Does Microsoft Copilot train on your data?
Microsoft Copilot by MicrosoftAI assistantsVendor's pages read on
It depends on the plan.
The vendor states that inputs are used for training by default on Copilot with a personal Microsoft account. The vendor states that an opt-out is available. The vendor states that inputs are not used for training by default on Microsoft 365 Copilot and Copilot Chat (work account, Entra ID). Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
A summary of what the vendor publishes, not legal advice, not an assessment of the vendor and not an endorsement. How this page was made.
What the vendor states, plan by plan
| Plan | Trains on your data | Default retention | Human review of inputs | Single sign-on |
|---|---|---|---|---|
| Copilot with a personal Microsoft accountConsumer / free | Yes by default; opt-out available | 18 months | Unknown | Unknown |
| Microsoft 365 Copilot and Copilot Chat (work account, Entra ID)Enterprise | No | Set by the customer's Microsoft Purview retention policies | No | Unknown |
“Unknown” means the vendor's page that would answer this was not read, or could not be opened. It does not mean “no”.
Copilot with a personal Microsoft account
On Copilot with a personal Microsoft account, the vendor states that inputs are used for training by default and that an opt-out is available. Retention: 18 months. Not verified: human review of inputs.
- Trains on customer data
- Yes by default; opt-out available
The FAQ describes which users and regions are included in model training; read it for your location.
“You can opt out of use of your conversation activity for model training at any time.”
The vendor states this on support.microsoft.com, read on 12 Nov 2026
- Default retention
- 18 months
“By default, we store conversation activity for 18 months.”
The vendor states this on support.microsoft.com, read on 12 Nov 2026
Unknown for this plan: Zero-retention option; Deletion on request; Human review of inputs; Single sign-on (SSO); SCIM provisioning; Audit logs; Admin console; Data residency options; Customer-managed keys.
Microsoft 365 Copilot and Copilot Chat (work account, Entra ID)
On Microsoft 365 Copilot and Copilot Chat (work account, Entra ID), the vendor states that inputs are not used for training. Retention: set by the customer's Microsoft Purview retention policies. The vendor states that inputs are not reviewed by people. Stated as available: audit logs and data residency options.
- Trains on customer data
- No
“Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”
The vendor states this on learn.microsoft.com, read on 12 Nov 2026
- Default retention
- Set by the customer's Microsoft Purview retention policies
“Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”
The vendor states this on learn.microsoft.com, read on 12 Nov 2026
- Human review of inputs
- No
“While abuse monitoring, which includes human review of content, is available in Azure OpenAI, Microsoft Copilot services have opted out of it.”
The vendor states this on learn.microsoft.com, read on 12 Nov 2026
- Audit logs
- Yes
“applies your retention policies, supports audit of interactions, and follows your administrative settings”
The vendor states this on learn.microsoft.com, read on 12 Nov 2026
- Data residency options
- EU Data Boundary (stated commitment)
“commitments to Microsoft 365 commercial customers, including the General Data Protection Regulation (GDPR) and European Union (EU) Data Boundary”
The vendor states this on learn.microsoft.com, read on 12 Nov 2026
Unknown for this plan: Zero-retention option; Deletion on request; Single sign-on (SSO); SCIM provisioning; Admin console; Customer-managed keys.
Attestations and company facts the vendor states
- GDPR DPA available
- Yes
Stated for Microsoft Copilot and Copilot Chat as used by organizations.
“covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor”
The vendor states this on learn.microsoft.com, read on 12 Nov 2026
- Model providers used
- OpenAI and Anthropic models (as subprocessors)
“Microsoft offers third-party AI models in Microsoft Copilot, such as Anthropic and OpenAI models.”
The vendor states this on learn.microsoft.com, read on 12 Nov 2026
“Yes” means the vendor's page says so, with the page linked. GhostAudit has not audited the vendor. Scope by product is on the vendor's page.
What remains unknown
- Zero-retention option
- Deletion on request
- Human review of inputs
- Single sign-on (SSO)
- SCIM provisioning
- Audit logs
- Admin console
- Data residency options
- Customer-managed keys
- SOC 2 Type II
- ISO/IEC 27001
- ISO/IEC 42001
- HIPAA BAA available
- FedRAMP
- Company headquarters
- Data processing location
None of these was guessed, inferred from another vendor or filled from memory. Ask the vendor, using the list below.
- Trains by default on the consumer plan. Applies to: Copilot with a personal Microsoft account. Employees using personal accounts are on these terms.
How to check Microsoft Copilot in your own company
- 01Find out which plan each account is on. The vendor's terms differ between Copilot with a personal Microsoft account and Microsoft 365 Copilot and Copilot Chat (work account, Entra ID). People who signed up with a personal address are on the personal terms, whatever the company bought.
- 02Open the account or administrator settings and look for the data-controls or model-training setting the vendor's page describes. Note what it is set to today and who is able to change it.
- 03Read the vendor's own page, linked under each fact below, and check that the sentence quoted here is still there. Pages change; the date shows when this one was read.
- 04Compare with your contract or order form. Where a data processing agreement or negotiated terms exist, they take precedence over the public pages.
- 05Record the plan, the setting and the date in your AI inventory, so that the answer exists the next time a customer or auditor asks.
What to ask the vendor
Neutral questions for the points the vendor's public pages left open. Ask for the answer in writing.
- 01Is a zero-retention option available on our plan, and what does it exclude (for example abuse monitoring logs)?
- 02How do we request deletion of our data, and within how many days is it completed, including backups?
- 03Can your staff or contractors read our inputs? In which cases, and is that access logged?
- 04Is single sign-on available on our plan, and can sign-in with personal accounts be blocked for our domain?
- 05Is SCIM provisioning available, so that leavers lose access automatically?
- 06Are audit logs available to administrators, and can they be exported to our security tooling?
- 07Is there an administrator console where data controls can be set for every account in our organisation?
- 08Where is our data processed and stored, and can a region be chosen?
- 09Can we hold the encryption keys for our data?
- 10Do the statements on your public pages apply to our contract as written, or do negotiated terms override them?
Questions about Microsoft Copilot
- Does Microsoft Copilot train on your data?
- It depends on the plan. The vendor states that inputs are used for training by default on Copilot with a personal Microsoft account. The vendor states that an opt-out is available. The vendor states that inputs are not used for training by default on Microsoft 365 Copilot and Copilot Chat (work account, Entra ID). Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
- Is Microsoft Copilot safe to use at work?
- GhostAudit does not rate tools. Whether Microsoft Copilot is acceptable for your company depends on the plan you hold, the data people put into it and your own policy. This page records what the vendor states, with the wording and the source, so that decision can be made on facts: Copilot with a personal Microsoft account: yes by default; opt-out available and Microsoft 365 Copilot and Copilot Chat (work account, Entra ID): no (training on customer data).
- How long does Microsoft Copilot keep data?
- The vendor states: 18 months. This is the default the vendor's page describes for one plan; other plans may differ, and the table on this page shows each.
- Which attestations does the vendor of Microsoft Copilot state?
- The vendor's pages state: GDPR DPA available. This is the vendor's statement, with the page linked; GhostAudit has not audited the vendor, and the scope by product is on the vendor's page.
- When were these facts checked, and how do I report an error?
- The vendor's pages were read on 12 Nov 2026. Every quotation was checked against the stored text of its source page on that date. To report an inaccuracy, email [email protected] with the page that shows the current wording.
How this page was made, and how to correct it
Every fact above is a statement found on a page Microsoft itself publishes. The page was fetched and reduced to text, the statement was recorded with its exact wording, and the quotation was checked against the stored text of the page. Quotations are at most 25 words. Search results, blogs and third-party summaries were not used.
These are summaries of statements the vendor publishes, as read on the date shown. They are not legal advice, not an assessment of the vendor and not an endorsement. Vendors change their terms: open the linked source and check your own contract before you rely on a statement.
Found an error, or are you the vendor? Report an inaccuracy with the page that shows the current wording. The page is re-read; the fact, its quotation and its date are corrected, or the fact is set to unknown if the page cannot be opened. The full method.
The vendor's official pages
- Privacy policymicrosoft.com
Microsoft Copilot is a product of Microsoft. GhostAudit is not affiliated with, endorsed by or sponsored by Microsoft.
Is Microsoft Copilot in use at your company, and on which plan?
GhostAudit shows which AI tools your people use, from Google Workspace or Microsoft 365 and from the browser, and sets each one beside the terms on this page. It records tool names and time, never prompts.