Skip to content

Control 4.5: Copilot Usage Analytics and Adoption Reporting

Control ID: 4.5 Pillar: Operations & Monitoring Regulatory Reference: Sarbanes-Oxley §§302/404 (where applicable to ICFR), FFIEC IT Examination Handbook, GLBA §501(b) Last Verified: 2026-05-25 Governance Levels: Baseline / Recommended / Regulated

Objective

Implement structured monitoring and reporting for Microsoft 365 Copilot adoption, usage, and related agent activity so the organization can measure control effectiveness, detect unusual usage patterns, support license and spend decisions, and provide examination-ready evidence of ongoing AI governance.

Why This Matters for FSI

Usage analytics are a governance control, not just an adoption dashboard. Financial institutions are expected to monitor whether technology controls are operating as intended and whether AI use remains aligned with approved business scope. If Copilot usage expands faster than supervisory coverage, training, or monitoring, the institution can create gaps that are difficult to explain during examinations.

Usage reporting also supports:

  • Sarbanes-Oxley §§302/404 evidence that monitored controls continue to operate
  • FINRA supervisory adequacy reviews for channels where Copilot assists communication or research workflows
  • FFIEC proportionality expectations by showing where AI usage is concentrated
  • budget stewardship for per-seat and PAYG usage models

Disclaimer

This control is provided for informational purposes only and does not constitute legal, regulatory, or compliance advice. See full disclaimer.

Control Description

Microsoft's current Copilot Analytics model spans several connected reporting surfaces rather than a single report:

Analytics Surface Primary Path Governance Value
Copilot overview M365 Admin Center > Copilot > Overview Readiness, adoption signals, recommended actions, security links
Copilot usage reports M365 Admin Center > Reports > Usage > Microsoft 365 Copilot Tenant-wide usage, active users, workload adoption, and license utilization context
Copilot Dashboard (Adoption) Viva Insights > Copilot Dashboard Organizational adoption trends and feature engagement
Copilot Dashboard (Impact) Viva Insights > Copilot Dashboard Assisted work patterns and productivity-oriented measures
Business Impact reporting Viva Insights / Copilot Analytics experience Connects adoption and impact measures to business outcomes and executive reporting
Agent Overview M365 Admin Center > Agents > Overview Active users, total sessions, exception rate, and runtime for governed agent use

Copilot Dashboard: Satisfaction, Intent, and High-Usage Metrics

The Copilot Dashboard in the M365 Admin Center now includes expanded metrics that support FSI governance objectives:

Metric Description Governance Value
User satisfaction scores Aggregated satisfaction signals from Copilot interactions Tracks user experience quality and helps identify adoption friction or misuse patterns
Intent metrics Categorization of how users are engaging Copilot (drafting, summarizing, analyzing, etc.) Helps compliance teams understand whether Copilot usage aligns with approved business purposes
High-usage user identification Users with significantly above-average Copilot interaction volume Supports governance review of power users and aids PAYG cost monitoring for consumption-based billing

FSI compliance teams should incorporate these metrics into their periodic adoption reviews to monitor whether usage patterns remain aligned with approved business scope and to identify potential misuse or ungoverned activity early. High-usage identification is also relevant to PAYG cost governance (see Control 4.8).

Copilot Dashboard Feature Availability Matrix

Not all Copilot Dashboard capabilities are available in every licensing tier. The following matrix summarizes feature availability as of May 2026. Organizations should verify current availability against Microsoft documentation because feature rollout timelines may differ across licensing tiers.

Feature M365 E3 + Copilot M365 E5 + Copilot Viva Insights Add-On
Copilot usage reports (Admin Center) ✅ ✅ ✅
Copilot Dashboard — Adoption view ❌ ✅ ✅
Copilot Dashboard — Impact view ❌ ✅ ✅
Intelligent summaries ❌ ✅ ✅
Industry benchmarks ❌ ✅ ✅
User satisfaction scores ❌ ✅ ✅
Intent metrics ❌ ✅ ✅
High-usage user identification ✅ ✅ ✅
Agent Overview (Admin Center) ✅ ✅ ✅
Business Impact reporting ❌ ✅ ✅

Intelligent Summaries and Industry Benchmarks

The Copilot Dashboard includes AI-generated intelligent summaries that synthesize adoption and impact trends into narrative insights, and industry benchmarks that compare the organization's Copilot adoption metrics against anonymized peer data.

Feature Description Governance Value
Intelligent summaries AI-generated narrative summaries of adoption trends, usage patterns, and impact signals Accelerates leadership reporting by translating raw metrics into executive-readable insights; saves analyst time
Industry benchmarks Anonymized peer comparison data showing how the organization's Copilot adoption compares to similar organizations Provides context for adoption metrics — helps governance teams determine whether usage levels are typical or warrant investigation

FSI caveats:

  • Intelligent summaries are generated by AI and should be reviewed by a human analyst before inclusion in regulatory reporting or board presentations. Organizations should document that AI-generated summaries were reviewed and, where necessary, edited for accuracy.
  • Industry benchmarks are anonymized and aggregated. They should be treated as directional indicators, not as performance targets or compliance benchmarks. Do not present benchmark comparisons to regulators as evidence of control effectiveness.

Viva Pulse and Glint Sentiment Integration

Organizations using Viva Pulse (lightweight pulse surveys) or Viva Glint (enterprise engagement surveys) can correlate employee sentiment data with Copilot adoption metrics to build a more complete picture of AI deployment impact.

Sentiment Source Integration Approach Governance Value
Viva Pulse Create Copilot-specific pulse surveys targeting pilot groups and broad populations; compare sentiment trends alongside adoption curves Identifies adoption friction, training gaps, or user dissatisfaction before they become governance risks
Viva Glint Include Copilot-specific questions in enterprise engagement cycles; segment results by department and role Supports board-level reporting on AI deployment satisfaction and organizational readiness

FSI organizations should coordinate with HR and employee relations teams before deploying AI-specific sentiment surveys to confirm alignment with employee privacy policies and labor relations requirements. Sentiment data should not be correlated with individual Copilot usage data at the user level.

Core Analytics Dimensions

Dimension Example Measures Governance Question
Readiness Licenses assigned, enabled user groups, recommended actions Is rollout aligned with the approved deployment plan?
Adoption Active users, returning users, feature usage by workload Are approved users actually using Copilot as expected?
Impact Assisted time, meeting/email/document support signals Is the organization seeing measurable benefit from the deployment?
Risk and supervision Usage concentration, after-hours usage, heavy usage in regulated populations Do monitoring and supervisory controls remain proportional to use?
Agent operations Active users, sessions, exception rate, ownerless agents Are agents governed as they scale?

Department and Role Segmentation

Usage should be segmented in ways that matter for FSI oversight:

Segmentation Purpose
Department / business unit Compare operations, finance, legal, compliance, research, and frontline usage patterns
Role type Distinguish regulated functions from lower-risk internal populations
Geography Support jurisdiction-specific governance or data-residency reviews
License or billing model Compare full Microsoft 365 Copilot seats to PAYG usage patterns
Agent-enabled vs. chat-only populations Detect where agent governance demands more oversight

Copilot Surface Coverage

Surface Analytics Available Notes
Microsoft 365 Copilot Chat Full Core adoption and workload activity metrics
Teams meetings and chat Full Usage should be reviewed alongside supervision and meeting controls
Outlook Full Useful for communication-channel adoption tracking
Word / Excel / PowerPoint Full Supports business-case and training analysis
Copilot Pages / Notebooks Partial Review with SharePoint governance and collaboration controls
Agents Growing / operational Review through Agent Overview and Registry in addition to general Copilot analytics

Governance Levels

Baseline

  • Review M365 Copilot usage reports monthly
  • Compare assigned licenses to active usage
  • Document which administrators and analysts can access usage data
  • Produce a quarterly summary for the governance committee
  • Include agent metrics if the tenant has agents enabled
  • Segment usage by department, risk tier, and billing model
  • Create anomaly thresholds for spikes, drops, and concentrated usage
  • Correlate communication-channel adoption with supervisory capacity
  • Combine native Microsoft reports with a governance dashboard for leadership
  • Include agent adoption and exception metrics in the same reporting cycle

Regulated

  • Include Copilot usage analytics in examination and SOX evidence packages where relevant
  • Present quarterly AI usage reporting to a board, technology, or risk committee
  • Archive governance reports according to the firm's evidence-retention standards
  • Document methodology, data sources, and material assumptions for auditor review
  • Track exceptions, overrides, or special-population enablement separately

Setup & Configuration

Step 1: Enable and Review Native Reports

  1. Open M365 Admin Center > Copilot > Overview.
  2. Open Reports > Usage > Microsoft 365 Copilot.
  3. Confirm the organization can view recent usage, adoption, and license-related signals.

Step 2: Assign Reporting Access

Define who can access which reporting surfaces:

Surface Typical Role
Copilot overview and usage reports AI Administrator, Reports Reader, Global Reader (read-only scenarios)
Viva Insights Copilot Dashboard Viva Insights Analyst or approved analytics role
Agent Overview AI Administrator, Global Reader (read-only review)

Step 3: Establish Reporting Cadence

Report Frequency Audience
Operational usage summary Monthly IT Operations / Copilot program team
Department adoption report Monthly Business owners and governance leads
Supervisory capacity comparison Quarterly Compliance / supervisory leadership
Executive AI usage summary Quarterly Technology or risk committee

Step 4: Configure Anomaly Thresholds

Define review triggers such as:

  • sudden department-level usage spikes
  • unexpected after-hours usage in high-risk teams
  • high license assignment with low activation
  • agent session growth without corresponding governance review

Step 5: Build the Governance Dashboard

Use native reports as the foundation and add curated dashboards or exports where needed. The Microsoft Open-Source Copilot Analytics Tools playbook can support readiness, usage, impact, and audit reporting if your team needs more tailored views.

Financial Sector Considerations

Supervisory adequacy: If Copilot usage in regulated communication channels grows materially, the institution should evaluate whether communication review and audit sampling remain proportional.

Spend accountability: Usage analytics should inform both seat-license optimization and PAYG billing policy reviews. A governance program that measures usage but ignores cost ownership is incomplete.

Examination readiness: Regulators increasingly ask how AI tools are used in practice, not just which policies exist. Trend reporting and decision logs help show that governance is active.

Agent sprawl visibility: Agents should not be reported separately from the rest of the Copilot governance story. Agent adoption, exception rates, and ownerless agents should be visible alongside core Copilot metrics.

Verification Criteria

# Verification Step Expected Result
1 Access Copilot usage reports Reports are accessible and populated
2 Review latest monthly usage summary Summary exists and is current
3 Verify report access roles Only designated personnel have access
4 Confirm segmentation is available or documented Department/risk-based reporting exists
5 Review anomaly thresholds Thresholds are defined and used
6 Confirm governance committee reporting Periodic reporting is delivered to the intended audience
7 Review agent metrics if agents are enabled Agent Overview data is incorporated into operational reporting
8 Confirm archival of reports Governance reports are retained per policy

Additional Resources

FSI Copilot Governance Framework v1.4.0 - April 2026