Official documentation checked October 14, 2026.
For organizational Microsoft Copilot, a tenant is a logical identity and access boundary—not a private computer on which every part of the AI service runs. Claims that all processing stays in the tenant’s geographic region or that prompts are never retained are too broad.
Assess four separate questions: who can access content, where it is stored, where it is processed, and which additional services receive it. This guide explains how to collect that evidence without relying on nonexistent “data source” switches.
Separate access isolation from storage and processing
Microsoft’s organizational Copilot privacy documentation describes permission-based grounding, protected interaction history, and residency commitments. It also describes processing across regions in some circumstances. “Not used to train foundation models” does not mean “no records are retained.”
Use precise language in your internal assessment:
- Access: which identities may read the source and result?
- Storage: which service holds source files and interaction records, and under which retention policy?
- Processing: what location commitments cover the selected feature and model?
- Extensions: what additional data flows arise from search, agents, connectors, or actions?
A company file can remain in SharePoint while relevant content is processed to answer a request. Conversely, a user saving an answer creates another artifact that needs appropriate permissions. Neither can be evaluated simply by asking whether the original file moved.
Review the exceptions and additional data flows
Web search: Copilot can generate a Bing query to supplement a response. Review the web-query data-handling explanation and policy; do not treat web search as identical to internal document retrieval.
Agents and tools: inspect the publisher, permissions, terms, and destination service. An approved extension can introduce external processing. The extensibility overview distinguishes the supported integration routes.
Model configuration: Microsoft’s current Anthropic configuration documentation distinguishes subprocessor models from separately enabled models with data-retention terms. It also identifies exclusions from EU Data Boundary and applicable in-country processing commitments. Review the exact enabled offering; a general Microsoft 365 statement is not sufficient to approve every model.
Feedback and history: optional feedback may contain submitted content samples, while interaction records can be governed by Copilot retention policies. These are not a universal 30-day temporary cache.
Build an evidence-based review for your organization
- Identify the tenant cloud, user group, app, feature, and enabled model or agent. Avoid an approval that simply says “Copilot.”
- List the allowed information types and any residency, records, or contractual requirement. Have the responsible privacy or security owner interpret those requirements.
- Map each requirement to the applicable Product Terms, Data Protection Addendum, service documentation, and model or extension terms. Record the document date and unresolved exceptions.
- Verify source permissions and configured policies using authorized administration tools. Use harmless pilot content to test the intended user access.
- Document what the test does and does not prove. A successful response or a clean audit search does not establish the geographic location of every processing step.
If a response reveals unexpected information, preserve its source references and the time, account, and feature. Check existing sharing and conversation context before concluding there was cross-tenant leakage. Escalate suspected unauthorized access through the security process; do not make broad sharing changes or delete evidence as a substitute for investigation.
The outcome should be a scoped approval or a clearly identified gap—not a blanket assurance that nothing leaves a tenant. Recheck it when adding a model, extension, or materially different workload.