Copilot data residency is not a universal region switch. To assess where organizational Copilot data is stored and processed, separate three questions: where stored data resides, where AI processing occurs, and which contractual commitments cover the particular feature or model.
The earlier “Customer Data Boundary” menu and EU/UK/US selection procedure were incorrect. Use the Microsoft 365 Data Location Card for storage information and the applicable service documentation for processing. This guide concerns organizational Copilot, not a personal consumer account.
Official documentation checked: October 14, 2026. This is a technical review workflow, not a legal determination of compliance.
Storage, Processing and the EU Data Boundary Are Different
Data at rest means stored information. A storage commitment does not automatically tell you where every inference request, support operation or external service runs.
The EU Data Boundary covers defined enterprise services in EU/EFTA countries, subject to documented limited-transfer exceptions. It is not a choice among three equivalent “EU,” “UK” and “US” boundaries. Microsoft identifies tenant eligibility and exclusions, including a Multi-Geo caveat, in that documentation.
Microsoft’s Copilot privacy guidance distinguishes residency commitments from processing and identifies provider-specific exceptions. Do not derive a processing region from a user’s physical location, the language of a response or the country of a cited website.
Check the Actual Storage Commitment
- Ask an authorized tenant Global Administrator to sign in to the Microsoft 365 admin center.
- Open Settings → Org settings → Organization profile → Data location.
- Record the relevant service, Current Geography and Committed Geography. Include the tenant and review date in your internal record, not in a public support post.
- Compare those values with your applicable Product Terms and any Advanced Data Residency or Multi-Geo arrangement.
- If the values differ, investigate the migration or commitment state before describing the tenant as fully moved.
The Data Location Card documentation describes this at-rest view. Not every covered service appears on the card. A missing Copilot Chat row is not proof of no protection, and a migration mismatch is not fixed by an invented 24-hour boundary toggle.
Do not change a geography or purchase a residency add-on merely to make a screenshot look compliant. First identify the required outcome and the documented effect of the proposed change.
Review Model and External-Service Exceptions
As checked on the date above, Microsoft’s Anthropic models documentation states that those models are excluded from the EU Data Boundary and, where applicable, in-country processing commitments. It also distinguishes ordinary subprocessor use from separately enabled models labeled with Data Retention. Do not assume that every selectable model has identical terms.
For each enabled agent or connector, identify what information is sent, which service receives it and which contract applies. Content indexed from an external system and an agent calling that system are not necessarily the same data flow. Review the actual integration rather than marking all connectors either covered or uncovered.
Route unresolved requirements to your privacy, security or legal reviewer. Microsoft’s service commitments are relevant evidence, but they do not by themselves certify your organization’s particular workflow.
Build a Useful Residency Review Record
Use a short evidence record for each workflow:
- Scope: account type, tenant, app, feature and any provider or agent used.
- Stored data: the card values and the relevant residency contract.
- Processing: the feature-specific geography commitment and identified exclusions.
- External transfers: enabled providers, connector or agent destinations and applicable terms.
- Decision: approved data classes, reviewer, unresolved questions and next review date.
For example, an EU storage entry plus an enabled provider with an EUDB exclusion requires further review; the storage screenshot alone cannot close the question. Recheck this record after changing providers or adding an agent, not only when a Microsoft 365 subscription renews.