Skip to content

Capture matrix

The honest, surface-by-surface answer to "what is actually capturable for M365-originated FDA calls?"

The triple, and where each part lives

Part of the triple Best programmatic source Status Notes
User question (prompt) MS Graph aiInteractionHistory → text; Office 365 Mgmt API → index GA Graph gives full text; Mgmt API gives metadata + thread id
Rephrased question / grounding Workspace-monitoring ApplicationContext; FDA SDK run-steps (replay only) Partial Internal chain-of-thought is not exposed for live M365 calls
Generated / executed DAX Semantic-model workspace monitoring (EventText = DAX, executed over XMLA) GA The most reliable programmatic DAX source for M365 traffic
Answer (response) MS Graph aiInteractionHistory; Purview DSPM/Activity Explorer GA / Preview Graph returns response body
User + timestamp All three sources GA Used as the correlation key
Full DAX as the agent generated it + reasoning Purview DSPM for AI / Activity Explorer, FDA Python SDK (replay) Preview Activity Explorer shows generated queries; not cleanly API-exportable yet

Design consequence: no single API returns the whole triple for live M365 calls. We capture from multiple surfaces and correlate by user + time-window + workspace/model.

The three capture surfaces

What: prompt and response text, one row per message, keyed per user.

Endpoint: GET /copilot/users/{user}/interactionHistory/getAllEnterpriseInteractions

Permission: AiEnterpriseInteraction.Read.All (application, admin-consented).

Lands in: Raw_GraphInteractions.

Caveats: keyed per user, so you must enumerate a user set (explicit list or Entra group expansion); coverage of FDA-via-M365 depends on which experiences write to the interaction-history service. Can lag the live interaction by minutes.

What: CopilotInteraction audit records (RecordType 261) — metadata only: ThreadId, MessageIds, AppHost, AccessedResources, agent id, user, timestamp. No prompt/response text and no DAX.

Endpoint: .../activity/feed/subscriptions/content?contentType=Audit.General

Permission: ActivityFeed.Read (Office 365 Management APIs). Requires the unified audit log to be on.

Lands in: Raw_AuditInteractions.

Caveats: index/metadata surface; useful for thread/agent attribution and as a correlation anchor. Can lag minutes to ~30 min.

What: the executed DAX (EventText) plus DurationMs, CpuTimeMs, Status, executing-user identity and ApplicationContext. The FDA executes its NL2DAX output over the XMLA endpoint, and that execution is logged here.

Source: the read-only monitoring Eventhouse created when you enable workspace monitoring.

Permission: Database Viewer on the monitoring KQL database.

Lands in: Raw_ExecutedDax.

Caveats: the GA, near-real-time source of truth for DAX. This is what makes per-interaction tuning possible.

What: the richest reasoning / run-steps (generated queries, tool calls, errors) — but produced by re-asking sampled questions through the Fabric Data Agent SDK, not captured from the live M365 turn.

Lands in: Raw_SdkRuns. See SDK replay.

Caveats: preview; a reconstruction on the FDA side. Use for side-by-side comparison, not as the production record.

What you cannot get (for live M365 calls)

  • Chain-of-thought / internal reasoning tokens. Not exposed by any GA surface. The closest approximations are the rephrased question (ApplicationContext, where present), the concrete grounding artifact (the DAX), and the SDK replay reconstruction.
  • The DAX exactly as the agent emitted it, cleanly via API. Purview DSPM for AI / Activity Explorer shows generated queries in preview, but it is not cleanly API-exportable yet. Workspace monitoring's executed DAX is the reliable proxy.

Graceful degradation

The collector wraps each source so a missing or preview surface is skipped and logged, never fatal. A run with only workspace monitoring available still lands DAX rows (as Unmatched orphans) so no DAX is lost; a run with only Graph available lands question/answer text without DAX. The GA spine is B + C.