Tracker / Productivity suite AI

Does Microsoft 365 Copilot train on your data? Microsoft 365 Copilot admin guide

Prompts, responses and Microsoft Graph data are not used to train foundation LLMs. Copilot is covered by the EU Data Boundary and by Microsoft's data residency commitments (added Mar 1, 2024). Interactions are logged automatically in Purview Audit (Standard). Note: Anthropic-provided models are currently excluded from the EU Data Boundary.

Vendor: Microsoft · Last checked Oct 22, 2026 · 1 plan tracked

Plan by plan

Microsoft 365 Copilot (commercial tenant) enterprise

Trains on your data?
No Prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs. source ↗ checked Oct 22, 2026
Retention
User-deletable activity history; Purview retention Users can delete their Copilot activity history in the My Account portal. Admins manage retention through Purview. source ↗ checked Oct 22, 2026
SSO
yes – Microsoft Entra ID (required) Users must have a Microsoft Entra ID work or school account; sign-in follows your Entra policies (Conditional Access, MFA). source ↗ checked Oct 22, 2026
SCIM
Unknown Not verified from a vendor-owned source yet.
Audit logs
Yes Logged automatically in Audit (Standard) when auditing is on. Audit of non-Microsoft AI apps is billed pay-as-you-go and kept for 180 days. source ↗ checked Oct 22, 2026
Data residency
Yes EU traffic stays inside the EU Data Boundary. Copilot has been a covered workload in Product Terms data residency since Mar 1, 2024. ADR and Multi-Geo are available. Anthropic models are excluded from the EU Data Boundary. source ↗ checked Oct 22, 2026
DPA
Yes Covered by the Microsoft Product Terms and Data Protection Addendum. source ↗ checked Oct 22, 2026

How to block or allow Microsoft 365 Copilot

  1. network

    Block personal Microsoft accounts and other tenants (Tenant Restrictions v2)

    Create a TRv2 policy in Entra ID → External Identities → Cross-tenant access settings. Signal it with a proxy header sec-Restrict-Tenant-Access-Policy: <TenantID>:<policyGUID> on login.live.com, login.microsoft.com, login.microsoftonline.com and login.windows.net, or use Windows GPO/Intune or Global Secure Access. Requires Entra ID P1 or P2.

    source ↗ checked Oct 22, 2026

Domains

“Primary domain only” means we haven't found a full endpoint list from the vendor, so blocking just this domain may not catch every API or desktop-app endpoint.

Change history

Sources