How Copilot for Microsoft 365 delivers on data security and privacy

Like Floww, many customers have data privacy and compliance top of mind. It’s no wonder as research shows 82% of ransomware attacks are targeted at small and medium-sized businesses[*].

Our customers, when using Microsoft 365 for Business and Copilot for Microsoft 365, get peace of mind with the highest standards of data protection. Microsoft 365 for Business protects passwords, secure access, keep your business data safe, manage your devices so they stay secure, and defend your business against cyberthreats. You can learn more about our three subscriptions plans here.

Additionally, as a Microsoft 365 for Business user, your Web-grounded AI chat in the browser, Outlook, M365 apps or Teams come with enterprise data protection to safeguard your business data and devices with integrated identity, security, compliance, device management, and privacy protection.

Now Copilot for Microsoft 365 also works with work & business data in the Microsoft 365 Graph – your emails, calendars, and documents you have access to. That is how it has the power to become your personal assistant at work, from recapping Teams meetings, to turning a Word document into a stunning PowerPoint. Here’s how Microsoft protects your data and gives you control over it.

A high-level architecture diagram of Copilot for Microsoft 365, depicting service boundary, data flows, and prompt/response orchestration

Tenant Security

Copilot operates within the Microsoft 365 tenant, inheriting all the existing security, privacy, identity, and compliance requirements.

It is built upon a foundation of trust, ensuring that organizational data is distinct and separate from other tenants.

Watch this video to learn more about how Copilot is built upon a foundation of trust.

Data Defense

Data is considered the customer’s business, and Copilot respects the customer’s control over its collection, use, and distribution.

It ensures that data is stored, encrypted, processed, and defended to the highest standards. Further, we don’t use your customer data to train foundation models, and Copilot adheres to existing data permissions and policies, and its responses to you based only on data that you personally can access.

Watch the following video to learn how data is stored, encrypted, processed, and defended.

Azure OpenAI Service

Interactions with Copilot (prompts) are processed using Azure OpenAI services, which prioritize the integrity and protection of your organizational data.