Copilot data, privacy and security

This page's changes and edits · All guidance changes

Microsoft's edit · 6 Jan 18:54 UTC

Add Anthropic info to M365 Copilot privacy article

Microsoft's commit message in MicrosoftDocs/microsoft-365-docs · commit bb75cf1 · +7 −6 lines · also on GitHub

⋯ 16 unchanged lines

1717 - d-star

1818 hideEdit: true

1919 ms.update-cycle: 180-days

20 −ms.date: 09/05/2025

20 +ms.date: 01/07/2026

2121 ms.custom: [copilot-learning-hub]

2222 ---

2323

⋯ 11 unchanged lines

3535 > - Microsoft 365 Copilot, including [Microsoft 365 Copilot Search](/copilot/microsoft-365/microsoft-365-copilot-search), is compliant with our existing privacy, security, and compliance commitments to Microsoft 365 commercial customers, including the General Data Protection Regulation (GDPR) and European Union (EU) Data Boundary.

3636 > - Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft 365 Copilot.

3737 > - Microsoft 365 Copilot operates with multiple protections, which include, but aren't limited to, [blocking harmful content](#how-does-copilot-block-harmful-content), [detecting protected material](#does-copilot-provide-protected-material-detection), and [blocking prompt injections (jailbreak attacks)](#does-copilot-block-prompt-injections-jailbreak-attacks).

38 +> - Anthropic models within Microsoft 365 Copilot experiences are provided under the Microsoft Product Terms and Data Protection Addendum. Anthropic models have built-in protections, instantiated and operated by Anthropic, to ensure harmful content is not returned in prompt responses. [Learn more about Anthropic's safeguards.](https://support.claude.com/collections/4078535-safeguards)

39 +> - Anthropic models are out of scope for the EU Data Boundary and when available, in-country LLM processing commitments. For more information, see [Anthropic as a subprocessor for Microsoft Online Services](connect-to-ai-subprocessor.md).

3840

3941 The information in this article is intended to help provide answers to the following questions:

4042

⋯ 24 unchanged lines

6567 > [!NOTE]

6668 > - When you’re using agents to help Microsoft 365 Copilot to provide more relevant information, check the privacy statement and terms of use of the agent to determine how it will handle your organization’s data. For more information, see [Extensibility of Microsoft 365 Copilot](#extensibility-of-microsoft-365-copilot).

6769 > - When you’re using web search, Microsoft 365 Copilot parses the user’s prompt and identifies terms where web search would improve the quality of the response. Based on these terms, Copilot generates a search query that it sends to the Bing Search service. For more information, [Data, privacy, and security for web queries in Microsoft 365 Copilot and Microsoft 365 Copilot Chat](/microsoft-365-copilot/manage-public-web-access).

70 +> - Starting January 7, 2026, Anthropic is a subprocessor for Microsoft 365 Copilot. For more information, see [Anthropic as a subprocessor for Microsoft Online Services](connect-to-ai-subprocessor.md).

6871

6972 While abuse monitoring, which includes human review of content, is available in Azure OpenAI, Microsoft 365 Copilot services have opted out of it. For information about content filtering, see the [How does Copilot block harmful content?](#how-does-copilot-block-harmful-content) section later in this article.

7073

⋯ 108 unchanged lines

179182

180183 ### How does Copilot block harmful content?

181184

182 −To help block harmful content, Microsoft 365 Copilot makes use of the Azure OpenAI Service, which includes a [content filtering system](/azure/ai-foundry/openai/concepts/content-filter) that works alongside core models. The content filtering models for the Hate & Fairness, Sexual, Violence, and Self-harm categories have been specifically trained and tested in various languages. This system works by running both the input prompt and the response through classification models that are designed to identify and block the output of harmful content.

185 +To help block harmful content, Microsoft 365 Copilot uses safeguards that work alongside AI models used to generate responses. Depending on the scenario, these safeguards may include Microsoft first‑party protections or, in some cases, safety mitigations built into the underlying model. These safeguards use a defense-in-depth approach and can include a mix of Microsoft first-party protections that help detect and reduce jailbreak attempts and prompt injection patterns (including cross-prompt injection attacks), content harm filters to identify harmful content in prompts or generated responses (such as Hate & Fairness, Sexual, Violence, and Self-harm), or in some scenarios, safety mitigations built into the underlying model.

183186

184187 Hate and fairness-related harms refer to any content that uses pejorative or discriminatory language based on attributes like race, ethnicity, nationality, gender identity and expression, sexual orientation, religion, immigration status, ability status, personal appearance, and body size. Fairness is concerned with making sure that AI systems treat all groups of people equitably without contributing to existing societal inequities. Sexual content involves discussions about human reproductive organs, romantic relationships, acts portrayed in erotic or affectionate terms, pregnancy, physical sexual acts, including those portrayed as an assault or a forced act of sexual violence, prostitution, pornography, and abuse. Violence describes language related to physical actions that are intended to harm or kill, including actions, weapons, and related entities. Self-harm language refers to deliberate actions that are intended to injure or kill oneself.

185188

186 −In addition to content filtering provided by the Azure OpenAI Service, Microsoft 365 Copilot also applies filters to help prevent workplace harms from happening. Workplace harms refers to a category of harms that can result from generative AI or models making inferences, judgments, or evaluations about an employee based on their workplace communication. Currently, that means inferences, judgments, or evaluations about an employee's performance, attitude, internal or emotional state, or personal characteristics. We restrict the use of generative AI or models from being used for these purposes.

187 −

188189 ### Does Copilot provide protected material detection?

189190

190 −Yes, Microsoft 365 Copilot provides detection for protected materials, which includes text subject to copyright and code subject to licensing restrictions. Not all of these mitigations are relevant for all Microsoft 365 Copilot scenarios.

191 +Yes, Microsoft 365 Copilot provides detection for protected materials, which includes text subject to copyright and code subject to licensing restrictions. This detection may not be available in all Microsoft 365 Copilot scenarios, and not all of these mitigations are relevant for all Microsoft 365 Copilot scenarios.

191192

192193 ### Does Copilot block prompt injections (jailbreak attacks)?

193194

194 −Jailbreak attacks are prompts designed to bypass Copilot's safeguards or induce non-compliant behavior. Microsoft 365 Copilot helps mitigate these attacks by using proprietary jailbreak and cross-prompt injection attack (XPIA) classifiers. These classifiers analyze inputs to the Copilot service and help block high-risk prompts prior to model execution.

195 +Jailbreak attacks are prompts designed to bypass Copilot's safeguards or induce non-compliant behavior. Microsoft 365 Copilot helps mitigate these attacks by using proprietary jailbreak and cross-prompt injection attack (XPIA) classifiers. These classifiers analyze inputs to the Copilot service and help block high-risk prompts prior to model execution. These classifiers may not be available in all Microsoft 365 Copilot scenarios.

195196

196197 ### What happens when foundation model changes occur?

197198

⋯ 15 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/microsoft-365-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:49 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.