Back Blogs.Microsoft

Reconstructing AI activity in investigations

Blogs.Microsoft •Phillip Misner and Microsoft AI Red Team • June 9, 2026

Learn how to investigate AI activity in Microsoft 365 Copilot and Azure AI services using a structured, telemetry-driven approach. This playbook helps security teams reconstruct events, assess data exposure, and detect potential threats faster.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Releases Incident Response Playbook for AI Services Microsoft has launched an incident response playbook aimed at assisting security teams in analyzing activities within Microsoft 365 Copilot and Azure AI. The playbook addresses the challenge of integrating fragmented telemetry from various security tools, providing a structured methodology for identifying potential threats such as prompt injection and unauthorized data access. It leverages signals from Microsoft Purview, Defender, and Sentinel to help reconstruct user interactions. This initiative is crucial for organizations utilizing these AI services to enhance their security posture and incident response capabilities. 3 sources 25

Extracted Entities

Platforms (2)

Azure AI Services Microsoft 365 Copilot