Does Microsoft 365 Copilot train on your data? (Business plans)
Doesn't train by default
Doesn't train on business data by default.
Prompts, responses, and Microsoft Graph data aren't used to train foundation LLMs.
Why this matters: A "no" keeps your prompts and files out of Microsoft's models, where they couldn't be removed later. Confirm it covers the plan you use. Why training matters →
Below: retention, SOC 2, ISO 27001/42001, DPA, BAA, data residency and zero-retention for Microsoft 365 Copilot, each linked to Microsoft's own page.
Trains on your data by default
Prompts, responses, and Microsoft Graph data aren't used to train foundation LLMs.
- learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy · checked Oct 17, 2026
Data retention
Interaction history is stored; admins set retention via Microsoft Purview.
- learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy · checked Oct 17, 2026
SOC 2 Type II
Not stated on the Copilot privacy pages checked.
- learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy · checked Oct 17, 2026
- learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection · checked Oct 17, 2026
ISO/IEC 27001
Listed among Copilot compliance offerings.
- learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy · checked Oct 17, 2026
ISO/IEC 42001
Listed: ISO 42001 standard for AI management systems.
- learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy · checked Oct 17, 2026
DPA available
Covered by the Microsoft Products and Services DPA.
- learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection · checked Oct 17, 2026
BAA / HIPAA
Supports HIPAA compliance for properly configured implementations (web search queries excluded).
- learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection · checked Oct 17, 2026
Data residency options
EU Data Boundary and data residency commitments; LLM calls may route to other regions for capacity.
- learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy · checked Oct 17, 2026
Zero-retention option
Not stated on the Microsoft pages we checked.
- learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy · checked Oct 17, 2026
- learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection · checked Oct 17, 2026
Vendor pages we monitor for this tool
We save a fingerprint (SHA-256 of the page's visible text) on every check so we can spot when a vendor edits its terms.
| Page | Checked | Fingerprint |
|---|---|---|
| https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy | Oct 17, 2026 | e2d2c47bcb6d… |
| https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection | Oct 17, 2026 | f03c3f376339… |
Compare with
- Amazon Q Business Doesn't train
- ChatGPT Enterprise / Business Doesn't train
- Claude for Work (Team / Enterprise) Doesn't train
- Gemini for Google Workspace Doesn't train
- Le Chat Enterprise Doesn't train
See all Assistant tools · Why AI training on your data matters · How we source and verify this