Microsoft 365 Copilot — privacy & data policy

Provider: Microsoft. PromptPrivacy score: 96/100. Last verified August 26, 2026.

What happens to your data?

Your prompts, responses, and organizational content are processed within your organization's Microsoft 365 security boundary and accessed only according to individual user permissions. This data is encrypted at rest and in transit, and it is never used to train foundation AI models. Administrators maintain full control over retention, tenant isolation, and access policies.

Does it train on your data?

Prompts, responses, and data accessed through Microsoft Graph or connected experiences are not used to train foundation LLMs. Optional customer feedback submitted to improve services is also not used to train foundation LLMs.

Can you opt out?

Yes. Administrators can manage and turn off connected experiences that analyze content or optional connected experiences across Microsoft 365 apps. Users can also delete their Copilot activity history through the My Account portal, and admins can decide whether to enable third-party models or agents.

Data retention

User prompts and Copilot responses (activity history) are stored and processed in alignment with contractual commitments for Microsoft 365 content. Administrators can set custom retention policies for Copilot chat interaction data using Microsoft Purview.

Encryption & security

Customer data is encrypted in transit and at rest using BitLocker, per-file encryption, Transport Layer Security (TLS), and Internet Protocol Security (IPsec). Microsoft Copilot also honors encryption and usage rights applied by Microsoft Purview Information Protection and Information Rights Management (IRM).

Is it safe for work?

Yes. Microsoft Copilot is designed for enterprise use with strong commercial privacy commitments, tenant isolation, GDPR and EU Data Boundary compliance, ISO 27001 and ISO 42001 certifications, no model training on customer data, and copyright indemnification.

Source policy: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy