When you use Copilot in Outlook, your email messages, calendar events, and contact data are processed to generate summaries, draft replies, and suggest actions. Many business users are unsure what data leaves their tenant, whether it is stored, and who can access it. This article explains the specific data Copilot reads, how Microsoft handles it, and which privacy settings in the Microsoft 365 admin center control data flow. You will learn how to audit and restrict data sent to Copilot while keeping productivity features active.
Key Takeaways: Copilot in Outlook Data Handling
- Microsoft 365 admin center > Copilot > Data controls: Disables Copilot from reading specific Microsoft Graph data sources like calendar or mailbox content.
- Outlook Copilot pane > Feedback > Diagnostic data: Lets you view what telemetry data is sent to Microsoft for product improvement.
- Microsoft Purview compliance portal > Data lifecycle management: Lets you set retention policies that affect how long Copilot-processed data is stored.
What Data Copilot in Outlook Reads
Copilot in Outlook uses the Microsoft Graph API to access data stored in your Microsoft 365 tenant. The specific data types Copilot reads depend on the task you request. For example, when you ask Copilot to summarize an email thread, it reads the email body, subject line, sender, recipients, and timestamp of each message in that thread. When you ask Copilot to suggest a meeting time, it reads your calendar events, free/busy status, and meeting attendees.
Copilot does not read all data from your tenant at once. It reads only the data relevant to the current query or action you initiate in Outlook. The data is processed in memory and is not stored permanently in a separate Copilot database. However, Microsoft may retain diagnostic logs that include metadata such as query text, response quality, and performance metrics for up to 30 days.
The data Copilot reads falls into these categories:
Email and Messages
When Copilot summarizes an email thread, it reads the full content of each message in that thread. This includes inline images, attachments, and any embedded links. Copilot does not store the email content after generating the summary. The summary itself is generated on the fly and is not saved as a separate document unless you manually copy and paste it.
Calendar and Meetings
When Copilot suggests meeting times or drafts meeting invitations, it reads your calendar items, including event titles, descriptions, attendee lists, and location details. Copilot does not read calendar items outside the time range you specify in your request.
Contacts
When Copilot drafts a reply that includes a recipient name, it reads the contact name and email address from your Outlook contacts or your organization’s global address list. Copilot does not read contact notes, phone numbers, or other custom fields unless you explicitly ask for that information.
Data Processing Location and Storage
All data processing for Copilot in Outlook occurs within your Microsoft 365 tenant’s geographic region. Microsoft does not transfer the content of your emails or calendar events to a different region for processing. The Copilot service runs on Microsoft’s Azure infrastructure in the same region as your tenant’s primary data center.
The data read by Copilot is processed in memory and is not written to disk in a persistent store. However, Microsoft may generate diagnostic logs that include the following metadata:
- Query text you typed or selected
- Response text generated by Copilot
- Performance metrics such as response time and error codes
- User identifier (anonymized after 30 days)
These diagnostic logs are retained for up to 30 days and are used to improve the quality of Copilot responses. You can opt out of diagnostic data collection by turning off optional diagnostic data in Windows settings or in the Microsoft 365 admin center.
Controlling Data Access with Privacy Settings
Microsoft 365 administrators can control which data Copilot can access by configuring data source policies in the Microsoft 365 admin center. These policies apply to all users in the tenant who have a Copilot license.
Steps to Restrict Copilot Data Sources
- Open the Microsoft 365 admin center
Go to https://admin.microsoft.com and sign in with an account that has Global Admin or Copilot Admin role. - Navigate to Copilot settings
In the left navigation pane, select Settings > Org settings. Then click the Copilot tab. - Select Data controls
Under the Copilot section, click Data controls. You will see a list of Microsoft Graph data sources that Copilot can read. - Disable specific data sources
Uncheck the box next to any data source you want to block. For example, uncheck Mail to prevent Copilot from reading email content. Uncheck Calendar to block calendar data access. - Save the changes
Click Save at the bottom of the page. The changes take effect within 15 minutes for all users.
After disabling a data source, Copilot will still appear in Outlook but will return an error message if you try to use a feature that requires that data. For example, if you disable Mail, the “Summarize this email” button will show a message that the feature is unavailable.
What Data Is Sent to Microsoft for Telemetry
Copilot in Outlook sends telemetry data to Microsoft for product improvement. This data is separate from the content of your emails and calendar events. Telemetry includes:
- Feature usage counts: how many times users triggered a Copilot action
- Response quality ratings: thumbs up or thumbs down feedback you submit
- Error logs: any failures in generating a response
- Performance data: how long Copilot takes to generate a response
You can view the diagnostic data that Copilot sends by opening the Copilot pane in Outlook, clicking the three-dot menu, and selecting Feedback > Diagnostic data. This shows a summary of the data collected in the last 24 hours. You can also delete this data by clicking the Delete diagnostic data link.
If Copilot Still Shows Data You Blocked
After you disable a data source, Copilot may still show cached or previously processed data until the cache expires. The cache is stored locally in Outlook and is refreshed every 24 hours. If you see data from a blocked source immediately after changing the policy, wait 15 minutes and restart Outlook. If the issue persists, clear the Outlook cache by closing Outlook, deleting the contents of the %localappdata%\Microsoft\Outlook\RoamCache folder, and restarting Outlook.
Copilot Uses Data from Other Microsoft 365 Apps
Copilot in Outlook may also use data from other Microsoft 365 apps if you have enabled cross-app data sharing. For example, if you ask Copilot to draft an email about a project, it may read data from Microsoft Teams or SharePoint if those data sources are enabled in the admin center. To block cross-app data access, go to the Data controls page and uncheck Microsoft Teams and SharePoint under the “Cross-app data sources” section.
| Item | Copilot in Outlook (Default) | Copilot in Outlook (Restricted) |
|---|---|---|
| Data read | Email body, calendar, contacts | Only contacts and calendar free/busy |
| Data storage | In memory, not persisted | In memory, not persisted |
| Telemetry sent | Feature usage, error logs, performance | Feature usage, error logs, performance |
| Admin control | Full list of data sources available | Mail and Calendar data sources disabled |
| Cross-app data | Enabled by default | Disabled via admin policy |
You now know exactly what data Copilot in Outlook reads, how that data is processed, and which settings control data access. To audit your current configuration, open the Microsoft 365 admin center and review the Data controls page. For deeper compliance needs, use Microsoft Purview to set data retention policies on Copilot logs.