Microsoft 365 Copilot — privacy & data policy

Provider: Microsoft. PromptPrivacy score: 97/100. Last verified November 01, 2026.

What happens to your data?

Prompts and responses are grounded in authorized organizational data accessed via Microsoft Graph under strict permission boundaries. All interaction content is isolated to your tenant, encrypted at rest and in transit, and governed by existing Microsoft 365 enterprise commitments. Your content is never used to train foundational AI models.

Does it train on your data?

Does not train on your content. Prompts, responses, and data accessed through Microsoft Graph are not used to train foundation large language models, including those powering Microsoft Copilot. Optional customer feedback is likewise excluded from foundation model training.

Can you opt out?

Not applicable. Prompts, responses, and tenant organizational data are not used to train foundation AI models by default.

Data retention

Interaction history containing prompts and responses is retained in alignment with Microsoft 365 contractual commitments. Administrators can define custom retention schedules using Microsoft Purview, and individual users can delete their Copilot activity history at any time.

Encryption & security

Data is protected in transit and at rest using BitLocker, per-file encryption, Transport Layer Security (TLS), and Internet Protocol Security (IPsec). The platform also supports Microsoft Purview Information Protection and satisfies compliance standards including ISO 27001, ISO 42001, and HIPAA.

Is it safe for work?

Yes. Microsoft 365 Copilot provides robust commercial data protection, tenant logical isolation, enterprise compliance certifications (GDPR, HIPAA, ISO 27001), and a strict contractual guarantee against using enterprise data to train AI models.

Source policy: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy