Microsoft 365 Copilot
microsoft.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- Anthropic models are on by default outside EU/UK and sit outside residency and in-country processing commitments
- A no-training commitment was found: confirm its scope in writing
- Retention terms found: confirm them in writing
See Before you sign, with what to ask for ↓
Scanned Nov 1, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: Anthropic is a Microsoft subprocessor whose models are enabled by default for commercial-cloud tenants outside the EU/EFTA and UK, which includes Australia. Microsoft states these models are currently excluded from the EU Data Boundary and from in-country processing commitments. A further class, 'Anthropic models with Data Retention' (e.g. Claude Fable 5, Claude Mythos 5), is off by default and, if an admin opts in, takes data outside the Microsoft DPA entirely: Anthropic acts as an independent processor and retains inputs/outputs for up to 30 days (up to two years for flagged content). By contrast, Fable 5.1 for eligible tenants runs under the Microsoft DPA with no Anthropic retention. UI indicators show when Claude models are in use.
What to ask for: Confirm for our tenant region whether Anthropic models are enabled by default, whether any Anthropic processing occurs outside Australia, and which Anthropic models are available under the Microsoft DPA versus Anthropic's own terms. The vendor states this can be switched off: disable it for your tenant before deployment, or confirm in writing that it is off.
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
“Microsoft enables Anthropic models on by default for most customers in commercial cloud (excluding EU/EFTA and UK). This update gives users in your organization the ability to use multiple AI models in their Microsoft offerings, such as in Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps.”
“Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments. Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default.”
“Anthropic models with Data Retention are advanced models (such as Claude Fable 5 and Claude Mythos 5 ) that require data retention by Anthropic. This means data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA.”
“This means that Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days before deleting them. If Anthropic's trust and safety classifiers identify potential violations of Anthropic's Usage Policy, Anthropic may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years. Anthropic doesn't use retained data for model training without your express permission.”
“For example, for certain organizations, Fable 5.1 is available with Anthropic acting as a subprocessor and Microsoft's Product Terms and Data Protection Addendum (DPA) apply. For these organizations, no additional terms apply, and Anthropic doesn't retain customer content (including prompts and responses).”
“Microsoft offers third-party AI models in Microsoft Copilot, such as Anthropic and OpenAI models. As an admin, you can decide whether to use these models to power your experiences, and additional terms may apply.”
Why it matters: The sources include a no-training statement ("Prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs, including those used by the product.") but do not settle the question for every model, plan and data type in scope.
What to ask for: Confirm in writing that the no-training commitment covers every model, plan and data type you will use, including any opt-in sharing or feedback.
“This means that Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days before deleting them. If Anthropic's trust and safety classifiers identify potential violations of Anthropic's Usage Policy, Anthropic may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years. Anthropic doesn't use retained data for model training without your express permission.”
“Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”
“We may use customer feedback, which is optional, to improve Microsoft Copilot, just like we use customer feedback to improve other Microsoft 365 services and Microsoft 365 productivity apps. We don't use this feedback to train the foundation LLMs used by Microsoft Copilot.”
Why it matters: The sources describe retention ("Prompts and responses are stored as the user's Copilot activity history within the Microsoft 365 tenant. There is no fixed deletion window; retention is customer-controlled through Microsoft Purview retention policies and Content search, and users can delete their own history.") but not a complete window for every data type.
What to ask for: Get retention periods in writing for inputs, outputs, logs and backups, including any provider that runs the model.
“Anthropic models with Data Retention are advanced models (such as Claude Fable 5 and Claude Mythos 5 ) that require data retention by Anthropic. This means data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA.”
“For example, for certain organizations, Fable 5.1 is available with Anthropic acting as a subprocessor and Microsoft's Product Terms and Data Protection Addendum (DPA) apply. For these organizations, no additional terms apply, and Anthropic doesn't retain customer content (including prompts and responses).”
“To view and manage this stored data, admins can use Content search or Microsoft Purview. Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”
Australian Government checksdirections checked Nov 1, 2026
No vendor-specific PSPF direction names this vendor or product (checked 2026-11-01).
Australian Government PROTECTED level; Microsoft 365 with Microsoft Copilot (Microsoft 365 Copilot) in the scope of assessed services; report stated to be on the Microsoft Service Trust Portal; assessment date and assessor not stated in the stash.
“An Australian Government Protected Infosec Registered Assessors Program (IRAP) assessment of Microsoft 365 with Microsoft Copilot is in the scope of assessed services and is available at Microsoft Service Trust Portal . Microsoft 365 (Copilot included) is assessed to store information at the Protected level and is the highest level of security assessment applicable to a public cloud service in Australia.”
Not found in the sources this scan collected. If the service will hold government data, ask whether it is hosted with a provider certified under the Hosting Certification Framework, and at which level.
The sources say: "Under the Product Terms, if a customer provisions its tenant in Australia (among the listed Geos), Microsoft stores the enumerated Customer Data categories at rest only within that Geo;" Confirm in the contract that every data type (inputs, outputs, logs and backups) stays in Australia, including when the AI model is run by a third party.
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo:”
What your organisation still has to do
Every level of government
- Treat AI outputs, including meeting transcripts and summaries, as public records: capture or dispose of them under your records authority (the Archives Act 1983 for Commonwealth agencies, your state's records legislation for state agencies and councils). Source ↗
Commonwealth agencies
- Assess foreign ownership, control or influence risk for this technology asset, as PSPF Direction 001-2024 requires. Source ↗
- Apply the DTA Policy for the responsible use of AI in government: record the use case, assess its impact before deployment, and keep your AI transparency statement current. Source ↗
- Assess the service against the ISM controls for the highest classification of data you intend to use with it (OFFICIAL, OFFICIAL: Sensitive or PROTECTED). Source ↗
State agencies and councils
- Assess the service under your state's privacy law, which governs where residents' personal information may go: for example the PPIP Act 1998 in New South Wales, the Privacy and Data Protection Act 2014 in Victoria or the Information Privacy Act 2009 in Queensland.
- New South Wales agencies: complete the NSW AI Assessment Framework self-assessment, which Circular DCS-2024-04 makes mandatory. Source ↗
- Victorian public sector: follow Administrative Guideline 2024/07 on the safe and responsible use of generative AI. Source ↗
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
When these models are enabled, Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days; content flagged by Anthropic's trust-and-safety classifiers may be kept up to two years and classification scores up to seven years. Anthropic does not use retained data for model training without the customer's express permission.
Requires written confirmation, see Before you sign ↓
“This means that Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days before deleting them. If Anthropic's trust and safety classifiers identify potential violations of Anthropic's Usage Policy, Anthropic may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years. Anthropic doesn't use retained data for model training without your express permission.”
“Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”
“We may use customer feedback, which is optional, to improve Microsoft Copilot, just like we use customer feedback to improve other Microsoft 365 services and Microsoft 365 productivity apps. We don't use this feedback to train the foundation LLMs used by Microsoft Copilot.”
!How long do they keep your data?Ask the vendor
Certain advanced Anthropic models require data retention by Anthropic: data is stored by Anthropic and is not subject to the Microsoft Customer Agreement, Product Terms or DPA. These models are off by default and need explicit tenant-admin opt-in, with Anthropic acting as an independent processor under Anthropic's own terms and DPA.
Requires written confirmation, see Before you sign ↓
“Anthropic models with Data Retention are advanced models (such as Claude Fable 5 and Claude Mythos 5 ) that require data retention by Anthropic. This means data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA.”
“For example, for certain organizations, Fable 5.1 is available with Anthropic acting as a subprocessor and Microsoft's Product Terms and Data Protection Addendum (DPA) apply. For these organizations, no additional terms apply, and Anthropic doesn't retain customer content (including prompts and responses).”
“To view and manage this stored data, admins can use Content search or Microsoft Purview. Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”
!Who else can access your data?Ask the vendor
Microsoft names OpenAI as a subprocessor providing models within Microsoft Copilot experiences and points to a dedicated page on OpenAI as a subprocessor in Microsoft Online Services.
Confirm in writing: Ask the vendor to state this in writing before signing.
“For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services .”
“Microsoft offers third-party AI models in Microsoft Copilot, such as Anthropic and OpenAI models. As an admin, you can decide whether to use these models to power your experiences, and additional terms may apply.”
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
“Microsoft enables Anthropic models on by default for most customers in commercial cloud (excluding EU/EFTA and UK). This update gives users in your organization the ability to use multiple AI models in their Microsoft offerings, such as in Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps.”
“The Data Protection Addendum does not apply to Bing Search Services or to any use of Bing within a Product. For any component of a Product that is powered by Bing, as disclosed in the product documentation, the Microsoft Privacy Statement ( https://privacy.microsoft.com/privacystatement ) applies.”
“When you're using web search, Microsoft Copilot parses the user's prompt and identifies terms where web search would improve the quality of the response. Based on these terms, Copilot generates a search query that it sends to the Bing Search service.”
“Subcontractors or subprocessors deployed by Microsoft to perform work that requires access to your data can perform only the functions they were hired to provide. They’re bound by the same contractual privacy commitments that Microsoft makes to you. The Microsoft Online Services Subprocessor List identifies authorized subprocessors who have been audited in advance against a stringent set of security and privacy requirements.”
✗Where is your data processed?Concern / gap
Anthropic models deployed in Microsoft Copilot and related offerings are currently excluded from the EU Data Boundary and, where applicable, from in-country processing commitments. Only EU Data Boundary and UK customers have them disabled by default; elsewhere (including Australia) they are on unless an admin disables them.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments. Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default.”
“Microsoft Copilot calls to the LLM are routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods.”
“Microsoft Advanced Data Residency (ADR) and Multi-Geo Capabilities offerings include data residency commitments for Microsoft Copilot customers as of March 1, 2024. For EU customers, Microsoft Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, EU, or other regions.”
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo:”
“any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat to the extent not included in the preceding commitments or subject to Data Residency for Microsoft 365 Copilot and Copilot Chat .”
“By the end of 2025, Microsoft will offer customers in four countries— Australia, the United Kingdom, India, and Japan —the option to have Microsoft 365 Copilot interactions processed in-country.”
“Local data inferencing for Copilot interactions in Microsoft 365 Copilot is expected to become available in Australia, India, the United Arab Emirates, United Kingdom and the United States by the end of 2026, with support for Canada to follow in 2027 and Japan in 2028.”
!What happens in a security incident?Ask the vendor
Microsoft's Trust Center states that documentation for DPIAs, data subject requests and data breach notification is provided for customers' GDPR accountability programs. The stash contains no incident notification timeline, vulnerability disclosure process or Copilot-specific incident handling detail.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Documentation for Data Protection Impact Assessments (DPIAs), Data Subject Requests (DSRs), and data breach notification is provided to incorporate into your own accountability program in support of the GDPR.”
Email to send the vendor7 items to confirm in writing
Hello Microsoft team, We are assessing Microsoft 365 Copilot (Microsoft) as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Please address the following: Anthropic models are on by default outside EU/UK and sit outside residency and in-country processing commitments. 2. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 3. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 4. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 5. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 6. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 7. Please provide the current Microsoft 365 IRAP assessment report (date, assessor, PROTECTED scope statement naming Microsoft 365 Copilot) and the latest SOC 2 Type II report covering Office 365 Services. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓PROTECTED-level IRAP scope, Australian at-rest residency and SOC 1/2 Type II coverageStrong
Microsoft states that an Australian Government PROTECTED IRAP assessment of Microsoft 365 includes Microsoft Copilot in scope (report on the Service Trust Portal), that tenants provisioned in Australia have stored Copilot interaction content held at rest only within that Geo under the Product Terms, and that Microsoft 365 Copilot is a defined Office 365 Service covered by SSAE 18 SOC 1 Type II and SOC 2 Type II. Configuration guidance is aligned to the ASD Blueprint for Secure Cloud.
For Australian Government and regulated buyers these are the primary gating controls: a PROTECTED IRAP scope that explicitly names the product, a contractual at-rest residency commitment, and independent SOC attestations. All are vendor-published; the IRAP report itself and SOC reports sit behind the Service Trust Portal and were not in the stash, so assessment dates and assessor are unverified here.
Question for vendor: Please provide the current Microsoft 365 IRAP assessment report (date, assessor, PROTECTED scope statement naming Microsoft 365 Copilot) and the latest SOC 2 Type II report covering Office 365 Services.
“An Australian Government Protected Infosec Registered Assessors Program (IRAP) assessment of Microsoft 365 with Microsoft Copilot is in the scope of assessed services and is available at Microsoft Service Trust Portal . Microsoft 365 (Copilot included) is assessed to store information at the Protected level and is the highest level of security assessment applicable to a public cloud service in Australia.”
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo:”
“any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat to the extent not included in the preceding commitments or subject to Data Residency for Microsoft 365 Copilot and Copilot Chat .”
“In addition to the security practices and policies for Online Services in the DPA , each Core Online Service also complies with the control standards and frameworks shown in the table below and implements and maintains the security measures set forth in Appendix A of the DPA for the protection of Customer Data . Online Service SSAE 18 SOC 1 Type II SSAE 18 SOC 2 Type II Office 365 Services Yes Yes”
“Office 365 Services The following services, each as a standalone service or as included in an Office 365 or Microsoft 365-branded plan or suite: Customer Lockbox, Exchange Online Archiving, Exchange Online Protection, Exchange Online, Microsoft Bookings, Microsoft Forms, Microsoft Planner, Microsoft Stream (Classic), Microsoft Teams, Microsoft To-Do, Microsoft Defender for Office 365, Office for the web, OneDrive for work or school, Project, SharePoint, Sway, Viva Insights, Whiteboard, Viva Engage, and Microsoft 365 Copilot.”
“This guidance assumes access to Microsoft Copilot subscription licensing and Microsoft 365 Enterprise E5, in alignment with the Australian Signals Directorate (ASD) Blueprint for Secure Cloud configuration guidance for Microsoft 365.”
✗Anthropic models are on by default outside EU/UK and sit outside residency and in-country processing commitmentsGap
Anthropic is a Microsoft subprocessor whose models are enabled by default for commercial-cloud tenants outside the EU/EFTA and UK, which includes Australia. Microsoft states these models are currently excluded from the EU Data Boundary and from in-country processing commitments. A further class, 'Anthropic models with Data Retention' (e.g. Claude Fable 5, Claude Mythos 5), is off by default and, if an admin opts in, takes data outside the Microsoft DPA entirely: Anthropic acts as an independent processor and retains inputs/outputs for up to 30 days (up to two years for flagged content). By contrast, Fable 5.1 for eligible tenants runs under the Microsoft DPA with no Anthropic retention. UI indicators show when Claude models are in use.
An Australian tenant that relies on residency or in-country processing and leaves defaults untouched will have some Copilot interactions processed by a third-party model provider outside those commitments. The admin controls exist, but the burden sits with the buyer to disable Anthropic as a subprocessor or restrict it to specific users. The Data Retention class changes the contractual counterparty for the data.
Question for vendor: Confirm for our tenant region whether Anthropic models are enabled by default, whether any Anthropic processing occurs outside Australia, and which Anthropic models are available under the Microsoft DPA versus Anthropic's own terms.
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
“Microsoft enables Anthropic models on by default for most customers in commercial cloud (excluding EU/EFTA and UK). This update gives users in your organization the ability to use multiple AI models in their Microsoft offerings, such as in Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps.”
“Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments. Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default.”
“Anthropic models with Data Retention are advanced models (such as Claude Fable 5 and Claude Mythos 5 ) that require data retention by Anthropic. This means data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA.”
“This means that Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days before deleting them. If Anthropic's trust and safety classifiers identify potential violations of Anthropic's Usage Policy, Anthropic may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years. Anthropic doesn't use retained data for model training without your express permission.”
“For example, for certain organizations, Fable 5.1 is available with Anthropic acting as a subprocessor and Microsoft's Product Terms and Data Protection Addendum (DPA) apply. For these organizations, no additional terms apply, and Anthropic doesn't retain customer content (including prompts and responses).”
“Microsoft offers third-party AI models in Microsoft Copilot, such as Anthropic and OpenAI models. As an admin, you can decide whether to use these models to power your experiences, and additional terms may apply.”
!Where Copilot prompts are processed: regional routing, Bing path outside the DPA, and Australian in-country inferencing still pendingGap
Microsoft discloses that LLM calls go to the closest regional data centre but can be routed to other regions under high utilisation, and that non-EU customers may have queries processed in the US, EU or other regions. In-country processing for Australia was announced for end-2025 but the same page's April 2026 note revises this to local inferencing 'expected' by end of 2026; the Microsoft 365 data residency page says detailed data-in-processing documentation is 'coming soon'. Separately, web-search queries generated by Copilot go to the Bing Search service, and the Product Terms exclude any use of Bing within a Product from the DPA (Microsoft Privacy Statement applies). The stale end-2025 statement is tagged stale_or_superseded.
At-rest residency is committed, but processing location is a 'mixed' picture today: regional-by-default with cross-region overflow, and no live in-country inferencing commitment for Australia in the evidence. Buyers who need in-country processing should treat it as a roadmap item and confirm in writing, and should decide whether to disable web search (an optional connected experience) given the Bing path sits outside the DPA.
Question for vendor: Is in-country inferencing for Microsoft 365 Copilot now available to Australian tenants, and under what contractual instrument? Under normal operations, in which regions are our prompts processed, and what are the overflow conditions?
“Microsoft Copilot calls to the LLM are routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods.”
“Microsoft Advanced Data Residency (ADR) and Multi-Geo Capabilities offerings include data residency commitments for Microsoft Copilot customers as of March 1, 2024. For EU customers, Microsoft Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, EU, or other regions.”
“By the end of 2025, Microsoft will offer customers in four countries— Australia, the United Kingdom, India, and Japan —the option to have Microsoft 365 Copilot interactions processed in-country.”
“Local data inferencing for Copilot interactions in Microsoft 365 Copilot is expected to become available in Australia, India, the United Arab Emirates, United Kingdom and the United States by the end of 2026, with support for Canada to follow in 2027 and Japan in 2028.”
“The Data Protection Addendum does not apply to Bing Search Services or to any use of Bing within a Product. For any component of a Product that is powered by Bing, as disclosed in the product documentation, the Microsoft Privacy Statement ( https://privacy.microsoft.com/privacystatement ) applies.”
“When you're using web search, Microsoft Copilot parses the user's prompt and identifies terms where web search would improve the quality of the response. Based on these terms, Copilot generates a search query that it sends to the Bing Search service.”
!Incident handling and evaluation evidence are thin in the public stash (judged partial, not not_evidenced)Gap
The only incident-related disclosure found is a Trust Center statement that GDPR breach-notification documentation is provided; there is no Copilot-specific incident notification timeline, vulnerability disclosure process or Secure Future Initiative detail in the collected pages. Testing and evaluation describes safeguards (content-harm filters, jailbreak/XPIA classifiers, protected-material detection) but publishes no evaluation results, red-team findings or coverage caveats beyond 'may not be available in all scenarios'. Both domains were marked partial rather than not_evidenced because a disclosure does exist in each; change_management is likewise partial (model updates are regular and settings-preserving, but no notice period is stated). Statements scoped to Microsoft 365 Copilot Chat or consumer Copilot were recorded with their own scope and did not drive any domain assessment.
A vendor of Microsoft's scale can supply incident SLAs and evaluation evidence (the DPA and Service Trust Portal exist for this), so the absence in the public pages is a question to ask rather than a sign nothing exists. Buyers should obtain the DPA security incident notification clause and any Copilot red-team or RAI evaluation summaries before sign-off.
Question for vendor: What is the contractual security-incident notification timeframe for Microsoft 365 Copilot, and can you share red-team or responsible-AI evaluation summaries for the current model set, including what notice is given before foundation model changes?
“Documentation for Data Protection Impact Assessments (DPIAs), Data Subject Requests (DSRs), and data breach notification is provided to incorporate into your own accountability program in support of the GDPR.”
“These safeguards use a defense-in-depth approach and can include a mix of Microsoft first-party protections that help detect and reduce jailbreak attempts and prompt injection patterns (including cross-prompt injection attacks), content harm filters to identify harmful content in prompts or generated responses (such as Hate & Fairness, Sexual, Violence, and Self-harm), or in some scenarios, safety mitigations built into the underlying model.”
“Microsoft Copilot helps mitigate these attacks by using proprietary techniques, such as jailbreak and cross-prompt injection attack (XPIA) classifiers. These classifiers analyze inputs to the Copilot service and help block high-risk prompts prior to model execution. These classifiers may not be available in all Microsoft Copilot scenarios.”
“The AI models that power Microsoft Copilot are regularly updated and enhanced. Model updates bring performance improvements, more advanced reasoning, and expanded capabilities, but they don't change your security, privacy, or compliance settings.”
✓No training on prompts, responses or Graph data; human-review abuse monitoring opted outStrong
Microsoft states that prompts, responses and Microsoft Graph data are not used to train foundation LLMs, that Copilot services have opted out of Azure OpenAI's human-review abuse monitoring, and that interaction data is stored encrypted in the tenant under customer-controlled Purview retention with user self-deletion. Optional customer feedback may be used to improve the product (but not to train foundation models), which is recorded as a mixed training verdict so buyers can confirm feedback controls in writing.
This is the strongest data-handling posture a buyer can expect from a hosted assistant: an explicit no-training commitment covering prompts, outputs and grounding data, no human review of content, and retention under the customer's own policies rather than a vendor-fixed window. The feedback carve-out is admin-manageable and does not extend to model training.
“Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”
“While abuse monitoring, which includes human review of content, is available in Azure OpenAI, Microsoft Copilot services have opted out of it.”
“To view and manage this stored data, admins can use Content search or Microsoft Purview. Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”
“We may use customer feedback, which is optional, to improve Microsoft Copilot, just like we use customer feedback to improve other Microsoft 365 services and Microsoft 365 productivity apps. We don't use this feedback to train the foundation LLMs used by Microsoft Copilot.”
“We may deploy other AI models for Microsoft Copilot to use that are hosted and operated by Microsoft. These models are governed by the same contractual and data protection commitments already in place, including that no data leaves Microsoft.”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score65
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“At Microsoft, we're guided by our AI principles , our Responsible AI Standard , and decades of research on AI, grounding, and privacy-preserving machine learning. A multidisciplinary team of researchers, engineers, and policy experts reviews our AI systems for potential harms and mitigations - refining training data, filtering to limit harmful content, query- and result-blocking sensitive topics, and applying Microsoft technologies like InterpretML and Fairlearn to help detect and correct data bias.”
“This guidance assumes access to Microsoft Copilot subscription licensing and Microsoft 365 Enterprise E5, in alignment with the Australian Signals Directorate (ASD) Blueprint for Secure Cloud configuration guidance for Microsoft 365.”
“Workplace harms refers to a category of harms that can result from generative AI or models making inferences, judgments, or evaluations about an employee based on their workplace communication. Currently, that means inferences, judgments, or evaluations about an employee's performance, attitude, internal or emotional state, or personal characteristics. We restrict the use of generative AI or models from being used for these purposes.”
Governance & accountability: vendor-evidenced, not yet independently corroborated.
AI system15% of the score47
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Microsoft Copilot is a sophisticated processing and orchestration engine that provides AI-powered productivity capabilities by coordinating the following components:”
“Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat. Some experiences, licenses, and capabilities might continue to reference Microsoft 365 Copilot and Microsoft 365 Copilot Chat during the transition period. There are no changes to security, compliance, and privacy for organizations.”
“Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions.”
“Unlike Microsoft Copilot, Copilot Chat is not grounded in organizational content like files, emails, or chats as part of the chat experience—it is grounded in data from the web only.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“These safeguards use a defense-in-depth approach and can include a mix of Microsoft first-party protections that help detect and reduce jailbreak attempts and prompt injection patterns (including cross-prompt injection attacks), content harm filters to identify harmful content in prompts or generated responses (such as Hate & Fairness, Sexual, Violence, and Self-harm), or in some scenarios, safety mitigations built into the underlying model.”
“Microsoft Copilot helps mitigate these attacks by using proprietary techniques, such as jailbreak and cross-prompt injection attack (XPIA) classifiers. These classifiers analyze inputs to the Copilot service and help block high-risk prompts prior to model execution. These classifiers may not be available in all Microsoft Copilot scenarios.”
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“The AI models that power Microsoft Copilot are regularly updated and enhanced. Model updates bring performance improvements, more advanced reasoning, and expanded capabilities, but they don't change your security, privacy, or compliance settings.”
“Preview models are the latest models that may, from time to time, be available for exploration and testing but aren't recommended for production use.”
“Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat. Some experiences, licenses, and capabilities might continue to reference Microsoft 365 Copilot and Microsoft 365 Copilot Chat during the transition period. There are no changes to security, compliance, and privacy for organizations.”
AI system description: vendor-evidenced, not yet independently corroborated.
Model10% of the score60
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services .”
“Microsoft offers third-party AI models in Microsoft Copilot, such as Anthropic and OpenAI models. As an admin, you can decide whether to use these models to power your experiences, and additional terms may apply.”
“We may deploy other AI models for Microsoft Copilot to use that are hosted and operated by Microsoft. These models are governed by the same contractual and data protection commitments already in place, including that no data leaves Microsoft.”
“Prompts and responses from Microsoft 365 Copilot large language models hosted on Azure OpenAI.”
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
Model provider transparency: vendor-evidenced, not yet independently corroborated.
Customer data15% of the score77
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”
“To view and manage this stored data, admins can use Content search or Microsoft Purview. Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”
“Microsoft Copilot calls to the LLM are routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods.”
“Microsoft Advanced Data Residency (ADR) and Multi-Geo Capabilities offerings include data residency commitments for Microsoft Copilot customers as of March 1, 2024. For EU customers, Microsoft Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, EU, or other regions.”
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo:”
“any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat to the extent not included in the preceding commitments or subject to Data Residency for Microsoft 365 Copilot and Copilot Chat .”
“Local data inferencing for Copilot interactions in Microsoft 365 Copilot is expected to become available in Australia, India, the United Arab Emirates, United Kingdom and the United States by the end of 2026, with support for Canada to follow in 2027 and Japan in 2028.”
“While abuse monitoring, which includes human review of content, is available in Azure OpenAI, Microsoft Copilot services have opted out of it.”
“We may use customer feedback, which is optional, to improve Microsoft Copilot, just like we use customer feedback to improve other Microsoft 365 services and Microsoft 365 productivity apps. We don't use this feedback to train the foundation LLMs used by Microsoft Copilot.”
“Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments. Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default.”
“Anthropic models with Data Retention are advanced models (such as Claude Fable 5 and Claude Mythos 5 ) that require data retention by Anthropic. This means data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA.”
“This means that Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days before deleting them. If Anthropic's trust and safety classifiers identify potential violations of Anthropic's Usage Policy, Anthropic may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years. Anthropic doesn't use retained data for model training without your express permission.”
“For example, for certain organizations, Fable 5.1 is available with Anthropic acting as a subprocessor and Microsoft's Product Terms and Data Protection Addendum (DPA) apply. For these organizations, no additional terms apply, and Anthropic doesn't retain customer content (including prompts and responses).”
“By the end of 2025, Microsoft will offer customers in four countries— Australia, the United Kingdom, India, and Japan —the option to have Microsoft 365 Copilot interactions processed in-country.”
Customer data treatment: the certifications above are independently corroborated, but they cover the management system — these specific disclosures are the vendor's own statements, not yet independently verified.
AI supply chain10% of the score60
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
“Microsoft enables Anthropic models on by default for most customers in commercial cloud (excluding EU/EFTA and UK). This update gives users in your organization the ability to use multiple AI models in their Microsoft offerings, such as in Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps.”
“The Data Protection Addendum does not apply to Bing Search Services or to any use of Bing within a Product. For any component of a Product that is powered by Bing, as disclosed in the product documentation, the Microsoft Privacy Statement ( https://privacy.microsoft.com/privacystatement ) applies.”
“When you're using web search, Microsoft Copilot parses the user's prompt and identifies terms where web search would improve the quality of the response. Based on these terms, Copilot generates a search query that it sends to the Bing Search service.”
“Subcontractors or subprocessors deployed by Microsoft to perform work that requires access to your data can perform only the functions they were hired to provide. They’re bound by the same contractual privacy commitments that Microsoft makes to you. The Microsoft Online Services Subprocessor List identifies authorized subprocessors who have been audited in advance against a stringent set of security and privacy requirements.”
“For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services .”
Subprocessors & supply chain: vendor-evidenced, not yet independently corroborated.
Security foundation15% of the scoreorganisation-level evidence65
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Documentation for Data Protection Impact Assessments (DPIAs), Data Subject Requests (DSRs), and data breach notification is provided to incorporate into your own accountability program in support of the GDPR.”
Independent assurance evidence10% of the score59
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Microsoft Copilot provides broad compliance offerings and certifications, including GDPR , ISO 27001 , HIPAA , and the ISO 42001 standard for AI management systems .”
“An Australian Government Protected Infosec Registered Assessors Program (IRAP) assessment of Microsoft 365 with Microsoft Copilot is in the scope of assessed services and is available at Microsoft Service Trust Portal . Microsoft 365 (Copilot included) is assessed to store information at the Protected level and is the highest level of security assessment applicable to a public cloud service in Australia.”
“In addition to the security practices and policies for Online Services in the DPA , each Core Online Service also complies with the control standards and frameworks shown in the table below and implements and maintains the security measures set forth in Appendix A of the DPA for the protection of Customer Data . Online Service SSAE 18 SOC 1 Type II SSAE 18 SOC 2 Type II Office 365 Services Yes Yes”
“Office 365 Services The following services, each as a standalone service or as included in an Office 365 or Microsoft 365-branded plan or suite: Customer Lockbox, Exchange Online Archiving, Exchange Online Protection, Exchange Online, Microsoft Bookings, Microsoft Forms, Microsoft Planner, Microsoft Stream (Classic), Microsoft Teams, Microsoft To-Do, Microsoft Defender for Office 365, Office for the web, OneDrive for work or school, Project, SharePoint, Sway, Viva Insights, Whiteboard, Viva Engage, and Microsoft 365 Copilot.”
“Your control over your data is reinforced by Microsoft's commitment to comply with broadly applicable privacy laws, such as the GDPR, and privacy standards, such as ISO/IEC 27018, the world's first international code of practice for cloud privacy.”
Read from the registry record above, cited, not reproduced.
Read from the registry record above, cited, not reproduced.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“The Data Protection Addendum , or DPA (defined in the Glossary) sets forth the parties obligations with respect to the processing and security of Customer Data , Professional Services Data , and Personal Data by the Products. The Data Protection Addendum can be downloaded here https://aka.ms/DPA . In the event of any conflict or inconsistency between the DPA and any other terms in Customer’s licensing agreement (including these terms), the DPA shall prevail.”
“Enterprise data protection refers to controls and commitments, under the Data Protection Addendum (DPA) and the Product Terms , that apply to customer data for users of Microsoft Copilot and Copilot Chat, with Microsoft acting as a data processor.”
“If a third party sues a commercial customer for copyright infringement for using Microsoft's Copilots or the output they generate, we'll defend the customer and pay the amount of any adverse judgments or settlements that result from the lawsuit, as long as the customer used the guardrails and content filters we have built into our products.”
“If Microsoft receives a request for your data, we will promptly notify you and provide a copy of the request unless legally prohibited from doing so. Moreover, we will direct the requesting party to seek the data directly from you.”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 62 → up to 83 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 9, registry checks and verification ladders, click to view
Australian Government PROTECTED level; Microsoft 365 with Microsoft Copilot (Microsoft 365 Copilot) in the scope of assessed services; report stated to be on the Microsoft Service Trust Portal; assessment date and assessor not stated in the stash.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Named for Microsoft Copilot among 'compliance offerings and certifications'; certificate issuer, scope statement and validity not stated.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Named for Microsoft Copilot as the AI management system standard; issuer, scope and validity not stated.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Listed among Copilot compliance offerings; HIPAA BAA coverage detail not in the stash.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
SSAE 18 SOC 1 Type II for Office 365 Services (Core Online Services), which the Product Terms define to include Microsoft 365 Copilot; report period not stated.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
SSAE 18 SOC 2 Type II for Office 365 Services (Core Online Services), which the Product Terms define to include Microsoft 365 Copilot; report period not stated.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Stated as a Microsoft commitment to comply with the ISO/IEC 27018 cloud privacy code of practice; no certificate scope, issuer or validity given.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Checked against Data Privacy Framework (dataprivacyframework.gov), Nov 1, 2026: Verified on the registry
Checked against FedRAMP Marketplace (fedramp.gov), Nov 1, 2026: Verified on the registry
Sources 14, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.