17 ms·

One thing that's not clear in the write-up here: which audit log is he talking about? Sharepoint file accesses? Copilot actions? Purview? Something else?

One thing that's not clear in the write-up here: *which* audit log is he talking about? Sharepoint file accesses? Copilot actions? Purview? Something else?

RachelF 1y ago
Lots of things aren't clear. Copilot is accessing the indexed contents of the file, not the file itself, when you tell it not to access the file. The blog writer/marketer needs to look at the index access logs.
- internetter 1y ago
  > The blog writer/marketer needs to look at the index access logs. How can you say this if microsoft is issuing a fix?
- pnt12 1y ago
  But those are technicalities. I imagine the intended feature is learning about who read some information, and who modified it. The implementation varies, but on a CRUD app it seems easy: an authenticated GET or PUT request against a file path - easy audit log. If you are copying information to another place, and make it accessible there in a lossy way that is hard to audit... you broke your auditing system. Maybe it's useful, maybe it's a trade-off, but is something that should be disclosed.
  - mr_toad 1y ago
    Not all vector databases are lossy. And even if a lossy index is used it’s totally possible to identify the original source of the information.
poemxo 1y ago
I asked ChatGPT the same thing and got > The system being referred to in that explanation is Microsoft 365 (M365) / Office 365 audit logging, specifically the Unified Audit Log in the Microsoft Purview Compliance Portal.
- eCa 1y ago
  Have you confirmed that this is true?
  - poemxo 1y ago
    No, but I figured it would recognize the format of the audit logs and no one else seemed to confirm which audit logs they meant. It seems like this[1] documentation matches the stuff in TFA [1] https://learn.microsoft.com/en-us/purview/audit-copilot https://learn.microsoft.com/en-us/purview/audit-copilot
    - lionkor 1y ago
      It doesn't recognize. It tells you what you wanna hear. I don't understand how this isn't brutally clear to everyone at this point.
    - majewsky 1y ago
      If you had checked that before posting your original message, you could have spared yourself the embarrassment of publishing a "ChatGPT speculates the following" post by just linking the documentation right away.
NameForComment 1y ago
In one of the footnotes: "The audit log will not show that the user accessed the file as a normal SharePointFileOperation FileAccessed event, but rather as a CopilotInteraction record. That’s intended, and in my opinion correct. It would be weird to make it as if the user directly accessed the file when they only did so via Copilot."
- ezconnect 1y ago
  So it is not logged as Copilot and the user using Copilot? I guess the chat is logged so it's another way to trace accountability.

One thing that's not clear in the write-up here: *which* audit log is he talking about? Sharepoint file accesses? Copilot actions? Purview? Something else?

RachelF 1y ago

Lots of things aren't clear. Copilot is accessing the indexed contents of the file, not the file itself, when you tell it not to access the file. The blog writer/marketer needs to look at the index access logs.

internetter 1y ago
> The blog writer/marketer needs to look at the index access logs. How can you say this if microsoft is issuing a fix?
pnt12 1y ago
But those are technicalities. I imagine the intended feature is learning about who read some information, and who modified it. The implementation varies, but on a CRUD app it seems easy: an authenticated GET or PUT request against a file path - easy audit log. If you are copying information to another place, and make it accessible there in a lossy way that is hard to audit... you broke your auditing system. Maybe it's useful, maybe it's a trade-off, but is something that should be disclosed.
- mr_toad 1y ago
  Not all vector databases are lossy. And even if a lossy index is used it’s totally possible to identify the original source of the information.

poemxo 1y ago

I asked ChatGPT the same thing and got > The system being referred to in that explanation is Microsoft 365 (M365) / Office 365 audit logging, specifically the Unified Audit Log in the Microsoft Purview Compliance Portal.

eCa 1y ago
Have you confirmed that this is true?
- poemxo 1y ago
  No, but I figured it would recognize the format of the audit logs and no one else seemed to confirm which audit logs they meant. It seems like this[1] documentation matches the stuff in TFA [1] https://learn.microsoft.com/en-us/purview/audit-copilot https://learn.microsoft.com/en-us/purview/audit-copilot
  - lionkor 1y ago
    It doesn't recognize. It tells you what you wanna hear. I don't understand how this isn't brutally clear to everyone at this point.
  - majewsky 1y ago
    If you had checked that before posting your original message, you could have spared yourself the embarrassment of publishing a "ChatGPT speculates the following" post by just linking the documentation right away.

NameForComment 1y ago

In one of the footnotes: "The audit log will not show that the user accessed the file as a normal SharePointFileOperation FileAccessed event, but rather as a CopilotInteraction record. That’s intended, and in my opinion correct. It would be weird to make it as if the user directly accessed the file when they only did so via Copilot."

ezconnect 1y ago
So it is not logged as Copilot and the user using Copilot? I guess the chat is logged so it's another way to trace accountability.