Microsoft 365 Copilot Chat
microsoft.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- Retention terms found: confirm them in writing
See Before you sign, with what to ask for ↓
Scanned Nov 2, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The sources describe retention ("A document a user supplies to Copilot Chat for reasoning is no longer retained by Copilot Chat once the chat session ends.") but not a complete window for every data type.
What to ask for: Get retention periods in writing for inputs, outputs, logs and backups, including any provider that runs the model.
“After the chat session ends, the document is no longer retained by Copilot Chat.”
“Logging : Before sending the response back to the user, both the prompt and response are logged and stored in Exchange for auditing/eDiscovery (Microsoft 365 tenant).”
“This means data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA. Anthropic models with Data Retention (such as Fable 5.0) have additional controls in the Microsoft 365 admin center and are off by default for all scenarios, including in regions when different Anthropic models are on by default in commercial cloud and for which Anthropic is a Microsoft subprocessor.”
“This means that Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days before deleting them. If Anthropic's trust and safety classifiers identify potential violations of Anthropic's Usage Policy, Anthropic may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years.”
“For example, for certain organizations, Fable 5.1 is available with Anthropic acting as a subprocessor and Microsoft's Product Terms and Data Protection Addendum (DPA) apply. For these organizations, no additional terms apply, and Anthropic doesn't retain customer content (including prompts and responses).”
Australian Government checksdirections checked Nov 1, 2026
No vendor-specific PSPF direction names this vendor or product (checked 2026-11-01).
Australian Government PROTECTED; Microsoft 365 with Microsoft Copilot in scope, Copilot Chat stated to be covered as a subset of the Microsoft Copilot service; assessment date and assessor not stated; report on Service Trust Portal.
“An Australian Government Protected Infosec Registered Assessors Program (IRAP) assessment of Microsoft 365 with Microsoft Copilot is in the scope of assessed services and is available at Microsoft Service Trust Portal . Microsoft 365 (Copilot included) is assessed to store information at the Protected level and is the highest level of security assessment applicable to a public cloud service in Australia.”
“Copilot Chat is a subset of the Microsoft Copilot service, as described in the architecture , and is also covered by the same IRAP assessment.”
Not found in the sources this scan collected. If the service will hold government data, ask whether it is hosted with a provider certified under the Hosting Certification Framework, and at which level.
The sources say: "For tenants provisioned in Australia (among listed Geos), Microsoft commits to store stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat at rest only within that Geo, alongside Exchange, SharePoint, OneDrive and Teams conten" Confirm in the contract that every data type (inputs, outputs, logs and backups) stays in Australia, including when the AI model is run by a third party.
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint Online site content and the files stored within that site, (3) files uploaded to OneDrive (work/school), (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (Classic) (on SharePoint) meeting recordings, and (5) any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat to the extent not included in the preceding commitments or subject to Data Residency for Microsoft 365 Copilot and Copilot Chat .”
What your organisation still has to do
Every level of government
- Treat AI outputs, including meeting transcripts and summaries, as public records: capture or dispose of them under your records authority (the Archives Act 1983 for Commonwealth agencies, your state's records legislation for state agencies and councils). Source ↗
Commonwealth agencies
- Assess foreign ownership, control or influence risk for this technology asset, as PSPF Direction 001-2024 requires. Source ↗
- Apply the DTA Policy for the responsible use of AI in government: record the use case, assess its impact before deployment, and keep your AI transparency statement current. Source ↗
- Assess the service against the ISM controls for the highest classification of data you intend to use with it (OFFICIAL, OFFICIAL: Sensitive or PROTECTED). Source ↗
State agencies and councils
- Assess the service under your state's privacy law, which governs where residents' personal information may go: for example the PPIP Act 1998 in New South Wales, the Privacy and Data Protection Act 2014 in Victoria or the Information Privacy Act 2009 in Queensland.
- New South Wales agencies: complete the NSW AI Assessment Framework self-assessment, which Circular DCS-2024-04 makes mandatory. Source ↗
- Victorian public sector: follow Administrative Guideline 2024/07 on the safe and responsible use of generative AI. Source ↗
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
✓Will they train on your data?Clear
Microsoft states that Copilot Chat does not use customer data to train foundation models.
“Copilot Chat does not use your data to train foundation models.”
“Anthropic doesn't use retained data for model training without your express permission.”
!How long do they keep your data?Ask the vendor
A document a user supplies to Copilot Chat for reasoning is no longer retained by Copilot Chat once the chat session ends.
Requires written confirmation, see Before you sign ↓
“After the chat session ends, the document is no longer retained by Copilot Chat.”
“Logging : Before sending the response back to the user, both the prompt and response are logged and stored in Exchange for auditing/eDiscovery (Microsoft 365 tenant).”
“This means data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA. Anthropic models with Data Retention (such as Fable 5.0) have additional controls in the Microsoft 365 admin center and are off by default for all scenarios, including in regions when different Anthropic models are on by default in commercial cloud and for which Anthropic is a Microsoft subprocessor.”
“This means that Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days before deleting them. If Anthropic's trust and safety classifiers identify potential violations of Anthropic's Usage Policy, Anthropic may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years.”
“For example, for certain organizations, Fable 5.1 is available with Anthropic acting as a subprocessor and Microsoft's Product Terms and Data Protection Addendum (DPA) apply. For these organizations, no additional terms apply, and Anthropic doesn't retain customer content (including prompts and responses).”
!Who else can access your data?Ask the vendor
The Copilot Chat privacy documentation says the grounded prompt is sent to an LLM and that Copilot Chat may use multiple models, but it does not name the model providers or model families used for Copilot Chat.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Large Language Model (LLM) : Copilot sends the grounded prompt to the LLM to generate a relevant response. Copilot Chat may use multiple models to generate a response.”
“The Bing search service operates separately from Microsoft 365 and has different data-handling practices from those used for prompts and responses. These data-handling practices are covered by the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement . This means that Microsoft acts as an independent data controller responsible for complying with all applicable laws and controller obligations.”
“Prompts and responses from Microsoft 365 Copilot large language models hosted on Azure OpenAI.”
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
“Microsoft is making Anthropic models available by default in certain regions. In Microsoft Copilot (web, desktop, and mobile), UI indicators show when Claude models are in use.”
“Microsoft offers third-party AI models in Microsoft Copilot, such as Anthropic and OpenAI models. As an admin, you can decide whether to use these models to power your experiences, and additional terms may apply.”
“Subcontractors or subprocessors deployed by Microsoft to perform work that requires access to your data can perform only the functions they were hired to provide. They’re bound by the same contractual privacy commitments that Microsoft makes to you. The Microsoft Online Services Subprocessor List identifies authorized subprocessors who have been audited in advance against a stringent set of security and privacy requirements.”
!Where is your data processed?Ask the vendor
Microsoft states that web search queries sent from Copilot Chat to Bing are not EU Data Boundary (EUDB) compliant. The statement is specific to the EU Data Boundary commitment for EU tenants; it confirms that generated search terms travel a separate path from prompts and responses, but it does not describe where those queries are processed for an Australian tenant, which Microsoft leaves to the separate Bing controller terms.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Web search queries sent from Copilot Chat to Bing are not EUDB-compliant.”
“Copilot Chat calls to the LLM are routed to the closest data centers in the region, but can also call into other regions where greater capacity is available when utilization is especially high. For European Union (EU) users, Copilot Chat has additional safeguards to comply with the EU Data Boundary . EU traffic stays within the EU Data Boundary, while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.”
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint Online site content and the files stored within that site, (3) files uploaded to OneDrive (work/school), (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (Classic) (on SharePoint) meeting recordings, and (5) any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat to the extent not included in the preceding commitments or subject to Data Residency for Microsoft 365 Copilot and Copilot Chat .”
“Multi-Geo subscription: allows customers to assign data location for Exchange Online, SharePoint, OneDrive, Microsoft Teams, and Microsoft 365 Copilot and Microsoft 365 Copilot Chat to any supported Geography .”
“For example, Microsoft 365 Copilot processes prompts and generates responses. With the appropriate configuration, this processing occurs within the same geographic boundary as your stored data, helping organizations meet data handling requirements that extend beyond storage.”
“Local data inferencing for Copilot interactions in Microsoft 365 Copilot is expected to become available in Australia, India, the United Arab Emirates, United Kingdom and the United States by the end of 2026, with support for Canada to follow in 2027 and Japan in 2028.”
“By the end of 2025, Microsoft will offer customers in four countries— Australia, the United Kingdom, India, and Japan —the option to have Microsoft 365 Copilot interactions processed in-country.”
“Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments. Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default.”
“Microsoft Advanced Data Residency (ADR) and Multi-Geo Capabilities offerings include data residency commitments for Microsoft Copilot customers as of March 1, 2024. For EU customers, Microsoft Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, EU, or other regions.”
!What happens in a security incident?Ask the vendor
Microsoft's Trust Center states that documentation covering data breach notification (alongside DPIAs and DSRs) is provided for customers' GDPR accountability programmes; no incident notification timeline, vulnerability disclosure process or security incident history specific to Copilot Chat appears in the stash.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Documentation for Data Protection Impact Assessments (DPIAs), Data Subject Requests (DSRs), and data breach notification is provided to incorporate into your own accountability program in support of the GDPR.”
Email to send the vendor8 items to confirm in writing
Hello Microsoft team, We are assessing Microsoft 365 Copilot Chat (Microsoft) as part of our supplier review. Before we proceed, please confirm the following in writing: 1. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 2. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 3. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 4. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 5. Please provide the current IRAP assessment report and letter of compliance confirming Microsoft Copilot Chat is within the assessed scope, with the assessment date and assessor. 6. Which model providers and model families serve Microsoft Copilot Chat in an Australian commercial tenant today, are Anthropic models in that path by default, and do the Australian in-country processing commitments (when delivered) cover Copilot Chat and all providers in the path? 7. Where are Copilot Chat generated search queries processed for an Australian tenant, are they excluded from the forthcoming in-country processing commitments, and what admin control disables web grounding for selected users? 8. Is in-country inferencing for Copilot interactions available today for Australian tenants, does it include Microsoft Copilot Chat, and how is it enabled and evidenced? A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Copilot Chat has explicit contractual and assurance footing in AustraliaStrong
Microsoft 365 Copilot Chat (work or school account) is named in the Product Terms as a Core Online Service with SOC 1 Type II and SOC 2 Type II, Microsoft states Copilot Chat is covered by the Microsoft 365 IRAP assessment at the PROTECTED level, stored interaction content for Australian-provisioned tenants is committed to stay at rest in the Australian Geo, and Microsoft states Copilot Chat does not use customer data to train foundation models. All of these statements name Copilot Chat directly or are organisation-wide, so the customer_data_treatment, independent_assurance and legal_and_contractual_transparency domains are assessed as covered on target-scoped evidence.
An Australian Government or regulated buyer can anchor enterprise-data-protection, residency and no-training commitments to the DPA and Product Terms rather than to marketing pages, and can request the IRAP and SOC reports from the Service Trust Portal to corroborate them.
Question for vendor: Please provide the current IRAP assessment report and letter of compliance confirming Microsoft Copilot Chat is within the assessed scope, with the assessment date and assessor.
“Copilot Chat does not use your data to train foundation models.”
“Microsoft 365 Copilot Chat Microsoft 365 Copilot Chat, used with a work or school account.”
“Online Service SSAE 18 SOC 1 Type II SSAE 18 SOC 2 Type II Office 365 Services Yes Yes Microsoft 365 Compliance Services Yes Yes Microsoft Dynamics 365 Core Services Yes Yes Microsoft Azure Core Services Varies* Varies* Microsoft Intune Online Services Yes Yes Microsoft Power Platform Core Services Yes Yes Microsoft 365 Copilot Chat Yes Yes”
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint Online site content and the files stored within that site, (3) files uploaded to OneDrive (work/school), (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (Classic) (on SharePoint) meeting recordings, and (5) any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat to the extent not included in the preceding commitments or subject to Data Residency for Microsoft 365 Copilot and Copilot Chat .”
“Copilot Chat is a subset of the Microsoft Copilot service, as described in the architecture , and is also covered by the same IRAP assessment.”
!Model providers behind Copilot Chat are not named; Anthropic models are excluded from in-country processingGap
The Copilot Chat privacy documentation says only that Copilot Chat may use multiple models. OpenAI and Anthropic are named as subprocessors for Microsoft Copilot experiences, Anthropic models are on by default in commercial cloud outside the EU/EFTA and UK, and Microsoft states Anthropic models are currently excluded from the EU Data Boundary and, where applicable, from in-country processing commitments. Those Anthropic statements are scoped to Microsoft Copilot, Researcher, Copilot Studio, Power Platform and Copilot in Microsoft 365 apps, not to Copilot Chat, so they neither condemn nor clear the target; model_provider_transparency is therefore assessed partial on the Copilot Chat and organisation-wide statements only.
If Anthropic models are in the Copilot Chat request path for an Australian tenant, prompts could be processed outside any Australian in-country processing commitment and the residency picture differs from the Azure OpenAI-hosted path described in the in-country processing announcement.
Question for vendor: Which model providers and model families serve Microsoft Copilot Chat in an Australian commercial tenant today, are Anthropic models in that path by default, and do the Australian in-country processing commitments (when delivered) cover Copilot Chat and all providers in the path?
“Large Language Model (LLM) : Copilot sends the grounded prompt to the LLM to generate a relevant response. Copilot Chat may use multiple models to generate a response.”
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
“Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments. Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default.”
“Microsoft is making Anthropic models available by default in certain regions. In Microsoft Copilot (web, desktop, and mobile), UI indicators show when Claude models are in use.”
“Microsoft enables Anthropic models on by default for most customers in commercial cloud (excluding EU/EFTA and UK). This update gives users in your organization the ability to use multiple AI models in their Microsoft offerings, such as in Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps.”
“Microsoft offers third-party AI models in Microsoft Copilot, such as Anthropic and OpenAI models. As an admin, you can decide whether to use these models to power your experiences, and additional terms may apply.”
!Web grounding queries leave the DPA and residency boundaryGap
Copilot Chat is grounded in web data via the Bing search service, which Microsoft says operates separately from Microsoft 365 under the Microsoft Services Agreement and Privacy Statement with Microsoft as an independent controller, and whose queries are not EU Data Boundary compliant. Microsoft mitigates this by sending only a few generated terms without user or tenant identifiers, but the flow is outside the DPA that governs prompts and responses.
Australian Government and regulated buyers relying on processor-mode DPA commitments and residency should treat generated search terms as a separate controller-mode data flow and decide whether web grounding should remain enabled for sensitive user groups.
Question for vendor: Where are Copilot Chat generated search queries processed for an Australian tenant, are they excluded from the forthcoming in-country processing commitments, and what admin control disables web grounding for selected users?
“The Bing search service operates separately from Microsoft 365 and has different data-handling practices from those used for prompts and responses. These data-handling practices are covered by the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement . This means that Microsoft acts as an independent data controller responsible for complying with all applicable laws and controller obligations.”
“Web search queries sent from Copilot Chat to Bing are not EUDB-compliant.”
“Unlike Microsoft Copilot, Copilot Chat is not grounded in organizational content like files, emails, or chats as part of the chat experience—it is grounded in data from the web only. If Copilot Chat users would like to use organizational content in their chat, they can do so in four ways:”
!Australian in-country processing is a slipped, forward-looking option scoped to Microsoft 365 CopilotGap
The Microsoft 365 blog originally said Australian customers would have the option for Microsoft 365 Copilot interactions to be processed in-country by the end of 2025; the April 2026 editor's note on the same page now expects local inferencing in Australia by the end of 2026. The commitment is scoped to Microsoft 365 Copilot LLMs hosted on Azure OpenAI and does not mention Copilot Chat. Today the stash supports an at-rest residency commitment for Copilot Chat interaction content in the Australian Geo, plus Multi-Geo assignment, but processing for non-EU customers may occur in the US, EU or other regions. The original end-2025 statement is recorded as stale_or_superseded.
A buyer who read the 2025 announcement may believe in-country processing is already available; it is not confirmed in these sources, and at-rest residency is not the same as in-country inferencing.
Question for vendor: Is in-country inferencing for Copilot interactions available today for Australian tenants, does it include Microsoft Copilot Chat, and how is it enabled and evidenced?
“Local data inferencing for Copilot interactions in Microsoft 365 Copilot is expected to become available in Australia, India, the United Arab Emirates, United Kingdom and the United States by the end of 2026, with support for Canada to follow in 2027 and Japan in 2028.”
“By the end of 2025, Microsoft will offer customers in four countries— Australia, the United Kingdom, India, and Japan —the option to have Microsoft 365 Copilot interactions processed in-country.”
“For example, Microsoft 365 Copilot processes prompts and generates responses. With the appropriate configuration, this processing occurs within the same geographic boundary as your stored data, helping organizations meet data handling requirements that extend beyond storage.”
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint Online site content and the files stored within that site, (3) files uploaded to OneDrive (work/school), (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (Classic) (on SharePoint) meeting recordings, and (5) any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat to the extent not included in the preceding commitments or subject to Data Residency for Microsoft 365 Copilot and Copilot Chat .”
“Multi-Geo subscription: allows customers to assign data location for Exchange Online, SharePoint, OneDrive, Microsoft Teams, and Microsoft 365 Copilot and Microsoft 365 Copilot Chat to any supported Geography .”
“Copilot Chat calls to the LLM are routed to the closest data centers in the region, but can also call into other regions where greater capacity is available when utilization is especially high. For European Union (EU) users, Copilot Chat has additional safeguards to comply with the EU Data Boundary . EU traffic stays within the EU Data Boundary, while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.”
“Microsoft Advanced Data Residency (ADR) and Multi-Geo Capabilities offerings include data residency commitments for Microsoft Copilot customers as of March 1, 2024. For EU customers, Microsoft Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, EU, or other regions.”
!Incident handling and evaluation evidence is thin for Copilot ChatGap
The only incident-handling disclosure in the stash is a Trust Center pointer to GDPR breach-notification documentation; no incident notification timeline, vulnerability disclosure process or Copilot-specific incident history is published in these sources. Testing and evaluation rests on runtime Responsible AI safety checks for Copilot Chat and an organisation-wide harm-review statement; the jailbreak and XPIA classifier disclosure is scoped to Microsoft Copilot and no evaluation results or red-team findings are published. Both domains are assessed partial rather than not_evidenced because a disclosure does exist in each; neither is not_applicable, since a hosted service can supply both. Change management is likewise partial: the only Copilot Chat-scoped change notice is the product renaming, while model-update and default-on Anthropic statements are scoped to Microsoft Copilot.
A buyer cannot confirm from public sources how quickly a Copilot Chat security incident would be notified, how vulnerabilities are disclosed, or what evaluation evidence supports the safety claims; these need to be obtained contractually or from the Service Trust Portal.
Question for vendor: What are the contractual security incident notification timelines for Microsoft Copilot Chat under the DPA, and is there published red-team or evaluation evidence (for example a transparency note) specific to Copilot Chat?
“Documentation for Data Protection Impact Assessments (DPIAs), Data Subject Requests (DSRs), and data breach notification is provided to incorporate into your own accountability program in support of the GDPR.”
“It coordinates Responsible AI (RAI) safety checks throughout the process and logs the interaction for auditing/eDiscovery.”
“A multidisciplinary team of researchers, engineers, and policy experts reviews our AI systems for potential harms and mitigations - refining training data, filtering to limit harmful content, query- and result-blocking sensitive topics, and applying Microsoft technologies like InterpretML and Fairlearn to help detect and correct data bias.”
“Microsoft Copilot helps mitigate these attacks by using proprietary techniques, such as jailbreak and cross-prompt injection attack (XPIA) classifiers. These classifiers analyze inputs to the Copilot service and help block high-risk prompts prior to model execution. These classifiers may not be available in all Microsoft Copilot scenarios.”
“Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat. Some experiences, licenses, and capabilities might continue to reference Microsoft 365 Copilot and Microsoft 365 Copilot Chat during the transition period. There are no changes to security, compliance, and privacy for organizations.”
“The AI models that power Microsoft Copilot are regularly updated and enhanced. Model updates bring performance improvements, more advanced reasoning, and expanded capabilities, but they don't change your security, privacy, or compliance settings.”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score65
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“At Microsoft, we're guided by our AI principles , our Responsible AI Standard , and decades of research on AI, grounding, and privacy-preserving machine learning.”
“We will not disclose data to a government or law enforcement agency, except as you direct or where required by law. Microsoft scrutinizes all government demands to ensure they are legally valid and appropriate.”
“Enterprise data protection refers to controls and commitments, under the Data Protection Addendum (DPA) and the Product Terms , that apply to customer data for users of Microsoft Copilot and Copilot Chat, with Microsoft acting as a data processor.”
“When you consider integrating Microsoft Copilot, evaluate it within the context of the Microsoft AI Shared Responsibility Model . The model covers: Customer responsibility : You solely address these items. Microsoft doesn't have a responsibility to address these components.”
Governance & accountability: vendor-evidenced, not yet independently corroborated.
AI system15% of the score47
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Microsoft Copilot Chat prompts and responses are processed within the Microsoft 365 service boundary, which offers enterprise data protection . This means that security, privacy, and compliance controls and commitments available for Microsoft Copilot also extend to Copilot Chat.”
“Unlike Microsoft Copilot, Copilot Chat is not grounded in organizational content like files, emails, or chats as part of the chat experience—it is grounded in data from the web only. If Copilot Chat users would like to use organizational content in their chat, they can do so in four ways:”
“Copilot Chat uses the same architectural components of the Microsoft Copilot service, adhering to the highest security standards.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“It coordinates Responsible AI (RAI) safety checks throughout the process and logs the interaction for auditing/eDiscovery.”
“A multidisciplinary team of researchers, engineers, and policy experts reviews our AI systems for potential harms and mitigations - refining training data, filtering to limit harmful content, query- and result-blocking sensitive topics, and applying Microsoft technologies like InterpretML and Fairlearn to help detect and correct data bias.”
“Microsoft Copilot helps mitigate these attacks by using proprietary techniques, such as jailbreak and cross-prompt injection attack (XPIA) classifiers. These classifiers analyze inputs to the Copilot service and help block high-risk prompts prior to model execution. These classifiers may not be available in all Microsoft Copilot scenarios.”
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat. Some experiences, licenses, and capabilities might continue to reference Microsoft 365 Copilot and Microsoft 365 Copilot Chat during the transition period. There are no changes to security, compliance, and privacy for organizations.”
“Microsoft enables Anthropic models on by default for most customers in commercial cloud (excluding EU/EFTA and UK). This update gives users in your organization the ability to use multiple AI models in their Microsoft offerings, such as in Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps.”
“The AI models that power Microsoft Copilot are regularly updated and enhanced. Model updates bring performance improvements, more advanced reasoning, and expanded capabilities, but they don't change your security, privacy, or compliance settings.”
AI system description: vendor-evidenced, not yet independently corroborated.
Model10% of the score40
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“Large Language Model (LLM) : Copilot sends the grounded prompt to the LLM to generate a relevant response. Copilot Chat may use multiple models to generate a response.”
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
“Prompts and responses from Microsoft 365 Copilot large language models hosted on Azure OpenAI.”
“Microsoft is making Anthropic models available by default in certain regions. In Microsoft Copilot (web, desktop, and mobile), UI indicators show when Claude models are in use.”
“Microsoft offers third-party AI models in Microsoft Copilot, such as Anthropic and OpenAI models. As an admin, you can decide whether to use these models to power your experiences, and additional terms may apply.”
“We may deploy other AI models for Microsoft Copilot to use that are hosted and operated by Microsoft. These models are governed by the same contractual and data protection commitments already in place, including that no data leaves Microsoft.”
Customer data15% of the score77
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“Copilot Chat does not use your data to train foundation models.”
“The Bing search service operates separately from Microsoft 365 and has different data-handling practices from those used for prompts and responses. These data-handling practices are covered by the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement . This means that Microsoft acts as an independent data controller responsible for complying with all applicable laws and controller obligations.”
“Web search queries sent from Copilot Chat to Bing are not EUDB-compliant.”
“After the chat session ends, the document is no longer retained by Copilot Chat.”
“Logging : Before sending the response back to the user, both the prompt and response are logged and stored in Exchange for auditing/eDiscovery (Microsoft 365 tenant).”
“Copilot Chat calls to the LLM are routed to the closest data centers in the region, but can also call into other regions where greater capacity is available when utilization is especially high. For European Union (EU) users, Copilot Chat has additional safeguards to comply with the EU Data Boundary . EU traffic stays within the EU Data Boundary, while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.”
“Office 365 Services. If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft will store the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint Online site content and the files stored within that site, (3) files uploaded to OneDrive (work/school), (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (Classic) (on SharePoint) meeting recordings, and (5) any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat to the extent not included in the preceding commitments or subject to Data Residency for Microsoft 365 Copilot and Copilot Chat .”
“Multi-Geo subscription: allows customers to assign data location for Exchange Online, SharePoint, OneDrive, Microsoft Teams, and Microsoft 365 Copilot and Microsoft 365 Copilot Chat to any supported Geography .”
“By default, Microsoft engineers have no standing administrative privileges and no standing access to Customer Data in Microsoft 365. A Microsoft engineer may have limited and logged access to Customer Data for a limited amount of time, but only when necessary for normal service operations and only when approved by a member of senior management at Microsoft (and, for customers who are licensed for the Customer Lockbox feature, by the customer).”
“For example, Microsoft 365 Copilot processes prompts and generates responses. With the appropriate configuration, this processing occurs within the same geographic boundary as your stored data, helping organizations meet data handling requirements that extend beyond storage.”
“Local data inferencing for Copilot interactions in Microsoft 365 Copilot is expected to become available in Australia, India, the United Arab Emirates, United Kingdom and the United States by the end of 2026, with support for Canada to follow in 2027 and Japan in 2028.”
“By the end of 2025, Microsoft will offer customers in four countries— Australia, the United Kingdom, India, and Japan —the option to have Microsoft 365 Copilot interactions processed in-country.”
“Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments. Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default.”
“This means data is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA. Anthropic models with Data Retention (such as Fable 5.0) have additional controls in the Microsoft 365 admin center and are off by default for all scenarios, including in regions when different Anthropic models are on by default in commercial cloud and for which Anthropic is a Microsoft subprocessor.”
“This means that Anthropic (not Microsoft) stores most inputs and outputs for up to 30 days before deleting them. If Anthropic's trust and safety classifiers identify potential violations of Anthropic's Usage Policy, Anthropic may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years.”
“Anthropic doesn't use retained data for model training without your express permission.”
“For example, for certain organizations, Fable 5.1 is available with Anthropic acting as a subprocessor and Microsoft's Product Terms and Data Protection Addendum (DPA) apply. For these organizations, no additional terms apply, and Anthropic doesn't retain customer content (including prompts and responses).”
“While abuse monitoring, which includes human review of content, is available in Azure OpenAI, Microsoft Copilot services have opted out of it.”
“Microsoft Advanced Data Residency (ADR) and Multi-Geo Capabilities offerings include data residency commitments for Microsoft Copilot customers as of March 1, 2024. For EU customers, Microsoft Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, EU, or other regions.”
Customer data treatment: the certifications above are independently corroborated, but they cover the management system — these specific disclosures are the vendor's own statements, not yet independently verified.
AI supply chain10% of the score60
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“As a subprocessor, Anthropic operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. Unless models are labeled "Anthropic models with Data Retention," the Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to the use of Anthropic models through Microsoft's enterprise Online Services.”
“Subcontractors or subprocessors deployed by Microsoft to perform work that requires access to your data can perform only the functions they were hired to provide. They’re bound by the same contractual privacy commitments that Microsoft makes to you. The Microsoft Online Services Subprocessor List identifies authorized subprocessors who have been audited in advance against a stringent set of security and privacy requirements.”
“The Bing search service operates separately from Microsoft 365 and has different data-handling practices from those used for prompts and responses. These data-handling practices are covered by the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement . This means that Microsoft acts as an independent data controller responsible for complying with all applicable laws and controller obligations.”
Subprocessors & supply chain: vendor-evidenced, not yet independently corroborated.
Security foundation15% of the scoreorganisation-level evidence65
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Documentation for Data Protection Impact Assessments (DPIAs), Data Subject Requests (DSRs), and data breach notification is provided to incorporate into your own accountability program in support of the GDPR.”
Independent assurance evidence10% of the score59
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Online Service SSAE 18 SOC 1 Type II SSAE 18 SOC 2 Type II Office 365 Services Yes Yes Microsoft 365 Compliance Services Yes Yes Microsoft Dynamics 365 Core Services Yes Yes Microsoft Azure Core Services Varies* Varies* Microsoft Intune Online Services Yes Yes Microsoft Power Platform Core Services Yes Yes Microsoft 365 Copilot Chat Yes Yes”
“Copilot Chat is a subset of the Microsoft Copilot service, as described in the architecture , and is also covered by the same IRAP assessment.”
“Your control over your data is reinforced by Microsoft compliance with broadly applicable privacy laws, such as GDPR and privacy standards. These include the world’s first international code of practice for cloud privacy, ISO/IEC 27018.”
“An Australian Government Protected Infosec Registered Assessors Program (IRAP) assessment of Microsoft 365 with Microsoft Copilot is in the scope of assessed services and is available at Microsoft Service Trust Portal . Microsoft 365 (Copilot included) is assessed to store information at the Protected level and is the highest level of security assessment applicable to a public cloud service in Australia.”
“Microsoft Copilot provides broad compliance offerings and certifications, including GDPR , ISO 27001 , HIPAA , and the ISO 42001 standard for AI management systems .”
Read from the registry record above, cited, not reproduced.
Read from the registry record above, cited, not reproduced.
Independent assurance: vendor-evidenced, not yet independently corroborated.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“Enterprise data protection refers to controls and commitments, under the Data Protection Addendum (DPA) and the Product Terms , that apply to customer data for users of Microsoft Copilot and Copilot Chat, with Microsoft acting as a data processor.”
“Microsoft 365 Copilot Chat Microsoft 365 Copilot Chat, used with a work or school account.”
“In the event of any conflict or inconsistency between the DPA and any other terms in Customer’s licensing agreement (including these terms), the DPA shall prevail.”
“If a third party sues a commercial customer for copyright infringement for using Microsoft's Copilots or the output they generate, we'll defend the customer and pay the amount of any adverse judgments or settlements that result from the lawsuit, as long as the customer used the guardrails and content filters we have built into our products.”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 60 → up to 82 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 9, registry checks and verification ladders, click to view
SSAE 18 SOC 1 Type II; Microsoft 365 Copilot Chat listed as a Core Online Service in the Product Terms; report available via Service Trust Portal, not in stash.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
SSAE 18 SOC 2 Type II; Microsoft 365 Copilot Chat listed as a Core Online Service in the Product Terms; report not in stash.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Australian Government PROTECTED; Microsoft 365 with Microsoft Copilot in scope, Copilot Chat stated to be covered as a subset of the Microsoft Copilot service; assessment date and assessor not stated; report on Service Trust Portal.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Cited for Microsoft Copilot; certificate scope, issuer and validity not stated.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
AI management system standard cited for Microsoft Copilot; certificate scope, issuer and validity not stated.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Cited as a compliance offering for Microsoft Copilot; BAA scope not stated in stash.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Organisation-wide Trust Center statement of compliance with the cloud privacy code of practice; no certificate scope, issuer or validity stated.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Checked against Data Privacy Framework (dataprivacyframework.gov), Nov 2, 2026: Verified on the registry
Checked against FedRAMP Marketplace (fedramp.gov), Nov 2, 2026: Verified on the registry
Sources 14, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.