Scorecard › Microsoft Copilot
Does Microsoft Copilot train on my data?
The short answer depends on your plan. Here's each Microsoft Copilot plan, graded from Microsoft's own policy pages.
A Microsoft Copilot Microsoft 365 Copilot (Business)
Why this grade: No training, no human review, admin retention, DPA, ISO 27001/42001 and HIPAA listed. SOC 2 scope for Copilot not confirmed.
| Trains on your data by default | no |
|---|---|
| Can you opt out? | n/a |
| How to opt out | unknown |
| Admin can enforce settings | yes |
| How long data is kept | Admin retention policies via Microsoft Purview |
| Human review | no (opted out of Azure OpenAI abuse-monitoring review) |
| DPA available | yes (Microsoft Data Protection Addendum) |
| SOC 2 | unknown (Office 365 has SOC 2 Type 2; Copilot scope not confirmed) |
"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs"
Source: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy · checked 2026-10-16
C Microsoft Copilot consumer (personal account)
Why this grade: Conversation activity can be used to train models, with an opt-out. Default and retention not confirmed.
| Trains on your data by default | unknown (opt-out exists; default not stated on cited page) |
|---|---|
| Can you opt out? | yes |
| How to opt out | unknown |
| Admin can enforce settings | no |
| How long data is kept | unknown |
| Human review | unknown |
| DPA available | unknown |
| SOC 2 | unknown |
"You can opt out of use of your conversation activity for model training at any time."
Source: https://support.microsoft.com/en-us/topic/privacy-faq-for-microsoft-copilot-27b3a435-8dc9-4b55-9a4b-58eeb9647a7f · checked 2026-10-16
Which AI tools are safe for your business data, and what changed this week. Plain English, 3-minute read.