Last checked:
Scorecard › Is Microsoft Copilot safe for business?
Is Microsoft Copilot safe for business?
Best-graded plan: Microsoft Copilot Microsoft 365 Copilot (Business) (A). Microsoft Copilot Microsoft 365 Copilot (Business) does not train on your data by default. Microsoft Copilot older app (personal account) can use your data for training unless you opt out.
| Plan | Grade | Trains by default | Human review | Retention | DPA | SOC 2 |
|---|---|---|---|---|---|---|
| Microsoft 365 Copilot (Business) | A | no | no (opted out of Azure OpenAI abuse-monitoring review) | Admin retention policies via Microsoft Purview | yes (Microsoft Data Protection Addendum) | unknown (Office 365 has SOC 2 Type 2; Copilot scope not confirmed) |
| older app (personal account) | C | yes unless you opt out (older Copilot app; some groups, e.g. signed-out users and under-18s, excluded) | yes, no opt-out (older Copilot app) | 18 months by default (older Copilot app); delete chats anytime | unknown | unknown |
| new app since Aug 18, 2026 (personal account) | B | no (prompts, responses and files aren't used to train foundation models) | unknown | unknown | unknown | unknown |
Sources: Microsoft 365 Copilot (Business) · older app (personal account) · new app since Aug 18, 2026 (personal account)
A Microsoft Copilot Microsoft 365 Copilot (Business)
No training, no human review, admin retention, DPA, ISO 27001/42001 and HIPAA listed. SOC 2 scope for Copilot not confirmed.
"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs"
C Microsoft Copilot older app (personal account)
Applies to the older Copilot app. Trains on your conversations unless you opt out, some chats get human review with no opt-out, and conversations are kept 18 months by default. No business contract.
"Except for certain categories of users or users who have opted out, Microsoft uses data from Bing, MSN, Copilot, and interactions with ads on Microsoft for AI training."
B Microsoft Copilot new app since Aug 18, 2026 (personal account)
In the new Copilot app (since Aug 18, 2026), Microsoft says prompts, responses, files and feedback aren't used to train foundation models. It's a personal account with no business contract, and retention and human review aren't confirmed for the new app.
"Prompts, responses, and your file contents when using the Microsoft Copilot app aren't used to train foundation models."
Grades describe published policies, not security testing. How we grade.