Data, privacy and security documentation — Microsoft 365 Copilot

Cited by

Facts read from this source

• GDPR commitment Report an error

  “Microsoft Copilot, including Microsoft Copilot Search, is compliant with our existing privacy, security, and compliance commitments to Microsoft 365 commercial customers, including the General Data Protection Regulation (GDPR) and European Union (EU) Data Boundary.”

• No training on customer data Report an error

  “Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”

• Permission based grounding Report an error

  “Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions.”

• Anthropic Report an error

  “For information about models provided by Anthropic as a subprocessor within Microsoft Copilot experiences, see Anthropic models in Microsoft Online Services.”

• Openai Report an error

  “For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services.”

• Abuse monitoring opt out Report an error

  “While abuse monitoring, which includes human review of content, is available in Azure OpenAI, Microsoft Copilot services have opted out of it.”

• Stored interactions Report an error

  “The stored data includes the user's prompt and Copilot's response, including citations to any information used to ground Copilot's response.”

• Admin tools Report an error

  “To view and manage this stored data, admins can use Content search or Microsoft Purview.”

• User deletion Report an error

  “Your users can delete their Copilot activity history, which includes their prompts and the responses Copilot returns, by going to the My Account portal.”

• Teams export API Report an error

  “For Microsoft Teams chats with Copilot, admins can also use Microsoft Teams Export APIs to view the stored data.”

• EU data boundary Report an error

  “EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.”

• Anthropic EU exclusion Report an error

  “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.”

• Data residency Report an error

  “Microsoft Copilot was added as a covered workload in the data residency commitments in Microsoft Product Terms on March 1, 2024.”

• Non EU processing regions Report an error

  “Customers outside the EU may have their queries processed in the US, EU, or other regions.”

• Graph connectors Report an error

  “Microsoft Copilot experiences can reference third-party tools and services when responding to a user's request by using Microsoft Graph connectors or agents.”

• Admin agent control Report an error

  “Admins have full control to select which agents are allowed in their organization.”

• Encryption at rest transit Report an error

  “Microsoft 365 uses service-side technologies that encrypt customer content at rest and in transit, including BitLocker, per-file encryption, Transport Layer Security (TLS), and Internet Protocol Security (IPsec).”

• Purview encryption honored Report an error

  “When you have data that's encrypted by Microsoft Purview Information Protection, Microsoft Copilot honors the usage rights granted to the user.”

• ISO standards Report an error

  “Your control over your data is reinforced by Microsoft's commitment to comply with broadly applicable privacy laws, such as the GDPR, and privacy standards, such as ISO/IEC 27018, the world's first international code of practice for cloud privacy.”

• Certifications Report an error

  “Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.”

• EU AI act Report an error

  “Microsoft is committed to complying with all laws and regulations applicable to Microsoft, including the EU AI Act, to enable our AI solutions to meet evolving standards for trustworthy and responsible AI.”

• Privacy controls effect Report an error

  “If you turn off connected experiences that analyze your content on devices in your organization, Microsoft Copilot features won't be available to your users in the following apps: Excel OneNote Outlook PowerPoint Word”

• Optional connected experiences Report an error

  “If you turn off optional connected experiences in your organization, Microsoft Copilot features that are optional connected experiences won't be available to your users.”

• Copyright commitment Report an error

  “If a third party sues a commercial customer for copyright infringement for using Microsoft's Copilots or the output they generate, we'll defend the customer and pay the amount of any adverse judgments or settlements that result from the lawsuit, as long as the customer used the guardrails and content filters we have built into our products.”

• Ownership of output Report an error

  “Microsoft doesn't claim ownership of the output of the service.”

• Protected material detection Report an error

  “Yes, Microsoft Copilot provides detection for protected materials, which includes text subject to copyright and code subject to licensing restrictions.”

• Prompt injection mitigation Report an error

  “Microsoft Copilot helps mitigate these attacks by using proprietary techniques, such as jailbreak and cross-prompt injection attack (XPIA) classifiers.”

• Content harm filters Report an error

  “content harm filters to identify harmful content in prompts or generated responses (such as Hate & Fairness, Sexual, Violence, and Self-harm)”

• Web search via bing Report an error

  “Based on these terms, Copilot generates a search query that it sends to the Bing Search service.”

• Semantic index access boundary Report an error

  “Semantic Index honors the user identity-based access boundary so that the grounding process only accesses content that the current user is authorized to access.”

• Model updates no setting change Report an error

  “Model updates bring performance improvements, more advanced reasoning, and expanded capabilities, but they don't change your security, privacy, or compliance settings.”

• Tenant isolation Report an error

  “Logical isolation of customer content within each tenant for Microsoft 365 services is achieved through Microsoft Entra authorization and role-based access control.”

Scores citing this record

• The Automation Lead Data use, training & retention
• The Automation Lead Models & processing location
• The Automation Lead Admin, identity & access controls
• The Automation Lead Integrations, connectors & knowledge
• The Automation Lead Agent capabilities & guardrails
• The Automation Lead European sovereignty
• The Automation Lead Data use, training & retention
• The Automation Lead Models & processing location
• The Automation Lead Admin, identity & access controls
• The Automation Lead Integrations, connectors & knowledge
• The Automation Lead Agent capabilities & guardrails
• The Automation Lead European sovereignty
• The Customer-Service Director Data use, training & retention
• The Customer-Service Director Models & processing location
• The Customer-Service Director Admin, identity & access controls
• The Customer-Service Director Integrations, connectors & knowledge
• The Customer-Service Director Agent capabilities & guardrails
• The Customer-Service Director European sovereignty
• The Customer-Service Director Data use, training & retention
• The Customer-Service Director Models & processing location
• The Customer-Service Director Admin, identity & access controls
• The Customer-Service Director Integrations, connectors & knowledge
• The Customer-Service Director Agent capabilities & guardrails
• The Customer-Service Director European sovereignty
• The Data Protection Officer Data use, training & retention
• The Data Protection Officer Models & processing location
• The Data Protection Officer Admin, identity & access controls
• The Data Protection Officer Integrations, connectors & knowledge
• The Data Protection Officer Agent capabilities & guardrails
• The Data Protection Officer European sovereignty
• The Data Protection Officer Data use, training & retention
• The Data Protection Officer Models & processing location
• The Data Protection Officer Admin, identity & access controls
• The Data Protection Officer Integrations, connectors & knowledge
• The Data Protection Officer Agent capabilities & guardrails
• The Data Protection Officer European sovereignty
• The Head of IT Data use, training & retention
• The Head of IT Models & processing location
• The Head of IT Admin, identity & access controls
• The Head of IT Integrations, connectors & knowledge
• The Head of IT Agent capabilities & guardrails
• The Head of IT European sovereignty
• The Head of IT Data use, training & retention
• The Head of IT Models & processing location
• The Head of IT Admin, identity & access controls
• The Head of IT Integrations, connectors & knowledge
• The Head of IT Agent capabilities & guardrails
• The Head of IT European sovereignty
• The Skeptic Data use, training & retention
• The Skeptic Models & processing location
• The Skeptic Admin, identity & access controls
• The Skeptic Integrations, connectors & knowledge
• The Skeptic Agent capabilities & guardrails
• The Skeptic European sovereignty
• The Skeptic Data use, training & retention
• The Skeptic Models & processing location
• The Skeptic Admin, identity & access controls
• The Skeptic Integrations, connectors & knowledge
• The Skeptic Agent capabilities & guardrails
• The Skeptic European sovereignty
• The Works Council Member Data use, training & retention
• The Works Council Member Models & processing location
• The Works Council Member Admin, identity & access controls
• The Works Council Member Integrations, connectors & knowledge
• The Works Council Member Agent capabilities & guardrails
• The Works Council Member European sovereignty
• The Works Council Member Data use, training & retention
• The Works Council Member Models & processing location
• The Works Council Member Admin, identity & access controls
• The Works Council Member Integrations, connectors & knowledge
• The Works Council Member Agent capabilities & guardrails
• The Works Council Member European sovereignty