Microsoft 365 Copilot
Microsoft
Safe
Microsoft says prompts, responses, and data accessed through Microsoft Graph are not used to train foundation models for Microsoft 365 Copilot. Commercial use is covered by the Microsoft data protection addendum, and Copilot respects the tenant's permissions, sensitivity labels, retention, and audit settings. That is a reasonable default for ordinary business files. Whether your existing HIPAA addendum names Copilot is not stated on the pages we read, so check the product terms before using it with health records.
Last checked 2026-11-10
Data-safety checklist
Trains on your data by default
No
Microsoft Learn says prompts, responses, and data accessed through Microsoft Graph are not used to train foundation LLMs, including those used by Microsoft Copilot. The enterprise data protection page repeats that commitment for Copilot and Copilot Chat used by organizations.How to opt out
Steps
No training opt-out is required. The commitment is the default for commercial tenants. Optional feedback is described separately and is not used to train the foundation models in the Microsoft 365 apps article.Data retention
What they keep
Interaction content is stored like other Microsoft 365 content under your organization's retention policies. Microsoft does not publish one universal number of days on the privacy page we read.BAA / HIPAA
Unknown
Commercial Copilot is covered by the Microsoft Products and Services Data Protection Addendum. The pages we read do not say whether Copilot is in scope of a HIPAA business associate agreement. Confirm that in your Microsoft agreement.Certifications
2 listed
- ISO/IEC 27018 (named in the enterprise data protection commitments)
- GDPR commitments stated by Microsoft
Enterprise and admin controls
Controls
Copilot honors identity permissions, sensitivity labels, retention policies, audit, and admin settings. The exact controls depend on the subscription. Bing search queries triggered from Copilot Chat are described as a separate service with different terms.Sources
3 pages