Set Duration to a documented option: 7 Days, 30 Days, 6 Months, 9 Months, 1 Year, 3 Years, 5 Years, 7 Years, or 10 Years. Beyond 180 days through one year requires eligible Audit Premium licensing; multiyear options additionally require the per-user 10-Year add-on. Apply the firm's record-class schedule — 3 years for communications, 6 years for financial/accounting or governance records, 5 years for CFTC records, and longer only where a specific rule or the firm's records schedule requires it. Record the selected supported capture duration separately from preservation.
Under Record types, cover every in-scope type, either explicitly or with All. Verify user/operation scope and policy priority:
- CopilotInteraction
- ConnectedAIAppInteraction
- AIAppInteraction (only if PAYG enabled — note PAYG records cap at 180 days regardless)
- PowerPlatformAdministratorActivity
- PowerPlatformAdministratorActivity, MicrosoftFlow, PowerAppsApp (as applicable)
Under Users, choose All users or select the intended individual users. Reconcile selected users with license assignments; do not assume the selector accepts security groups.
Set Priority explicitly (1 = highest); document the priority decision in the policy description so the audit binder can explain conflict resolution.
Click Save.
Per-organization limit: 50 audit retention policies. Reserve at least 10 slots for incident-response policies that may be added under examination.

§6 — Enable PAYG for `AIAppInteraction` (If Non-Microsoft AI Apps Are in Scope)

AIAppInteraction (and certain ConnectedAIAppInteraction scenarios involving non-Microsoft AI apps surfaced via Connected AI App) are billed under Audit (Premium) pay-as-you-go and require explicit enablement. Without enablement, audit search returns zero rows for these record types and the firm has no audit evidence for non-Microsoft AI usage — a material gap if employees use non-Microsoft AI assistance from managed endpoints.

As Entra Global Admin, open Settings > Account details (or the header rocket icon > Get Started) and follow PAYG enablement. Associate an active Azure subscription and resource group in the same tenant.
Confirm the PAYG cost commitment with the Azure subscription Owner; PAYG bills against an Azure subscription, not a per-seat license.
Verify the applicable AI collection policy and feature enablement separately. Subscription association alone does not establish that a supported application is being captured.
Document the enablement decision in the §1.3 change ticket and capture the confirmation screenshot.

Validate after the next ingestion window:

Search-UnifiedAuditLog -RecordType AIAppInteraction `
    -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -ResultSize 1

Note that PAYG-captured records are subject to 180-day retention regardless of any custom retention policy — for longer preservation, export to the §10 immutable blob layer on a recurring schedule.

Note: AIAppInteraction PAYG availability may vary. Verify against Microsoft Learn before relying on this capability.

§7 — Dataverse Environment-Level and Per-Table Audit (Power Platform / Copilot Studio)

Dataverse data-change history and Copilot Studio authoring activity are separate pipelines. Microsoft documents Copilot Studio administrative collection as enabled by default. Verify authoring operations under PowerPlatformAdministratorActivity, not ConnectedAIAppInteraction; per-table Dataverse settings govern data-change history, not whether those authoring events are emitted.

7.1 Enable environment-level auditing (per environment)

Sign in to the Power Platform Admin Center (admin.powerplatform.microsoft.com).
Navigate to Environments > select the target environment.
Open Settings > expand Audit and logs > select Audit settings.
Toggle Start Auditing to ON.
Set Retain these logs for:
- Zone 1 environments: minimum 180 days.
- Zone 2 environments: minimum 365 days.
- Zone 3 environments: minimum 730 days (or Custom / Forever for longer).
Click Save.
Capture screenshot for the evidence pack.
Repeat for every environment in the tenant. Use the Audit Compliance Manager for tenant-wide automation.

7.2 Enable tenant-level Dataverse auditing policy

In PPAC > Security > Compliance > Auditing, enable Turn on Auditing.
Additionally enable the User Sign-In and Activity checkboxes to capture sign-in events and entity-level activity across all Dataverse environments.

7.3 Enable per-table audit on the six Copilot Studio entities

Environment, table, and column settings govern Dataverse data-change auditing. The framework-selected starting set below is not a Microsoft-mandated prerequisite for Copilot Studio authoring audits. Confirm installed tables, supported audit metadata, and the approved column scope in each environment:

bot
botcomponent
botcomponentcollection
conversationtranscript
aiplugin
aipluginauth

For each approved, supported table (record absent or unsupported tables as exceptions):

From the Power Apps Maker portal (https://make.powerapps.com), select the target environment.
Open Tables and locate the entity.
Open Properties and enable Audit changes to its data.
At the column level, confirm which fields generate audit events; enable column audit for any field tracked under the firm's records schedule.
Save and capture screenshot.

Dataverse before/after field values change — May 2026

The May 2026 change removes before-and-after values from events sent to Purview, not Dataverse audit history. Retrieve details via audits(<id>)/Microsoft.Dynamics.CRM.RetrieveAuditDetails, or evaluate the separately configured Synapse Link audit export. This change may affect SEC 17a-4 / FINRA 4511 programs that rely on Purview audit integration for Dataverse field-level change records. Document and test the alternate retrieval pipeline in the audit binder.

8.1 Verify the live filter affordance before adding to runbooks

Documented agent filters

Microsoft Entra Agent ID logs documents Is Agent = Yes and Agent type filters at Entra ID > Monitoring & health > Sign-in logs. Sign in as at least Reports Reader. Agent activity can appear across:

Interactive user sign-ins
Non-interactive user sign-ins
Service principal sign-ins
Managed identity sign-ins

Record actual tenant availability and a known sign-in. Do not replace these documented filters with an assumed separate Agent activity navigation entry.

Portal path:

Microsoft Entra admin center
  > Entra ID > Monitoring & health > Sign-in logs
    > Is Agent: Yes
    > Agent type: select the required identity type

agentSignIn is an event type, not a documented diagnostic category. Forward the supported sign-in categories appropriate to the agent's authentication flow and verify a known agent event and its fields in the destination. For API verification, use the documented beta /auditLogs/signIns filter in Troubleshooting Scenario 5.

Microsoft Entra admin center
  > Monitoring & health
    > Diagnostic settings
      > Add diagnostic setting
        > Select supported user / service-principal / managed-identity sign-in categories
        > Destination: Log Analytics workspace / Storage account / Event Hub

Verify each surface independently

Agent-specific Graph sign-in queries use beta /auditLogs/signIns; that API version is not a separate diagnostic category or a portal availability guarantee. Test the documented filters and forwarding in the tenant.

8.3 Enable `MicrosoftServicePrincipalSignInLogs` (explicit configuration)

Microsoft Entra admin center
  > Monitoring & health
    > Diagnostics
      > Add diagnostic setting
        > Check: MicrosoftServicePrincipalSignInLogs
        > Destination: Log Analytics workspace / Storage account / Event Hub

High-volume stream — assess cost before enabling

Microsoft service principal sign-in logs capture Microsoft service-to-service authentication. They require explicit diagnostic routing, as at least Entra Security Admin, at Entra ID > Monitoring & health > Diagnostics. Assess observed volume and cost before enabling; this stream is not a substitute for agent-specific sign-in coverage.

8.4 Confirm agent-correlation fields in the SIEM ingestion schema

The following Entra sign-in fields support agent-specific audit correlation. AppOwnerTenantId, ResourceOwnerTenantId, SessionId, and ASN are long-standing fields present on every user, service principal, and managed identity sign-in for years — they are not agent-specific or new. Confirm with the SIEM team that they are already in the ingestion schema before adding new mappings; only SourceAppClientID is reliably newer in the agent on-behalf-of (OBO) context.

Attribute	Status	FSI use case
`AppOwnerTenantId`	Long-standing	Cross-tenant agent attribution
`ResourceOwnerTenantId`	Long-standing	Data-residency verification
`SessionId`	Long-standing	Session-level audit reconstruction
`SourceAppClientID`	Newer in agent OBO context	Agent identity-chain mapping
`ASN`	Long-standing	Geolocation and routing audit review

§9 — SIEM Integration

Method	Use case
Microsoft Sentinel — Microsoft Copilot connector	Documented Copilot destination is `CopilotActivity`; verify other AI/Power Platform sources separately. See connector reference. Detection-rule authoring is owned by Control 3.9.
Office 365 Management Activity API	Programmatic export at higher bandwidth (Audit Premium); preferred for high-volume tenants and for non-Sentinel SIEMs
Audit Search Graph API	Available at `v1.0`; use the query-specific permissions, terminal-state checks, `isRecordCountLimitExceeded` check, and full pagination described in Troubleshooting Scenario 7
Manual portal export	Ad-hoc investigations; 30-day completed-job retention; export up to 50,000 rows Standard / 1,000,000 Premium

End-to-end ingestion latency: Microsoft does not publish a hard SLA for audit availability. Empirically, core services (Exchange / SharePoint / OneDrive) typically appear within 60–90 minutes; Power Platform / Copilot Studio / Dataverse can take longer. Sentinel ingestion adds connector-poll latency on top. Treat any 5-minute / 15-minute SLA claim as fabricated unless cited to a specific Microsoft commitment.

Verification procedure: generate a known event (e.g., a single CopilotInteraction from a test account), record the exact UTC timestamp, and query the SIEM with a tight time window pinned to that timestamp after the documented latency ceiling. Capture the round-trip time and add to the §11 evidence pack as the documented end-to-end latency.

§10 — Preservation Layer: Azure Immutable Blob Storage (or 17a-4-Attested Vendor)

Per the SEC's October 2022 amendments to Rule 17a-4(f) (compliance date 3 May 2023), broker-dealers may use either WORM storage or the audit-trail alternative for required record preservation. Microsoft 365 Audit alone — even with the 10-year add-on — does not satisfy 17a-4(f); preservation must come from one of:

Option	Description	FSI applicability
Azure Immutable Blob Storage (time-based or legal hold, locked)	Export audit records and content extracts to an immutable container with a locked time-based retention policy. Cohasset-attested for SEC 17a-4(f), CFTC 1.31, and FINRA 4511.	Direct WORM equivalent; combine with chain-of-custody manifest
Third-party 17a-4-attested archive	Vendor with WORM or audit-trail compliance attestation: Smarsh Enterprise Archive, Global Relay Archive, Proofpoint Enterprise Archive, Mimecast Cloud Archive, Bloomberg Vault, Veritas Enterprise Vault.cloud	Verify vendor's 17a-4(f) third-party access undertaking is current; capture the attestation letter for the audit binder
Microsoft 365 Audit (Premium) with 10-year add-on	Native retention up to 10 years	Capture layer only; not a substitute for a 17a-4(f)-attested archive. Evaluate audit-trail-alternative sufficiency with compliance and legal counsel before relying on it standalone.

10.1 Configure Azure Immutable Blob Storage (Cohasset-attested path)

In the Azure portal, create or select a storage account in an appropriate US Azure region.
Create a blob container dedicated to audit preservation (one container per record-class per retention horizon is recommended).
On the container, open Access policy > Add policy > Time-based retention (or Legal hold for litigation-bound records).
Set the retention period to the regulatory floor:
- 3 years for SEC 17a-4(b)(4) communications records (first 2 years readily accessible).
- 5 years for CFTC 1.31 regulatory records.
- 6 years for SEC 17a-4(a) financial / accounting records.
- Longer periods only where a specific rule or the firm's records schedule requires them (for example, an OCC-driven or firm-standard over-retention decision may be documented separately).
- NYDFS 23 NYCRR 500.06 records retention obligation: minimum 5 years for cybersecurity-event records (verify against your firm's NYDFS program).
Lock the policy after validation — once locked, retention can be extended but never shortened or removed. The lock action itself is auditable via Azure Activity Log.

Capture the policy state and add to the evidence pack:

Get-AzRmStorageContainerImmutabilityPolicy -ResourceGroupName <rg> `
    -StorageAccountName <sa> -ContainerName <container>

Configure a recurring export from Purview Audit (and from DSPM for AI / eDiscovery for the content tier) to this container with a per-batch SHA-256 manifest. The manifest is the chain-of-custody artifact a 17a-4(f) attestation requires.

10.2 17a-4(f) audit-trail alternative — additional documentation

If the firm relies on the audit-trail alternative (rather than WORM), the §10 export pipeline must be accompanied by:

DEO representation signed by a Designated Executive Officer OR a DTP undertaking signed by a Designated Third Party.
Independent records-management assessment (typically by Cohasset Associates or equivalent) covering the end-to-end pipeline (capture → retention → export → preservation → retrieval).

These documents live outside Microsoft 365 — capture pointers to them in the §11 evidence pack so the audit binder is self-describing.

§11 — Evidence Pack for FSI Examiners

Capture for every audit-binder refresh (cadence per Verification & Testing — typically monthly for Zone 1, weekly for Zone 2, daily for Zone 3):

Tenant audit configuration — output of Get-AdminAuditLogConfig | Format-List from Exchange Online PowerShell. Naming: Control-1.7_{Tenant}_AuditConfig_{YYYYMMDD-UTC}.json plus .sha256 sidecar.
License entitlement matrix (§1.2) — user × SKU × add-on CSV. Required to support every retention attestation.
Custom retention policies — JSON export from Get-UnifiedAuditLogRetentionPolicy | ConvertTo-Json -Depth 10. Note in the binder that this does not include the platform default policy.
PAYG enablement state (§6) — confirmation screenshot plus a positive test result for AIAppInteraction.
Per-environment Dataverse audit settings (§7.1) — screenshot or API export per environment.
Per-table audit state on the six Copilot Studio entities (§7.3) — screenshot per entity per environment.
Agent sign-in filters and forwarding (§8) — capture the documented Is Agent / Agent type filters, selected supported diagnostic categories, destination resource ID, and known-event correlation. Record unavailable UI separately; do not fabricate an agentSignIn category.
Sample reconstruction artifact — for one randomly selected agent, run a reconstruction search ("all CopilotInteraction records for AgentId X over date range Y–Z"), navigate from the audit hit to the DSPM for AI transcript surface (per §3.2), capture both, and bundle with a chain-of-custody manifest.
Worked examiner example — the canonical FINRA / SEC examiner question is "Show me the audit trail and the underlying communications for AI-generated communications to customer X between dates Y and Z." Maintain a current worked-example file showing: (a) the Purview Audit search filter, (b) the audit CSV export with SHA-256, (c) the DSPM for AI / eDiscovery content extract, and (d) the chain-of-custody manifest tying audit IDs to content IDs.
WORM / immutability evidence (§10) — output of Get-AzRmStorageContainerImmutabilityPolicy (or vendor equivalent); locked-state confirmation; pointer to DEO/DTP and Cohasset-equivalent assessment if relying on the audit-trail alternative.
SIEM ingestion proof (§9) — Sentinel query result showing the same event the audit search returned, with documented end-to-end latency.

All artifacts: SHA-256 hashed at capture time; copied to the §10 immutable blob container; referenced in the attestation statement (template in Verification & Testing).

§12 — Zone-Specific Portal Workflows

Zone 1 — Personal productivity agents

Configuration	Setting
Unified audit logging	Enabled (verify per §2)
Audit retention policy	`Twelve Months` policy named `FSI-Zone1-Copilot-1y` covering `CopilotInteraction`, `ConnectedAIAppInteraction`, `PowerPlatformAdministratorActivity`
10-Year Audit Log Retention add-on	Not required
PAYG `AIAppInteraction`	Optional; enable only if non-Microsoft AI is permitted on managed endpoints
Dataverse environment audit	Enabled, 180-day retention
Per-table audit on Copilot Studio entities	Enabled in default environment only
Supported sign-in category forwarding for agents	Recommended; not required
Azure immutable blob preservation	Optional
Review cadence	Monthly
Evidence pack refresh	Monthly

Zone 2 — Team / departmental shared agents

Configuration	Setting
Unified audit logging	Enabled
Audit retention policy	`Twelve Months` (minimum) policy named `FSI-Zone2-Copilot-1y`; consider `Ten Years` for departments touching books-and-records data
10-Year Audit Log Retention add-on	Required for any user whose interactions feed a documented 10-year capture-window policy
PAYG `AIAppInteraction`	Required if non-Microsoft AI is in scope
Dataverse environment audit	Enabled, 365-day retention, all non-default environments
Per-table audit on Copilot Studio entities	Required across all environments hosting shared agents
Supported sign-in category forwarding for agents	Required, forwarded to Log Analytics
Azure immutable blob preservation	Recommended
SIEM integration	Required
Review cadence	Weekly
Evidence pack refresh	Weekly

Zone 3 — Enterprise / regulated agents (broker-dealer, FCM, swap dealer, CPO, NYDFS-regulated)

Configuration	Setting
Unified audit logging	Enabled
Audit retention policy	Record-class-based: apply the preservation schedule from Control 1.7 (3 years for communications, 6 years for financial/accounting or governance records, 5 years for CFTC records, and longer only where a specific rule or the firm's records schedule requires it). Document the capture-window choice separately: native Audit supports 3, 5, 7, and 10 years with the 10-Year add-on, but not 6 years.
10-Year Audit Log Retention add-on	Required only for users included in that documented 10-year capture-window scope; reconcile against the §1.2 license matrix on every binder refresh
PAYG `AIAppInteraction`	Required (non-Microsoft AI assumed in scope unless explicitly blocked by Control 1.5)
Dataverse environment audit	Enabled, 730-day minimum retention (or Forever), all environments
Per-table audit on the six Copilot Studio entities	Required across all environments
Supported sign-in category forwarding for agents	Required
`MicrosoftServicePrincipalSignInLogs`	Evaluated and documented; enabled where ingestion-cost analysis supports it
Azure immutable blob preservation OR 17a-4-attested vendor	Required for broker-dealer / FCM / swap dealer / CPO; preservation horizon per the §10 regulatory floor table
SIEM integration	Required, with documented end-to-end latency
DSPM for AI (1.6) / eDiscovery (Premium) (1.19) / Communication Compliance (1.10)	Required for content retrieval — audit alone does not preserve prompt/response text
Review cadence	Daily
Evidence pack refresh	Daily for capture verification; weekly for full binder refresh
Quarterly attestation (control owner + records officer + compliance officer)	Required

§13 — Implementation Notes

Implementation notes for US financial-services commercial tenants: - Azure immutable blob storage: the Cohasset attestation and SEC 17a-4(f) coverage statement should be re-verified at vendor cadence (annually) and stored alongside the §11 evidence pack.

§14 — Downstream Control Linkage

Downstream control	Linkage
1.5 — DLP and Sensitivity Labels	DLP policy hits surface in audit; deny events from DLP feed the Deny Event Correlation Report solution
1.6 — DSPM for AI	Primary content-retrieval surface for `CopilotInteraction` audit hits
1.10 — Communication Compliance	FINRA Rule 3110 supervisory-review surface for AI-generated communications captured in audit
1.19 — eDiscovery (Premium) for Agent Interactions	Legal hold / collection / review surface for Copilot interactions; the audit `Messages[].ID` is the join key
2.6 — Model Risk Management (OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7))	Model-card store referenced by `ModelTransparencyDetails.ModelProviderName` in audit; supplements the audit log where `ModelName` / `ModelVersion` are not populated for M365 Copilot
2.12 — Supervision and Oversight (FINRA Rule 3110)	Supervisory-review program that consumes the Comm Compliance hits driven by audit
3.4 — Incident Reporting and Root-Cause Analysis	Destination for any audit-pipeline gap discovered during a binder refresh
3.9 — Microsoft Sentinel Integration	KQL detection authoring against forwarded audit, `agentSignIn`, and `MicrosoftServicePrincipalSignInLogs` data

§15 — Regulatory Cross-Reference

This walkthrough is designed to support compliance with the following — it does not, by itself, satisfy any of them. Each citation should be verified against the firm's own legal counsel's current interpretation before being relied upon in an examiner narrative.

Citation	Relevance to this walkthrough
FINRA Rule 4511	Books-and-records retention. §5 (custom retention) + §10 (preservation layer) + §11 (evidence pack).
FINRA Rule 3110	Supervision of communications. Audit capture in §3 + content-tier handoff to Control 1.10 and Control 2.12.
FINRA RN 25-07 (Request for Comment, April 2025)	RFC on workplace modernization including AI-generated communications recordkeeping. Not final guidance; this walkthrough anticipates the direction of the RFC by capturing AI origin (`ApplicationId`, `AgentId`) and metadata that supports human vs AI attribution. Monitor for final-rule publication.
SEC Rule 17a-3	Record creation. Audit captures the creation events for required books and records.
SEC Rule 17a-4(a)	Financial / accounting records — 6-year retention. §10 retention floor table.
SEC Rule 17a-4(b)(4)	Communications records — 3-year retention (first 2 years readily accessible). Agent conversation logs typically qualify as communications.
SEC Rule 17a-4(f) (October 2022 amendments, compliance date 3 May 2023)	Permits WORM storage OR the audit-trail alternative with DEO/DTP and independent records-management assessment. §10 implements both options.
SOX 302/404	Internal controls over AI system logging. §11 evidence pack supports management certification.
GLBA 501(b) / Safeguards Rule	Security safeguards including audit trails for non-public personal information access. §3 + §11.
OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) / Federal Reserve SR 26-2 (formerly SR 11-7)	Model risk management — model identity, version, and use must be auditable. Audit captures `ModelProviderName`; full model identification supplemented by the Control 2.6 model-card store (audit log alone does not satisfy Fed SR 26-2 (formerly SR 11-7) model inventories for M365 Copilot).
CFTC Rule 1.31	5-year retention of regulatory records (FCMs, swap dealers, CPOs) in tamper-evident format with complete metadata. §10 retention floor.
NYDFS 23 NYCRR 500.06	Records retention for cybersecurity events — 5 years. §10 retention floor.
NYDFS 500.16	Incident response plan — supported by the §11 evidence pack and the 3.4 handoff.
NYDFS 500.17	Notice of cybersecurity event to the Department within 72 hours — audit evidence supports the required reconstruction.
FFIEC IT Examination Handbook	Information security audit-trail expectations — §11 evidence pack designed to map.
IRS Rev. Proc. 97-22 / 98-25	Electronic record retention for tax purposes — §10 immutable blob layer supports the records-integrity requirements.

§16 — Anti-Pattern Catalog

Anti-pattern	Why it fails	Correct approach
Treating Microsoft 365 Audit (Premium) + 10-year add-on as a 17a-4(f)-compliant preservation system	The 10-year add-on extends capture; it does not constitute non-rewriteable, non-erasable storage with a DEO/DTP undertaking	Pair audit with §10 preservation layer (Azure immutable blob or 17a-4-attested vendor)
Telling an examiner "the audit log preserves the AI conversation"	The audit record carries metadata only; prompt/response text lives in the Substrate	Always pair audit evidence with the matching content extract from DSPM for AI / eDiscovery / Comm Compliance
Authoring a 10-year custom retention policy without checking the per-user 10-Year add-on assignment	Records silently cap at 1 year for users without the add-on	§1.2 license matrix is mandatory before §5
Running `Get-AdminAuditLogConfig` from Security & Compliance PowerShell	Always returns `False` regardless of true tenant state	Run from Exchange Online PowerShell only; verify the connection URI
Using `-RecordType PowerPlatformAdminActivity`	Not a valid `AuditLogRecordType`; some module versions silently return zero rows	Use the names in §3.1 and validate against `[Enum]::GetNames(...)`
Declaring `Is Agent = Yes` unsupported	Microsoft documents Is Agent and Agent type	§8.1 — record documented filters and tenant availability
Enabling `MicrosoftServicePrincipalSignInLogs` without a cost assessment	High volume can dwarf the rest of the Log Analytics workspace	§8.3 — assess ingestion cost first
Assuming default Audit (Premium) retention covers Copilot record types	Default policy covers only AzureActiveDirectory / Exchange / OneDrive / SharePoint	§5 — explicitly name every Copilot record type in a custom policy
Conflating Dataverse data changes with Copilot Studio authoring audits	Different pipelines and event types; a table setting is not proof of authoring capture	§7.3 — test approved table/column history and default-on authoring events separately
Relying on a single-shot `Search-UnifiedAuditLog -ResultSize`	Truncates silently past the session ceiling	Use `-SessionCommand ReturnLargeSet -SessionId <guid>` paginated to completion (per PowerShell Setup)
Using "ensures compliance" / "guarantees" / "prevents" / "eliminates" in any control narrative	Overclaim — invites finding	Use the hedged-language alternatives in the Hedged-Language Reminder above

§17 — Verification Handoff

After completing this walkthrough, hand off to Verification & Testing to execute the full verification criteria from the control document, including:

Unified audit logging enabled (run Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled from Exchange Online PowerShell).
Audit (Premium) license entitlement verified per Copilot user.
Per-user 10-Year Audit Log Retention add-on assigned for every user included in a documented 10-year capture-window policy.
Copilot record types appear in audit search results.
Custom audit retention policies explicitly include the Copilot record types.
Retention policies configured per governance tier.
Export capability produces complete records using paginated ReturnLargeSet.
SIEM integration functional with documented end-to-end ingestion latency.
WORM storage or audit-trail alternative configured per SEC 17a-4(f).
Dataverse environment-level audit enabled across all environments.
Per-table Dataverse audit enabled on the six Copilot Studio entities.
Audit log retention set to a minimum of 180 days per environment.
agentSignIn logging enabled / validated for Zone 2 and Zone 3.
Agent-correlation sign-in fields confirmed present in the SIEM ingestion schema.
MicrosoftServicePrincipalSignInLogs evaluated and documented for Zone 3.
Evidence-pack capture procedure produces named, hashed, immutable artifacts.

§18 — Troubleshooting Handoff

For common failure modes (audit-search-returns-zero, retention-silently-falls-back-to-180-days, PowerShell connection-URI mismatch, Dataverse per-table audit not surfacing, agentSignIn not appearing in Log Analytics, immutable-blob policy lock errors), see Troubleshooting.

Back to Control 1.7 | PowerShell Setup | Verification & Testing | Troubleshooting

Updated: October 2026 | Version: v1.6.2 | UI Verification Status: Needs Review (documentation checked; tenant UI not tested)