Microsoft Copilot: what Microsoft says about your data
For organizations, Microsoft says Copilot prompts and responses under enterprise data protection are not used to train foundation models and follow the organization’s retention and audit settings.
Sources checked November 7, 2026
Personal plans
Copilot with a personal Microsoft account
- Training on your content
- Not covered by the page this library checked.
- How long it is kept
- Not covered by the page this library checked.
- Your controls
- Not covered by the page this library checked.
Business plans
Microsoft 365 Copilot and Copilot Chat used by organizations (enterprise data protection)
- Training on your content
- Microsoft’s page says prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.
- How long it is kept
- The page says Copilot applies your retention policies and supports audit of interactions; controls vary by subscription plan.
- Your controls
- The page says the same contractual terms as Exchange email and SharePoint files apply, with Microsoft as a data processor.
In Microsoft's words
“the prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation models.”
Source
What to write in your AI register
- Which plan your business uses, and whether staff sign in with company or personal accounts.
- Whether the training setting is on or off, who checked it and when.
- What kinds of data staff may put in (for example: no client names, no payment data).
Sources
Policies change; check the linked page before you decide. This page describes what the vendor says. It is not legal advice and not a review of the vendor.