Microsoft (365) Copilot — Copilot license (add-on)
Vendor: Microsoft.
| Field | Value |
|---|---|
| Retention (default) | Stored with M365 content per contractual commitments source · 2026-10-15 |
| Retention configurable | Yes – Microsoft Purview retention policies source · 2026-10-15 |
| Trains on customer data | No – prompts, responses, Graph data not used to train foundation LLMs source · 2026-10-15 |
| Zero data retention option | Unknown |
| Data residency | EU Data Boundary; ADR & Multi-Geo commitments (Anthropic models excluded from EUDB) source · 2026-10-15 |
| SSO | Microsoft Entra ID (M365 identity) source · 2026-10-15 |
| SCIM | N/A – identities come from Microsoft Entra ID source · 2026-10-15 |
| Audit logs / compliance API | Yes – Content search / Microsoft Purview source · 2026-10-15 |
| Customer-managed keys | Customer Key/BYOK-encrypted items supported and can be returned by Copilot source · 2026-10-15 |
| Admin connector controls | Yes – admins allow/block agents; Graph connectors source · 2026-10-15 |
| SOC 2 | Unverified: M365 SOC 2 Type II reports on Service Trust Portal (NDA) source (could not open) |
| ISO 27001 | Yes source · 2026-10-15 |
| HIPAA / BAA | Yes (listed compliance offering) source · 2026-10-15 |
| Encryption | At rest and in transit (BitLocker, per-file, TLS, IPsec) source · 2026-10-15 |
| DPA available | Yes – Microsoft Products and Services DPA source · 2026-10-15 |
| Feedback used for training | Feedback not used to train foundation LLMs source · 2026-10-15 |
| Vendor human review | Opted out of Azure OpenAI abuse monitoring (incl. human review) source · 2026-10-15 |
| AI mgmt cert (ISO 42001) | Yes – ISO 42001 source · 2026-10-15 |
| FedRAMP | Available in GCC High (inherits FedRAMP High) source · 2026-10-15 |
| Pricing note | $30/user/mo annual; requires qualifying M365 plan (Copilot Chat included at no cost) source · 2026-10-15 |