Short answer: Microsoft says prompts, responses, and work data accessed through Microsoft Graph for organizational Copilot are not used to train foundation models. Copilot can still surface any work content a user already has permission to view, and its interactions are stored under Microsoft 365 contractual commitments. Before rollout, review permissions and sharing, decide how to manage retention and audit records, and account for web-search and regional-processing exceptions.
Microsoft now calls Microsoft 365 Copilot “Microsoft Copilot” and Microsoft 365 Copilot Chat “Microsoft Copilot Chat,” although some licenses and product experiences may retain the older names during the transition. This FAQ covers use with a work or school identity under Microsoft’s commercial terms—not consumer Copilot, which has a different privacy context. Microsoft says organizational use is covered by its Data Protection Addendum (DPA) and Product Terms, with Microsoft acting as a data processor. Microsoft’s enterprise data protection overview describes these commitments.
As an Amazon Associate I earn from qualifying purchases.
What contractual protections apply to business use?
Microsoft says organizational Copilot and Copilot Chat use is covered by the DPA and Product Terms. Its Enterprise Data Protection (EDP) documentation describes protections including encryption at rest and in transit, tenant isolation, and the application of identity, permissions, sensitivity labels, retention, audit, and administrative settings. These are Microsoft’s documented commitments, not an independent assessment of a particular company’s tenant.
The available controls and policies depend on the underlying subscription. A business should check its own license and tenant configuration rather than assume every Copilot experience includes the same administrative features. Microsoft’s EDP documentation sets out the commercial scope and notes that controls vary by subscription.
#1 Best Overall
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
Are prompts and responses used to train foundation models?
For organizational Copilot, Microsoft says prompts, responses, and data accessed through Microsoft Graph are not used to train foundation large language models. This statement applies to the covered work or school account experience; it should not be generalized to consumer Copilot or other AI services with separate terms.
Third-party agents or optional models may have distinct data paths and terms. Check the specific experience and enabled services in your environment. Microsoft’s current statements for organizational Copilot are in its privacy and security documentation and EDP overview.
Rank #2
- The Microsoft Office 365 Bible: The Most Updated and Complete Guide to Excel, Word, PowerPoint, Outlook, OneNote, OneDrive, Teams, Access, and Publisher from Beginners to Advanced
- ABIS BOOK
What information does Copilot use to answer a prompt?
Copilot can ground a response in organizational content and context available through Microsoft Graph, including documents, email, calendar, chats, meetings, and contacts. Microsoft says it only surfaces organizational data a user has at least view permission to access. Copilot therefore follows existing access boundaries; it does not repair overly broad permissions or sharing arrangements.
That distinction matters in practice: if a user already has access to material that should be restricted, Copilot may make that material easier to find through a question. Before enabling broader AI-assisted discovery, review who can access sensitive sites, files, groups, and links. Microsoft’s description of grounding and permissions is in Data, Privacy, and Security for Microsoft Copilot.
Where are prompts stored, and can admins control them?
Microsoft says Copilot interaction history includes prompts and responses and may include citations to the grounding information used in an answer. These records support activity history and are stored under the same contractual commitments as other Microsoft 365 content. Microsoft says the interaction data is encrypted at rest and is not used to train foundation models.
Admins can use Content Search or Microsoft Purview to manage interaction records and apply retention policies. Users can delete their activity history through My Account. The applicable retention period depends on the organization’s policy and subscription; there is no single period a business owner should assume for every tenant. See Microsoft’s privacy documentation for its description of interaction data and controls.
What data residency commitments does Microsoft Copilot make?
Microsoft says Copilot requests are routed to nearby regional datacenters, but may be processed in another region when capacity is constrained. The contractual data-residency commitments are those in Microsoft’s Product Terms and DPA. Microsoft added Copilot as a covered workload to its data-residency commitments on March 1, 2024; that date does not mean every aspect of every request is guaranteed to remain in the tenant’s region.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor EU users, Microsoft describes additional EU Data Boundary safeguards and says global traffic may be sent to the EU and other regions for model processing. The boundary has exceptions: web-search queries are outside it, and Anthropic models are currently excluded according to Microsoft’s documentation. A business should check its tenant geography, applicable contract, and enabled features before making location assurances. Consult Microsoft’s data residency and privacy information alongside the EDP terms overview.
Best Value
Does web search change how prompts are handled?
When web grounding is enabled, Copilot derives a short query from a prompt and sends that query to Bing. Microsoft says the query travels over a secure connection with user and tenant identifiers removed, is not shared with advertisers, and is not used to train foundation models.
Bing is a separate service with distinct data-handling practices; Microsoft describes itself as an independent controller for that search service. Microsoft’s EDP documentation says the EU Data Boundary and HIPAA coverage do not apply to web-search queries. Businesses handling regulated or location-sensitive information should account for this separate path when deciding whether to enable web grounding. Details appear in Microsoft’s EDP documentation.
What should a small business do before deployment?
Use rollout preparation to reduce unnecessary access before Copilot makes information easier to discover. Microsoft’s administrator guidance recommends assessing high-risk or overshared SharePoint sites and sensitive content, identifying ownerless or inactive locations, and using Microsoft Purview and SharePoint Advanced Management assessments where available.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Review access first. Identify sensitive or broadly shared sites, files, and locations with no active owner. Confirm that permissions and sharing groups match business needs.
- Apply temporary discovery and data controls if needed. Microsoft’s guidance lists Restricted Content Discovery and Purview data loss prevention (DLP) as interim measures to limit discovery or grounding of sensitive information while permissions are being corrected.
- Set safer sharing defaults. Review company-wide sharing groups and Anyone links, use sensitivity-label controls where appropriate, and provision services with restrictive defaults rather than relying on users to correct access later.
- Remediate and validate. Fix excessive permissions, then audit the resulting configuration and confirm that retention and administrative controls work as intended.
These tools have licensing and administrator-role requirements. Microsoft’s guidance describes a foundation involving E3/E5 or Office 365 E3/E5 for relevant services and features, Copilot, and SharePoint Advanced Management (included with Copilot licenses at the time described). Entitlements can change, so verify current licensing and feature availability before purchasing or configuring services. See Microsoft’s Copilot readiness guidance for SharePoint.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
