Microsoft Copilot Edit Log: What It Tracks, Where It Ships, and 7 Ways to Write So the Replay Stays Clean
The full breakdown of what Copilot Edit Log captures inside Word and OneDrive, where the data goes, which universities are running it, and the writing protocols that keep your session log uneventful, even when you write the whole thing yourself.
By Akhil Boddu · AfricanTechBroMicrosoft Copilot Edit Log: what it tracks, where it ships, and 7 ways to write so the replay stays clean
What you'll be able to do after reading this: Understand exactly what Microsoft 365's Copilot Edit Log captures inside your Word documents, where that data ends up, who can request it, and how to write so a replay of your session looks like a normal student typing, not a paste-and-polish job.
Prerequisites: You write assignments in Word or upload them to OneDrive. Your university uses Microsoft 365 EDU (the vast majority of large universities do).
Time to complete: 20 minutes to read. Roughly 30 minutes to migrate your writing workflow.
Why this guide exists
If you got here from a comment on the dossier carousel, here's the short version. Microsoft has quietly built a system inside Word and OneDrive that records the writing process itself, not just the finished file. Your professor doesn't only see what you submitted. They can request a replay of how you wrote it: keystroke by keystroke, paste by paste, idle gap by idle gap.
That replay is the new evidence. Turnitin similarity scores were the old fight. The new one is about whether your writing session "looks like" a human writing or a human assembling.
This guide covers the receipts. What's verifiable from Microsoft's own documentation, what's been reported by integrity officers and university IT teams, and what's reasonable inference. I'll mark the difference clearly so you can take this to your faculty if you ever need to.
A note on accuracy upfront. The carousel that brought you here uses a few stylised numbers (the 180-day default, the 300-word paste threshold). Those are derived from Microsoft 365 Compliance Center defaults and Purview audit log behaviour, but tenants can reconfigure both. Think of them as the typical setup, not a universal constant. Where the source is firm, I cite it. Where it's projected from defaults or reported from one institution, I label it.
Section 1: what Copilot Edit Log actually captures
The Edit Log is not a single product. It's the combination of three things Microsoft already shipped, joined together by the Microsoft 365 Compliance Center (now called Microsoft Purview):
- Office client telemetry. Every keystroke event, paste event, idle gap, and document focus change in Word for Web, Word desktop, and Word mobile when the file lives in OneDrive or SharePoint.
- Copilot interaction history. Every prompt you send to Copilot, every suggestion it returns, and whether you accepted, edited, or rejected it.
- Audit logs. The metadata wrapper that timestamps everything and ships it to your tenant's compliance store.
Concretely, here's what shows up in a session reconstruction:
| Signal | What it records | Who can see it |
|---|---|---|
| Keystroke events | When you typed, idle gaps, typing speed (WPM windows) | Tenant admin via Purview audit log |
| Paste events | Source app (when known), character count, paste duration | Tenant admin via Purview audit log |
| Tab and app switches | When focus left Word, for how long, returning app context (limited) | Available in Edge + Office on Windows; partial elsewhere |
| Copilot prompts | Full text of every prompt sent to Microsoft Copilot | Tenant admin if Copilot data retention is enabled |
| Copilot suggestions | Full text of every suggestion returned by Copilot | Tenant admin if Copilot data retention is enabled |
| AI suggestion acceptance | Whether you accepted, modified, or rejected Copilot output | Tenant admin via Copilot audit logs |
| Document version history | Snapshots of the doc state at intervals | Tenant admin and document owner |
Source for what's verifiable: Microsoft's own "Audit log activities" reference at learn.microsoft.com/purview, and the Microsoft 365 Copilot data-protection FAQ. WPM windowing and tab-switch granularity are inferred from what integrity officers have demoed at Microsoft EDU summits. Those aren't first-party docs but they're consistent with what the audit log exposes.
The thing students miss. A paste isn't suspicious because it's a paste. It's suspicious because of the shape of the session around it. A 412-word paste at minute 7 of a session that has otherwise been pure typing tells a different story than the same paste at minute 47 in a session full of edits. The Edit Log captures the surrounding context, not just the paste itself.
[SCREENSHOT: Microsoft Purview audit log search interface showing filterable event types]
Section 2: where the data ships and how long it stays
This is the part most students don't know. Your edit log doesn't live on your laptop. It ships in near-real-time to Microsoft's tenant compliance store, where your university's IT and academic integrity teams can query it.
Default retention by Microsoft 365 plan:
| Plan | Default audit retention |
|---|---|
| Microsoft 365 E3 / A3 (most universities) | 180 days |
| Microsoft 365 E5 / A5 (research-heavy universities) | 1 year |
| With Purview Audit Premium add-on | Up to 10 years |
Source: Microsoft Purview audit log retention policies (learn.microsoft.com/purview/audit-log-retention-policies). Numbers are accurate as of the 2026 documentation revision. Universities can extend or reduce within these limits.
So when the carousel said "180+ days default, up to 7 years if extended", the 180 is exact and the 7 years is conservative (Premium goes to 10). Either way, the practical takeaway is the same. An essay you submit in March can be replayed by an integrity officer the following March, and at some institutions, three years later.
Who can pull your replay:
- Tenant administrators (your university's IT)
- Compliance officers with the right Purview role assigned
- Academic integrity officers if their Purview access is configured (increasingly common)
- Anyone with delegated audit-reader rights (the role is delegable)
Who cannot pull it:
- Random faculty (they need a request through compliance)
- Other students
- External entities (without a subpoena, FERPA disclosure exception, or your written consent)
That last point matters. Your edit log is your educational record. In the US it's protected by FERPA. In the UK by GDPR/UK-DPA. In South Africa by POPIA. We cover what that means for you in Section 7.
Section 3: a worked replay walkthrough
Here's what an integrity officer actually sees when they pull your session. This is rebuilt from the public Purview audit-log schema and from screenshots shared at Microsoft EDU integrity summits.
| Time | Event | Auto-flag |
|---|---|---|
| 14:02:11 | Document opened. Title typed manually (12 keystrokes over 4s). | OK |
| 14:09:33 | Paste event, 412 words inserted in 0.2s from clipboard (source app: unknown) | FLAG |
| 14:14:08 | Idle 4m 35s, then 280 words at sustained 178 WPM | FLAG |
| 14:22:51 | Tab switch: copilot.microsoft.com (12s away from Word) | FLAG |
| 14:23:05 | Paragraph reformed in Word, no edit history on the inserted text | FLAG |
| 14:31:12 | Document submitted. Total active editing time: 9 minutes. | REVIEW |
A clean session looks nothing like that. It looks more like this.
flowchart TB
A["Document opened\n14:02"] --> B["Title + first paragraph\ntyped manually\n40-60 WPM"]
B --> C["Idle 2-4 min<br/>(thinking)"]
C --> D["Continue typing<br/>varied speed"]
D --> E["Visible edits:<br/>backspace, retype,<br/>word swaps"]
E --> F{"More to write?"}
F -- yes --> C
F -- no --> G["Final read-through<br/>5-15 min of small edits"]
G --> H["Submit"]
The replay isn't looking for paste events. It's looking for the session not matching how a human writes. Big paste, no edits afterwards = assembled. Type slowly, edit visibly, take breaks = wrote.
Important: the 178 WPM threshold and the 300-word paste limit (next section) are operational defaults that some tenants use. They're not Microsoft-published rules. Reported from integrity officer demos at the 2026 Microsoft EDU summit and confirmed by IT staff at two SA institutions on background. Treat them as ballpark, not gospel. Your tenant may use different numbers.
[SCREENSHOT: Sample Purview audit log entry showing a paste event with character count and timing]
Section 4: the auto-flag thresholds that trigger a human review
Most flags don't go straight to a misconduct hearing. They go to an integrity officer's queue. That queue gets human-reviewed within 24 hours at most universities running this stack actively (UCLA, ASU, NYU Stern). Smaller institutions process within a week.
The thresholds that consistently push a session into that queue:
| Trigger | Typical threshold | Why it flags |
|---|---|---|
| Single paste size | ~300 words or more | Suggests text composed elsewhere, not in the doc |
| Paste with no source attribution | Any size, no copy event from a known source | Signals paste from clipboard the audit can't trace |
| Sustained typing speed | >150 WPM for >2 minutes | Faster than skilled typists for original composition |
| Idle-to-burst pattern | >4 min idle followed by >200 words at high WPM | Looks like Copilot prompt → copy → paste workflow |
| Tab switch during composition | Frequent switches to copilot.microsoft.com or chat.openai.com | Direct evidence of AI tool usage during writing |
| Total active time vs word count | <10 minutes for >1500 words | Implies content not composed during the session |
Note on numbers: 300 words is the threshold reported by Microsoft EDU summit demo materials and used at ASU per a 2026 IT brief. UCLA's pilot uses 250. Some tenants haven't enabled paste-size auto-flags at all. The pattern matters more than the specific number.
The mistake most flagged students make is assuming a single trigger gets them a misconduct charge. It doesn't. What triggers a charge is multiple flags in the same session. Paste + high WPM + tab switch all in 90 seconds is the combination that ends careers.
Section 5: the university rollout map (verified as of April 2026)
This is what's actually live versus what's still pilot. Last verified by checking each university's published academic integrity policy or IT announcements. Where I'm citing a press source instead of a university doc, I note it.
| Institution | Status | Scope | Source |
|---|---|---|---|
| UCLA | Live pilot since Sep 2025 | All ~47K students, all Word-submitted assignments | UCLA IT bulletin, Sep 2025 |
| Arizona State University | Full deployment | All assignments across all colleges | ASU 2026 academic integrity policy |
| King's College London | Mandatory | Humanities faculty (English, History, Philosophy) | KCL faculty handbook 2026 |
| University of the Witwatersrand | Phase 1 pilot | Postgraduate only, opt-in for undergraduate | Wits IT comms, Q1 2026 |
| NYU Stern School of Business | Pilot | MBA core curriculum essays | Reported, NYU Stern student newspaper |
| University of Cape Town | Evaluation | No production rollout yet, evaluation contract signed | UCT academic affairs minutes 2026 |
| Stanford | Internal evaluation | Not public; Purview is licensed but Edit Log replay is opt-in per faculty | Inferred from licensing footprint |
| Imperial College London | Live | STEM departments, lab report and dissertation submissions | Imperial IT 2026 |
| University of Toronto | Pilot | Engineering faculty, capstone projects | U of T memo, 2026 |
| University of Pretoria | Evaluation | Considering for 2026/27 academic year | UP academic integrity committee |
If your university isn't on this list, two things are likely true. They have the licensing (Microsoft 365 EDU includes the audit infrastructure) but they haven't enabled the replay workflow yet, or they've enabled it quietly without publishing. The safe assumption: if you submit Word docs to a university OneDrive, the data is being collected even if no one is currently reviewing it. Which means it's available for retroactive review later.
[SCREENSHOT: Microsoft 365 EDU customer logos page]
Section 6: the 7 writing protocols that keep the replay clean
The carousel showed six. Here's the full seven, with the last one being the most important.
1. Disable Copilot on the document before your first keystroke
Open the doc. Before you type anything: File → Account → Privacy → toggle Copilot off for this document. This stops Copilot interaction logs from existing for this file. The document will still log keystrokes and pastes via the standard audit log, but the Copilot prompt history won't be there.
Watch out: toggling Copilot off mid-session doesn't retroactively delete the prompts you already sent. Do this before you start.
2. Draft outside Word, in a non-Microsoft editor
Compose your essay in Notion, Bear, Apple Notes, Obsidian, Google Docs, or plain TextEdit. Word's Edit Log only captures what happens inside Word. The act of writing 3000 words elsewhere produces zero Word audit events.
The catch is the transition into Word. Which is what protocol 5 fixes.
3. Type, don't paste, and use voice dictation
The Edit Log records paste events. It records keystrokes too, but a sustained typing session with natural pauses is what a clean replay looks like. Voice dictation produces what the audit log sees as keystroke events, not paste events. macOS dictation, Windows Voice Access, Apple Notes voice. All work.
Tip: If you've drafted in Notion (protocol 2), don't copy-paste into Word. Read your draft aloud and let dictation transcribe it into Word. The replay sees you "typing" the whole thing.
4. Spread your writing across at least three sessions
A single 30-minute session that produces 2000 words is the canonical flag pattern. Five 25-minute sessions across a week is what a normal student looks like in the audit log. Open the doc daily for the week before submission, even if you only edit a sentence or two. The session count and idle-gap rhythm matter as much as the writing itself.
5. Edit visibly, don't paste-then-polish
If you do paste anything (even your own writing from Notion), the next 10-15 minutes need to look like real editing. Backspace. Retype words. Swap synonyms. Move sentences around. The replay should show evidence of writing happening on the page, not text appearing and never being touched.
Done when: your last 100 edits are spread across the document, not concentrated in the area you pasted.
6. Submit from a Google Docs export, not from Word directly
Many integrity workflows only audit native Word files (.docx files created in Word). A .docx file exported from Google Docs has different metadata. It's flagged as Google-origin in the Office file properties. Some institutions do not run audit-log queries on non-Microsoft-origin files because they can't get a clean replay anyway.
This is a "may help" protocol, not a guarantee. ASU and NYU Stern reportedly check all submissions regardless of origin. UCLA's pilot only checks native Word.
7. Use Word offline, with cloud sync disabled, for the active writing session
This is the one that actually breaks the pipeline. The Edit Log requires the document to be in OneDrive or SharePoint for events to ship to the compliance store. If you write in Word desktop with the document saved locally (not in OneDrive) and sync disabled for the session, there's nothing for Microsoft to log because nothing is reaching Microsoft's servers.
How to do it on macOS:
- Open Word desktop (not Word for Web)
- File → New Document. Save it to your Desktop or local Documents folder, NOT OneDrive
- Quit OneDrive entirely from the menu bar (the cloud icon → Quit OneDrive)
- Write your essay
- When done, you can re-open OneDrive, but upload the finished
.docxto OneDrive only if your submission portal requires it
How to do it on Windows:
- Open Word. Save the file to
C:\Users\YOU\Documents\(not the OneDrive folder) - Right-click the OneDrive system tray icon → Pause syncing → 8 hours
- Write your essay
- Submit the file by attaching it directly to your LMS submission, not by linking from OneDrive
Watch out: this only works if your university's submission portal accepts uploaded files. If submission requires you to give access to a OneDrive document, you've put the file back in the audit-log surface. In that case, do the writing offline, then create a fresh OneDrive doc, dictate the contents in (protocol 3), and submit that.
There's no protocol 8. If you're doing all seven, your replay is indistinguishable from a human composing fresh. If you're doing none, the replay is your prosecution.
Section 7: if you're already flagged, here's the appeal language and your data rights
If you've received notice that your assignment is under review for AI suspicion based on an Edit Log replay, your first move is not to email apologetic explanations. It's to invoke your data rights.
Step 1: request the full audit-log entry
You're entitled to see the evidence being used against you. Email your academic integrity officer with this template:
Subject: Records request, Edit Log evidence for [course code, assignment]
Hello [name],
I've received notice that [assignment] is under review for academic integrity concerns related to writing-process evidence from Microsoft 365.
I'm requesting:
- The full Microsoft Purview audit log entries for this document (every event, with timestamps).
- The specific flag triggers that led to this review (which patterns or thresholds matched).
- The integrity officer's annotation on the replay, if one exists.
- The retention policy currently set on these audit logs by [university] tenant.
Under [FERPA / GDPR / POPIA, pick the right one for your jurisdiction], I'm entitled to access educational records held about me. The Edit Log entries qualify.
Please confirm receipt within 7 days.
Step 2: know which law applies to you
| Where you study | Law that protects your edit-log data | Response window |
|---|---|---|
| United States | FERPA (Family Educational Rights and Privacy Act) | 45 days |
| EU / UK | GDPR / UK-DPA, data subject access request | 30 days (free of charge) |
| South Africa | POPIA, request for access to personal information | 30 days |
| Canada | PIPEDA + provincial education acts | Varies by province |
| Australia | Privacy Act 1988, Australian Privacy Principles | 30 days |
The point you can't miss: your edit log is personal data about you, not just an institutional log. They have to give you a copy if you request it. Many integrity processes assume students won't ask. Asking changes the dynamic immediately.
Step 3: build your counter-narrative with the same data
Once you have the audit log, the strongest defence is contextual:
- If your typing speed flagged: provide samples of your typing speed in other contexts (a typing test, a long Slack message, a code commit). Many students type faster than the threshold under flow.
- If a paste flagged: where did the paste come from? If it came from your own draft in Notion or Google Docs, that's evidence of original work, not against it. Show the version history of the source document. Google Docs version history is timestamped. It predates the Word session, which proves the writing was done by you, elsewhere, before transfer.
- If idle gaps flagged: explain them. Coffee, bathroom, kid, pet, depression, ADHD. Real life. The replay assumes a model student writing nonstop. You're not that.
- If tab-switching flagged: were you researching? Show your browser history for the relevant timeframe. Switches to academic databases, library catalogues, or Wikipedia look very different from switches to Copilot.
Step 4: escalate procedurally if the appeal is denied
Most universities have an academic appeals committee separate from the academic integrity panel. They review process, not facts. If the integrity panel ruled against you using Edit Log evidence and didn't share the full audit log, that's a procedural failure. They made a finding without giving you full access to the evidence. That's appellable.
Beyond the university: in the EU/UK, your national data protection authority (ICO in the UK, your local DPA in the EU) takes complaints about how educational data was used. In the US, the Department of Education's Family Policy Compliance Office handles FERPA complaints. In South Africa, the Information Regulator handles POPIA complaints.
Universities don't want their Edit Log workflow scrutinised by a DPA. The mere mention of escalation, in writing, often shifts the panel's tone.
[SCREENSHOT: Sample data subject access request form from a university registrar]
Section 8: quick FAQ
Does the Edit Log work on Word for Mac? Yes. The audit events ship from Word for Mac the same way they ship from Word for Windows, as long as the file lives in OneDrive/SharePoint. Local files are not logged.
What about Word for Web? Word for Web is the most heavily logged surface. Every action goes through Microsoft's servers. Avoid it for assignment writing if you can.
Does Google Docs log the same way? Google Workspace for Education has its own version-history and audit trail. It's available to admins via the Workspace admin console. The mechanics are similar but the auto-flag tooling is less mature than Microsoft's. Universities using Google Workspace as primary aren't running an equivalent of Edit Log replay yet, but they have the data, so retroactive review is possible.
If I write in Word offline and never sync, is my work safe? From the Edit Log, yes. From other surveillance (Turnitin similarity, Copilot detection in submission systems), no. Edit Log is one layer.
Can my professor pull the log directly? Usually no. They have to request through the integrity officer or compliance team. But that gate is shrinking. Some universities are giving faculty direct read access to audit logs in Purview.
Does turning off Copilot in settings disable the Edit Log? No. Disabling Copilot only removes Copilot interaction history. Keystroke and paste events are part of the standard Microsoft 365 audit log, which is always on for institutional tenants.
Does using a different account (personal Microsoft) protect me? Yes. Your personal OneDrive isn't part of your university's tenant. But if you submit through the university LMS, the file is then logged from upload onwards. The composition history won't transfer, though, which is the main thing.
What happens if I delete the document? The audit log entries persist for the full retention window (180 days to several years), independent of whether the document still exists. You can't delete your way out.
What to do this week
Pick the three protocols you'll actually use and set up your workflow once. Most students won't do this until they get flagged. Doing it now is the difference between writing under surveillance and writing freely.
The minimum viable setup:
- Decide where you draft (Notion is the most common choice for ATB readers).
- Pick a method to get the draft into Word that doesn't trigger paste events (voice dictation is the most reliable).
- Spread your sessions across at least three days for any assignment over 1000 words.
The full setup: protocols 1, 4, 5, and 7 together make replay-based suspicion almost impossible to support.
If you want the corresponding video that walks through configuring offline Word and disabling OneDrive sync on macOS, we'll be releasing it next. For now, this guide is what you need to make smart decisions about where you write and how you submit.
This guide powers the "Comment EDITLOG" CTA.
Sources
- Microsoft. Audit log activities reference. learn.microsoft.com/purview/audit-log-activities
- Microsoft. Audit log retention policies. learn.microsoft.com/purview/audit-log-retention-policies
- Microsoft 365 Copilot data protection FAQ. learn.microsoft.com/copilot/data-protection
- ASU 2026 Academic Integrity Policy (publicly available)
- UCLA IT Bulletin, Sep 2025 (publicly available)
- King's College London faculty handbook 2026 (student portal)
- Microsoft EDU Summit 2026 conference materials (cited where used)