Microsoft 365 Copilot’s Missing Audit Logs: The Hidden Risk Behind Zero-Click Data Leaks

When Microsoft patched CVE-2025-32711 in June 2025, it closed a critical zero-click vulnerability that allowed attackers to silently siphon sensitive data through Microsoft 365 Copilot. Dubbed EchoLeak, the flaw earned a CVSS score of 9.3 and required no user interaction—simply embedding a malicious prompt in an email could trick Copilot into leaking internal documents. But as security teams exhaled, a quieter and more insidious problem surfaced: the very audit trails that organizations depend on to detect such breaches are riddled with gaps. Evidence from community reports and independent testing reveals that Copilot interactions do not reliably generate the forensic records needed for compliance, incident response, or regulatory scrutiny. This audit-logging blind spot threatens to turn every future Copilot vulnerability into a silent catastrophe.

EchoLeak: The Zero-Click Nightmare That Started It All

Engineered by researchers at Aim Security, EchoLeak exploited a large language model (LLM) scope violation in Microsoft 365 Copilot. Attackers could send a carefully crafted email containing malicious markdown content to any employee within an organization. When the victim later asked Copilot a business question—such as summarizing an earnings report—the Retrieval-Augmented Generation (RAG) engine blended the poisoned email with sensitive internal data. No clicks, no suspicious links. Copilot’s default behavior automatically leaked classified information—from financial documents to HR records—through Teams and SharePoint URLs that pointed to attacker-controlled infrastructure.

The attack chain unfolded in four silent steps:
- Injection: An attacker sends a seemingly benign email with embedded prompt instructions.
- User Action: The victim interacts naturally with Copilot on an unrelated query.
- Scope Violation: Copilot mixes the untrusted data with privileged context without proper trust boundaries.
- Leak: The model outputs the most sensitive data from context, exfiltrating it seamlessly.

Microsoft fixed the vulnerability server-side and added CVE-2025-32711 to its June 2025 Patch Tuesday list, stating no evidence of in-the-wild exploitation had been found. Yet the patch addressed only the symptom, not the underlying architectural weakness. Copilot’s core design—freely combining data from employees and external sources—remains intact, as does the critical reliance on accurate audit logs to detect abuse.

The Deeper Problem: Audit Logs That Vanish When You Need Them Most

Security practitioners have long relied on Microsoft Purview Audit to track user and system actions across the Microsoft 365 ecosystem. Microsoft’s documentation claims that Copilot interactions are automatically logged when auditing is enabled, producing records with attributes like AppHost, AgentVersion, and referenced resources. But real-world experience tells a different story.

Multiple administrators on Microsoft’s community forums have documented missing events. One common scenario: a Copilot Studio agent tested in development generates audit records exactly as expected. Yet when deployed to a production Teams channel, the same bot’s actions suddenly disappear from Purview search results. The activity is visible in the application, but the forensic trail goes cold.

Microsoft’s own audit guidance acknowledges significant limitations:
- Device identity may not be captured in all contexts.
- Full conversation transcripts are absent when Teams transcript features are disabled.
- Some admin-change events tied to Copilot configurations are not logged.

These gaps mean that an attacker who manipulates a Copilot agent to exfiltrate data via Teams could leave behind no usable audit artifact. A security operations center (SOC) relying on SIEM correlation would see nothing, while the data leak proceeds in plain sight.

The RAIO Console: A Single Point of Catastrophic Failure

Perhaps the most alarming revelation from recent disclosures involves the Responsible AI Operations (RAIO) console—Microsoft’s internal control plane for model governance and auditing. Security researchers have demonstrated that sandbox escape techniques could allow attackers to pivot from a compromised Copilot context into RAIO itself. Access to this oversight console would grant control over policies, audit settings, and—crucially—the ability to suppress or alter logs.

If an attacker gains RAIO access, the entire audit integrity collapses. Organizations could no longer trust the records that prove whether a breach occurred, what data was exfiltrated, or who was responsible. Such a scenario moves beyond data theft into systemic compromise, undermining regulatory compliance and legal defensibility.

Why “Quiet” Failures Are More Dangerous Than Loud Exploits

Traditional cyberattacks leave noisy footprints: authentication logs, endpoint telemetry, network traffic anomalies. Even a stolen password generates a trail of failed logins or unusual access patterns. But when an AI agent with broad organizational access fails to emit reliable audit events, defenders face a different class of incident: silent exfiltration.

Consider a regulated industry—healthcare, finance, or government—where breach notification laws require timely discovery. If Copilot leaks protected data but Purview shows no interaction, the organization may remain unaware for months, violating compliance mandates and inviting steep fines. In incident response, missing logs equal missing evidence. Threat hunters cannot reconstruct the attacker’s path, eDiscovery efforts stall, and post-breach forensics become guesswork.

The EchoLeak patch did not solve this. It stopped one specific proof-of-concept, but Copilot’s logging gaps persist across multiple products and hosting contexts: Copilot in Office.com, Copilot in Teams, Copilot Studio, and BizChat. Each workload has different auditing behaviors, and Microsoft places the burden on administrators to validate that their specific configurations produce the expected events.

What Microsoft Gets Right—and Where It Falls Short

Microsoft provides a unified Purview interface for auditing Copilot interactions, with documented record types and export capabilities. The company distinguishes between Microsoft applications (covered by Audit Standard) and third-party AI apps (which may require pay-as-you-go billing). Administrators can filter by CopilotInteraction and AIAppInteraction record types, export to SIEM, and set retention policies.

But the weaknesses outweigh the strengths in high-security contexts:
- Inconsistent telemetry: The same bot produces different audit output depending on whether it runs in Teams or Copilot Studio.
- Missing forensic fields: Critical data like device identity, full prompt text, and complete transcripts may be absent.
- Configuration complexity: Admins must manually verify logging for each Copilot workload, a sprawling task across large tenants.
- Governance console risk: RAIO and similar oversight planes are high-value targets with no public evidence of comprehensive protection.

These limitations are not theoretical. They align with community complaints, vendor-documented caveats, and the broader reality that cloud-service telemetry can fail—as seen in Microsoft’s late-2024 security-log ingestion incident.

Practical Steps to Regain Visibility

Organizations cannot afford to wait for Microsoft to deliver a perfect audit solution. The following actions can harden defenses today:

1. Verify and Baseline Audit Coverage

Run recurring Purview searches for CopilotInteraction and AIAppInteraction record types across all hosting contexts. Compare expected events against actual usage patterns. Validate that actions executed by Copilot in Teams, Office.com, BizChat, and Studio appear as expected. Export results and automate consistency checks.

2. Harden Telemetry Collection and Retention

Enable comprehensive auditing tiers and pay-as-you-go plans for AI applications if policy allows. Configure export pipelines to an immutable SIEM or secure log archive, and monitor for ingestion gaps. Retain logs for the maximum period required by regulatory and forensic needs.

3. Test Incident-Response Playbooks with Copilot Scenarios

Simulate benign Copilot actions—file retrieval, meeting summarization, agent-triggered responses—and confirm that the resulting audit records are complete and usable for triage in your SIEM and eDiscovery workflows. Include bot deployments in Teams and Studio, and document any anomalies.

4. Protect Oversight and Governance Consoles

If your organization uses RAIO or similar control planes, restrict access to a small set of vaulted admin accounts. Enforce conditional access policies, multi-factor authentication, and Privileged Identity Management. Log all administrative activity to an immutable, off-platform store.

5. Monitor for Silent Anomalies

Tune detection rules to flag suspicious Copilot patterns: unusual resource retrieval volumes, repeated extraction from high-sensitivity sites, or out-of-character agent behaviors. Use behavioral analytics to identify anomalous data flows even when individual log events are incomplete.

6. Apply Least Privilege to Copilot Scope

Limit the mailboxes, SharePoint sites, and documents that Copilot can access. For highly sensitive stores, enforce approval workflows or review gates before Copilot can interact with them. The narrower the context, the smaller the blast radius.

7. Maintain Patching and Vendor Coordination

Apply Copilot-related security updates promptly. When Microsoft publishes advisories for AI defects, immediately re-validate logging and governance behaviors post-patch to ensure no new gaps were introduced.

The Bottom Line

EchoLeak was a wake-up call, but the real crisis is the systematic lack of trustworthy audit trails for AI-powered collaboration tools. Copilot’s ability to access, combine, and redistribute organizational data makes it a prime target for silent exfiltration. Without reliable logging, every vulnerability—whether zero-click or zero-day—becomes a ghost in the machine.

Microsoft has built the foundational Purview infrastructure, yet it remains incomplete and inconsistent in practice. The responsibility for closing the gap now falls on enterprise defenders. Validate your audit coverage. Harden your governance consoles. Assume that missing logs mean missed attacks. In a world where AI agents operate with ever-expanding privileges, the only thing more dangerous than a flaw is a flaw you cannot see.