Purview Audit Logs for Copilot Studio: What They Capture and What FINRA Examiners Still Ask For

Activity logging is not the same as evidence

Microsoft Purview audit logs are the default record of agent activity for many firms deploying Copilot Studio. They are designed for tenant-level activity auditing: they help an administrator see that events happened in the environment and who or what was associated with them. That is a legitimate and useful control.

An examiner request is usually framed differently. The question is rarely only whether something happened. It is whether the firm can reconstruct what an agent was allowed to do, which tools and data it used, what it returned, and who approved or supervised it. Logging an activity and evidencing an authorization are different artifacts, and a record can be complete for one and silent on the other.

This guide separates three layers: tenant activity records, interaction-level records, and policy-at-time-of-action records. It then maps typical examiner questions to the layer that can answer them. Each firm should test its own configuration against that map rather than assume the default log covers all three.

What FINRA has said about generative AI and agents

FINRA Regulatory Notice 24-09 states that AI, including large language models and other generative AI tools, presents opportunities for member firms to improve products and services and to gain operational and compliance efficiencies. It also states that as firms incorporate these tools, they should be mindful of the potential implications for their regulatory obligations. The notice does not create a new rule. It points firms back to the obligations they already have, including supervision and books and records.

The 2026 Annual Regulatory Oversight Report is more specific on records. It says a firm's approach may include storing prompt and output logs for accountability and troubleshooting. It also lists auditability and transparency as a concern, noting that complicated, multi-step agent reasoning tasks can make outcomes difficult to trace or explain. As of November 2026, these are statements in a FINRA report, not rule text.

The 2024 and 2025 reports flag log management practices, specifically not logging or retaining enough data about business or technical activity to support forensic analysis. That language is written in a cybersecurity context and should not be read as AI-specific. It does show that FINRA looks at whether logs are sufficient and retained, which carries over to agent records.

Mapping examiner questions to evidence layers

The table lists questions a firm should expect to field about an AI agent and the evidence each one requires. The third column names the layer that has to hold that evidence. A tenant activity audit can show that an event occurred. The other two layers are where authorization and content live. Test each row against the records your tenant actually produces.

• What was this agent permitted to do on the date in question?: Evidence: the permissions and policy in force at that moment, not the current configuration. Layer: policy-at-time-of-action record.
• Which tools, connectors and data did it call?: Evidence: each tool or connector call tied to a specific interaction. Layer: interaction and tool-call record.
• What did the agent receive and return?: Evidence: prompts and outputs for the interaction, consistent with the prompt and output log practice FINRA describes. Layer: interaction record.
• Who approved, supervised or escalated the action?: Evidence: a named approver or reviewer, a timestamp and the decision. Layer: policy and approval record, linked to the interaction.
• Which agent acted, and who changed its configuration?: Evidence: a stable agent identity and a change history. Layer: tenant activity audit, plus the policy record for the effective settings.
• Can you produce all of this on request, in a usable form?: Evidence: retained, searchable and exportable records for the required period. Layer: retention and export controls across all three layers.

Where the gaps tend to open

Three gaps matter most for supervision and recordkeeping, whatever log source a firm starts from.

The first is policy at the time of action. Agent configurations change. A current settings page does not prove what governed an action last quarter. To reconstruct authorization, the firm needs a record written when the action occurred, showing which policy applied and what was decided. A configuration change history helps, but it makes the reviewer rebuild the effective policy by hand for each date.

The second is interaction and tool-call detail. FINRA's concern about multi-step agent reasoning is a traceability concern. A reviewer needs to follow the chain of steps within an interaction: what the user asked, which tools the agent called, what each returned and what the agent said back. Records that stop at the level of the event, such as an agent being used, do not let a reviewer follow that chain. A firm should check whether prompts, responses and tool calls are retained at all, and whether they can be linked to one interaction.

The third is retention and export. FINRA Rule 4511 and SEC Rule 17a-4 are the books-and-records rules firms typically map retention to. The retention period, record format and accessibility should come from the firm's own books-and-records analysis, applied to each evidence layer. A log with a short default retention window, or one that is hard to export in a reviewable form, can satisfy tenant auditing and still fall short of what the firm needs to produce.

How runtime enforcement evidence complements native logs

Trussed enforces policy in the execution path: each interaction and tool call is evaluated at runtime, and the outcome is allow, redact, block, rate limit or escalate for human approval. Policy is enforced at runtime, not reviewed after the fact. Because the enforcement decision is the event, the same step produces audit-ready evidence at the level of the individual interaction and tool call, including what policy was applied and what was decided. That addresses the policy-at-time-of-action and tool-call rows in the table above.

Trussed deploys self-managed in the customer cloud, with configurable retention and data residency, so the firm sets how long evidence is kept and where it sits. It does not replace Purview. Tenant-level activity auditing remains a separate and useful layer. Insurance, a regulated financial sector, is where Trussed is deepest.