Need help recovering ChatGPT Enterprise app for auditing

Question

Need help recovering ChatGPT Enterprise app for auditing

Dimick Beesley Admin 0

We wanted to disconnect ChatGPT from potentially sensitive data, and without thinking I deleted it. Now we want to see what it may have accessed while it was connected.

Chandra Boorla 12,285 Reputation points Microsoft External Staff Moderator

2025-05-02T20:17:08.6133333+00:00
@Dimick Beesley Admin

As I understand you deleted the ChatGPT Enterprise app to disconnect it from sensitive data, and now you'd like to audit what it may have accessed before deletion.

Even though the app is no longer active, you may still be able to retrieve audit logs depending on your identity provider and logging configuration.

Just to better understand what might still be recoverable, could you confirm the following:

Was Microsoft Entra ID (formerly Azure AD) logging enabled for your tenant -specifically, were sign-in logs and audit logs retained?

Was Log Analytics or Azure Monitor configured to collect logs or telemetry related to enterprise applications like ChatGPT?

Was the ChatGPT Enterprise app registered in Microsoft Purview as a data source, or scanned using Purview before deletion?

Thank you.
phemanth 15,490 Reputation points Microsoft External Staff Moderator

2025-05-05T04:15:02.4266667+00:00

@Dimick Beesley Admin We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 12,285 Reputation points Microsoft External Staff Moderator

2025-05-05T22:21:15.66+00:00

@Dimick Beesley Admin

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Chandra Boorla 12,285 Reputation points Microsoft External Staff Moderator

2025-05-02T20:17:08.6133333+00:00

@Dimick Beesley Admin

As I understand you deleted the ChatGPT Enterprise app to disconnect it from sensitive data, and now you'd like to audit what it may have accessed before deletion.

Even though the app is no longer active, you may still be able to retrieve audit logs depending on your identity provider and logging configuration.

Just to better understand what might still be recoverable, could you confirm the following:

Was Microsoft Entra ID (formerly Azure AD) logging enabled for your tenant -specifically, were sign-in logs and audit logs retained?

Was Log Analytics or Azure Monitor configured to collect logs or telemetry related to enterprise applications like ChatGPT?

Was the ChatGPT Enterprise app registered in Microsoft Purview as a data source, or scanned using Purview before deletion?

Thank you.
phemanth 15,490 Reputation points Microsoft External Staff Moderator

2025-05-05T04:15:02.4266667+00:00

@Dimick Beesley Admin We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 12,285 Reputation points Microsoft External Staff Moderator

2025-05-05T22:21:15.66+00:00

@Dimick Beesley Admin

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

@Dimick Beesley Admin

Based on my understanding, you are using the Microsoft Purview service to connect to and manage the ChatGPT Enterprise app for auditing, please correct me if I'm mistaken.

If the ChatGPT Enterprise app was previously registered and scanned using Microsoft Purview, you may still be able to retrieve relevant audit and access information even after deletion. Here are a few ways you can proceed:

Scan History in Purview

Navigate to Microsoft Purview > Data Map > Sources.

Locate the ChatGPT Enterprise data source (it may appear inactive).

Review the scan history for insights into what data assets were scanned, classified, or labeled.

For additional information, please refer: Monitor scan runs

Lineage Tracking

Go to Purview > Data Lineage.

Search for assets that were connected to the ChatGPT Enterprise app.

Lineage diagrams may still show upstream or downstream data interactions the app had.

For more details, please refer: Data lineage in Microsoft Purview

Purview Insights

Under Purview Insights > Scan Insights or Asset Insights, filter for the relevant time period before deletion.

This will help you identify which assets were accessed or categorized by the app.

For more details, please refer: Understand the classic assets report in Unified Catalog

If Logging Wasn't Enabled

If the app was deleted before enabling Microsoft Purview scans, audit logging (via Microsoft Entra ID), or external logging tools (e.g., Azure Log Analytics or Microsoft 365 audit logs), and if it cannot be restored, there may be limited or no access to historical activity.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.

Share via

Need help recovering ChatGPT Enterprise app for auditing

1 answer

Your answer