Microsoft Copilot

Does Microsoft Copilot train on your prompts and files? With a work or school account, Microsoft says prompts and responses are not used to train its foundation models. For the new consumer app, Microsoft’s own documentation does not say either way, and which sign-in you use decides almost everything else.

Important: there are at least three different Copilots

Microsoft uses the Copilot name for several products that have different defaults, different pricing, and very different privacy postures. This is even more confusing than the two-Geminis problem.

Consumer Copilot (copilot.microsoft.com, Copilot in Windows when signed in with a personal Microsoft Account, the Copilot mobile app). Free, or with a Microsoft 365 Personal, Family or Premium subscription (NZ$179, NZ$229 or NZ$369 a year on Microsoft's New Zealand store, read 24 October 2026). Copilot Pro is no longer sold to new subscribers; Microsoft 365 Premium replaced it in October 2025. Microsoft’s documentation does not currently say whether the current app trains on your prompts, responses or file contents (updated 23 October 2026; see the training section). The legacy app, where it has not been updated, trains unless you opt out.

Microsoft 365 Copilot (the business add-on for Microsoft 365 plans; Microsoft 365 Copilot Business is NZ$34 a user a month billed annually, or NZ$40.80 monthly, on Microsoft's New Zealand page, read 24 October 2026). Tenant-scoped. Never trains on your data. Inherits your existing Microsoft 365 permissions.

GitHub Copilot (the code-completion product). Separate product, separate billing, separate policy. See the GitHub Copilot vendor profile for the full picture — and note the policy flipped from opt-in to opt-out on April 24, 2026 for Free/Pro/Pro+ tiers.

This profile covers the first two. GitHub Copilot has its own profile.

Plain-English risk rating: 2 of 5 (personal Microsoft account, current app and web) / 2 of 5 (work or school, Entra sign in)

We have split this profile because the products are different enough to warrant separate ratings.

Corrected 22 August 2026, and the correction moved the rating. This profile previously rated the consumer product 3 of 5 on the basis that training was on by default. Microsoft’s current documentation states plainly that prompts, responses and file contents in the Copilot app are not used to train its foundation models, and the privacy-controls page lists three controls with no training toggle among them. We had published the opposite. The consumer product is therefore 2 of 5, not 3.

Updated 23 October 2026: the statement this rating rests on no longer covers the consumer Copilot app on Microsoft’s page. The page we quoted now reads “Prompts, responses, and your file contents when using Copilot in Microsoft 365 apps aren’t used to train foundation models” and says it applies only to Copilot in Microsoft 365 apps for home (page updated 9 September 2026). Microsoft’s privacy overview for the consumer Copilot app (18 August 2026) does not say whether your conversations are used for training, and the Microsoft Privacy Statement (September 2026) says Microsoft “may use your data to develop, train, and fine-tune our AI models”. Until Microsoft states the consumer app’s position, read the consumer lines on this page as Microsoft’s August wording, not a current commitment. The consumer rating is under review.

One caveat we state rather than bury: Microsoft collapsed these product names on 18 August 2026, so the discriminator that matters is which sign-in you use, personal or work, not which name you saw. The legacy consumer app, where it has not yet been updated, remains 3 of 5 — see the training section.

Microsoft 365 Copilot sits at 2, one band riskier than Workspace Gemini at 1. The contractual no-training and tenant-isolation defaults are genuinely strong. What pulls it from 1 to 2 is the EchoLeak vulnerability (CVE-2025-32711) disclosed in June 2025 — a zero-click prompt injection that allowed sensitive enterprise data exfiltration with no user interaction. Microsoft patched it, but the broader class of indirect prompt injection vulnerabilities in agentic AI is structurally unsolved. Microsoft 365 Copilot has a larger agentic surface than Workspace Gemini, which proportionally widens the attack surface.

Recommended for

  • Sole proprietor on a personal Microsoft Account: No training toggle appears in the current app’s privacy controls, and Microsoft’s documentation does not currently say whether the consumer app trains on your prompts (updated 23 October 2026). Update the app so you are not left on the legacy version. This is a policy statement, not a contractual guarantee, so for client work under contract move to Microsoft 365 Copilot through a business account
  • Small team (2-10 people) already on Microsoft 365 Business: Microsoft 365 Copilot Business at NZ$34 a user a month (billed annually) if the productivity uplift justifies the cost. Run a permissions audit first — see "Critical pre-deployment warning" below
  • Regulated industry: Microsoft 365 Copilot with EU Data Boundary or GCC tenant residence, plus Microsoft Purview AI Hub for monitoring, plus BYOK encryption for Restricted-tier data
  • The honest answer for most 1-10 employee businesses: If you are already on Microsoft 365 Business Standard or higher, Microsoft 365 Copilot is a strong choice on the privacy axis — but only after you have done a SharePoint and OneDrive permissions cleanup. The product is safe; the permission gaps in your tenant are the actual risk

Critical pre-deployment warning (Microsoft 365 Copilot)

This is the most important sentence in this profile: Microsoft 365 Copilot inherits your existing Microsoft 365 permission model exactly as it stands.

In practice, that means: if your SharePoint sites have accumulated overly permissive sharing settings over the past 5-15 years (which is true of virtually every Microsoft 365 tenant), Copilot will surface content from those sites in responses. Users will see results from documents they technically have access to but have never visited and were never meant to see. There are no examples on record of Microsoft 365 Copilot bypassing permissions — but there are many examples of organisations discovering, after Copilot rollout, that their permissions were much more permissive than anyone realised.

Day-1 mitigation is Microsoft's Restricted Search feature, which can be enabled at the tenant level to limit Copilot grounding to a curated set of sources. Long-term fix is a SharePoint/OneDrive permissions audit. Both should happen before, not after, Copilot deployment.

Data retention default

Consumer Copilot:

  • Training: Microsoft’s documentation for the consumer app does not currently say (updated 23 October 2026; see the training section)
  • Chat history is kept so you can revisit conversations. Individual chats or the entire history can be deleted at any time
  • Personalization and memory can retain details such as your communication style, recurring topics and goals. Saved memories can be viewed, deleted individually, deleted in bulk, or switched off at Settings then Personalization
  • Web search is on by default and can be switched off at Settings then Personalization then Advanced
  • Microsoft does not restate a retention period on the current documents. The superseded FAQ specified 18 months. Do not assume that figure still applies. Export and deletion run through the Microsoft privacy dashboard
  • Legacy Copilot app, if you have not updated: the older Privacy FAQ governs, which specifies conversation activity stored for 18 months, uploaded files stored up to 18 months and then deleted, and model training subject to your settings

Microsoft 365 Copilot:

  • Prompts and responses stored within the user's mailbox (logged in Microsoft 365 audit trail)
  • Subject to your existing Microsoft Purview retention policies — admins control
  • Processed within the Microsoft 365 service boundary except when an Anthropic (Claude) model is used. Microsoft says Anthropic is now a Microsoft subprocessor and its models are on by default for most commercial customers outside the EU, EFTA and UK — New Zealand included — in Copilot, Researcher, Copilot Studio and Copilot in the Office apps. The Microsoft Data Protection Addendum still applies, and for standard Anthropic models Anthropic does not keep your prompts or responses. Admins can switch Anthropic off in the Microsoft 365 admin center, though some features then stop working. (Corrected 3 October 2026.)
  • Tenant-isolated; no cross-tenant data flow
  • EU Data Boundary supported for EU tenants

Training opt-out

Consumer Copilot, current app and web (since 18 August 2026): Microsoft’s documentation no longer states the position. In August Microsoft’s page read: “Prompts, responses, and your file contents when using the Microsoft Copilot app aren’t used to train foundation models.” By 23 October 2026 the same page said “when using Copilot in Microsoft 365 apps” and applied only to Copilot in Microsoft 365 apps for home. The consumer app’s own privacy overview does not address training. Microsoft said in August that even optional feedback is not used to train the foundation models.

We found no training opt-out for the current app. The privacy controls page for the current app lists exactly three controls: Personalization and memory, Chat history, and Web search. A training toggle is not among them. With no stated position, the missing toggle tells you nothing either way.

This is a policy statement, not a contractual guarantee. Consumer users have no data protection addendum. Microsoft can revise a support page at any time, which is exactly what it did on 18 August 2026. For the consumer app, treat it as unconfirmed until Microsoft restates it; it was always materially weaker than the contractual exclusion the enterprise tier carries.

Legacy Copilot app, if you have not updated: training is on by default for signed-in users, with an opt-out available, and the older Privacy FAQ still governs you. Microsoft now serves two separate privacy documents split by app version, and each disclaims the other. Note that web users are routed to the current document regardless of which app they installed.

Microsoft Copilot for work or school (formerly Microsoft 365 Copilot): training is contractually excluded by default. Tenant data is never used to train Microsoft foundation models, guaranteed via the Microsoft 365 Data Protection Addendum. No user-side toggle needed.

Note: optional tenant admin settings exist to share data with Microsoft for product improvement, for example the Dynamics 365 and Power Platform Copilot optional data sharing flag. These are opt-in by tenant admins and off by default.

Naming note. Microsoft renamed Microsoft 365 Copilot to Microsoft Copilot on 18 August 2026, so the personal product and the work product now share one name. Microsoft states there are no changes to security, compliance or privacy for organisations. The reliable way to tell which set of rules applies to you is the sign-in: a personal Microsoft account gets the consumer rules above, and a work or school (Microsoft Entra) account gets the contractual exclusion.

Zero Data Retention availability

  • Not applicable in the same form as ChatGPT/Claude API ZDR. Microsoft 365 Copilot's tenant-isolation model is structurally different — your data is retained inside your Microsoft 365 tenant and is not used for training. Exception: requests routed to Anthropic models leave Microsoft's boundary for Anthropic, under Microsoft's DPA; Anthropic keeps nothing for standard models, but “Anthropic models with Data Retention”, which an admin must switch on separately, are kept by Anthropic for up to 30 days. (Corrected 3 October 2026.)
  • For Azure OpenAI Service customers building applications, abuse-monitoring data retention is configurable, including options to opt out of human review for qualified customers with Enterprise Agreements

Plan tiers and pricing (read 24 October 2026 from New Zealand)

TierPrice (NZ$)Training on your data?Suitable for
Copilot (free, signed-out)$0No (because signed-out)Quick questions, public info
Copilot (free, signed-in)$0Not stated for the current app: Microsoft’s no-training sentence now covers Copilot in Microsoft 365 apps (read 23 October 2026). Legacy app not yet updated: yes.Personal use
Microsoft 365 Personal, Family or Premium (Copilot included for the subscription owner; replaced Copilot Pro)$179, $229 or $369 a yearMicrosoft says Copilot in Microsoft 365 apps for home is not used to train foundation models; the standalone Copilot app's position is not statedPersonal use; note this is a policy statement, not a contract
Microsoft 365 Copilot Business$34 a user a month billed annually, or $40.80 monthly (add-on to a Microsoft 365 business plan)No — contractually excludedTeams already on Microsoft 365
Microsoft 365 Copilot ChatIncluded with eligible Microsoft 365 plansNo — contractually excludedAll eligible Microsoft 365 users
Azure OpenAI ServicePay-per-tokenNo, by defaultDevelopers building applications

Notable: Microsoft 365 Copilot Chat (the conversational interface that uses web grounding rather than tenant grounding) was rolled into eligible Microsoft 365 plans during 2025 as a baseline feature. This is a meaningful free upgrade for Microsoft 365 Business and Enterprise subscribers.

Jurisdiction

  • Primary processor: Microsoft Corporation, Redmond, Washington, USA
  • Cloud infrastructure: Microsoft Azure
  • Microsoft 365 Copilot processes prompts and responses within the Microsoft 365 service boundary in the geographic region associated with the tenant
  • EU Data Boundary: for qualifying customers, Microsoft 365 Copilot prompts and responses are processed within the EU
  • Azure OpenAI inference runs within the same regional boundary as your tenant — your data is not transferred to OpenAI

Breach history (public incidents)

June 2025 — EchoLeak (CVE-2025-32711) — the most significant AI security vulnerability disclosed to date

Aim Security researchers disclosed EchoLeak in June 2025, a zero-click indirect prompt injection vulnerability in Microsoft 365 Copilot. CVSS severity score 9.3.

How it worked: An attacker sent a benign-looking email to a target employee. The email contained hidden prompt-injection instructions (formatted to evade Copilot's prompt classifiers). The user did not need to open the email, click any link, or take any action — Copilot's normal retrieval engine would ingest the email as context when the user later asked Copilot something unrelated (for example, "summarise our quarterly report"). At that point, the hidden instructions in the attacker's email would execute as if they were part of Copilot's prompt, instructing Copilot to extract sensitive data from the user's emails, documents, and Teams chats and exfiltrate it via a Microsoft Teams asynchronous preview API (an allowed domain under Copilot's content security policy).

The attack required no user interaction, left no obvious trace in security logs, and could exfiltrate arbitrary sensitive data from anywhere the targeted user had access. Aim Security reported the vulnerability to Microsoft in January 2025 via responsible disclosure; Microsoft deployed a server-side fix in May 2025 (no user action required) and publicly disclosed the vulnerability in June 2025 with the CVE assignment. Affected builds: 2024.10.15 through 2025.01.10.

Microsoft's specific patch closed EchoLeak, but the broader class of indirect prompt injection vulnerabilities is structurally unsolved across the industry — NIST's guide to attacks on AI systems treats indirect prompt injection as its own attack class, and OWASP ranks prompt injection as the #1 threat in its 2025 LLM Top 10. Expect more EchoLeak-class disclosures over time.

Sources: Aim Security disclosure (January 2025 private, June 2025 public); Microsoft Security Response Center; CVE-2025-32711 NVD entry; Sentra analysis; Information Security Media Group, 2025-06-16

Note on oversharing incidents: Microsoft 365 Copilot has been involved in multiple publicly-discussed (and many more privately-discussed) cases where the product surfaced sensitive content to employees who technically had access but should not have seen it. These are not breaches in the security sense — the permissions allowed the access — but they are real data exposure events that frequently trigger emergency permissions remediation projects. EPC Group and other Microsoft consulting partners have documented the pattern extensively. No CVE is assigned because the underlying issue is customer permission configuration, not a product vulnerability.

Note on the Microsoft 365 platform more broadly: The Microsoft 365 platform itself has a substantial breach history that affects Copilot indirectly (since Copilot inherits the platform's security posture). Notable incidents include the July 2023 Storm-0558 incident (China-linked threat actor accessed Outlook email accounts via stolen Microsoft signing key) and the January 2024 Midnight Blizzard (Russian SVR-linked) compromise of Microsoft corporate email accounts. These pre-date Copilot's wide deployment but represent the threat baseline for any data accessible via Microsoft 365.

Agent features: what it can reach, keep, pass on and do

Checked 23 September 2026. This section describes agent features only and does not change the rating above: agents are not yet part of our scoring method. Everything here comes from Microsoft’s own published pages, linked at the end of the section. Where Microsoft does not say something, we say so rather than guess.

Scope. This covers agents in Microsoft 365 Copilot, used with a work or school account. It does not cover the consumer Copilot app.

What it can reach. Microsoft says agents work inside your existing Microsoft 365 permissions and do not grant new ones: if you cannot open a SharePoint site, Teams channel or mailbox, an agent acting for you cannot either. Third-party agents are a different case. Microsoft says each is governed by its own terms of use and privacy policy, and that Copilot sends the agent a query built from your prompt, your conversation history and Microsoft 365 data you can access.

What it keeps. Microsoft says content that agents touch stays under your existing data loss prevention, retention and compliance policies, that agent activity is captured in the unified audit log, and that prompts and responses for custom engine agents are stored under the Microsoft 365 product terms. It also says the level of detail in logs varies by service and configuration.

Where your content goes. Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. Once a third-party agent receives a query, what happens to it is governed by that developer’s own policy, not Microsoft’s.

What it can do without asking. Microsoft’s own documentation warns that if an agent’s custom action pulls in untrusted content such as emails or support tickets, an attacker could craft a message that makes the agent answer wrongly or even invoke its actions. Its advice is to enable only agents that use trusted sources, and not to give an agent the ability to perform sensitive operations without careful human intervention. Admins can view, enable, block or remove agents and restrict who can share them.

What to do.

  • Before approving a third-party agent, read its own privacy policy: Microsoft’s protections stop at the edge of its service.
  • Keep any agent that reads email or tickets away from actions that send, pay or delete.
  • Admins: review the agent inventory in the Microsoft 365 admin center and restrict sharing to named groups.

Source for this section, read 23 September 2026: Data, privacy, and security considerations for extending Microsoft 365 Copilot.

What this means in plain English for SMB owners

Three honest takeaways:

  1. If you are already paying for Microsoft 365 Business and you can justify another NZ$34 a user a month, Microsoft 365 Copilot is the most enterprise-grade AI option in this database that does not require a custom enterprise sales process. The contractual defaults are strong. The tenant-isolation model is real. The integration with your existing identity and permissions is genuinely valuable.
  1. Before you turn it on, fix your SharePoint and OneDrive permissions. Every Microsoft 365 tenant we have seen has overshare problems that nobody discovered until Copilot started surfacing the documents in responses. Allow time and budget for a permissions audit. Microsoft's Restricted Search feature is the day-1 fix; permissions cleanup is the long-term fix.
  1. EchoLeak is the canary in the coal mine. A nine-point-three-severity vulnerability that exfiltrated enterprise data with zero clicks is not a one-off. The broader class of indirect prompt injection vulnerabilities affects every AI assistant that reads user data — Microsoft 365 Copilot, Workspace Gemini, Notion AI, Slack AI, ZoomMate, all of them. Microsoft has invested heavily in prompt-injection mitigations (Microsoft Purview DLP can detect injection patterns, Defender for Cloud Apps monitors for suspicious prompts) but the structural problem is unsolved. Plan for the next EchoLeak.

Sources

  • Microsoft Copilot for individuals: your data, privacy, and responsible AI (governs the CURRENT app and all web use): https://support.microsoft.com/en-us/privacy/microsoft-copilot/overview (verified 2026-08-22)
  • Microsoft: Copilot for individuals, your activity history (carries the no-training statement): https://support.microsoft.com/en-us/privacy/microsoft-copilot/activity-history (verified 2026-08-22)
  • Microsoft: Copilot for individuals, your privacy controls and choices: https://support.microsoft.com/en-us/privacy/microsoft-copilot/privacy-controls (verified 2026-08-22)
  • Note: the Microsoft Privacy FAQ listed next now governs the LEGACY Copilot app only. Microsoft added that scope banner on 18 August 2026.
  • Microsoft Privacy FAQ for Copilot: https://support.microsoft.com/en-us/topic/privacy-faq-for-microsoft-copilot-27b3a435-8dc9-4b55-9a4b-58eeb9647a7f (verified 2026-05-22)
  • Microsoft Learn: Enterprise data protection in Microsoft 365 Copilot: https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection (verified 2026-05-22)
  • Microsoft Learn: Data, Privacy, and Security for Microsoft 365 Copilot: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy (March 2026)
  • Microsoft Learn: Copilot Chat Privacy and Protections: https://learn.microsoft.com/en-us/copilot/privacy-and-protections (March 2026)
  • Microsoft Q&A: Copilot Free vs Pro data privacy distinction (May 2025)
  • EPC Group: Microsoft 365 Copilot Security & Data Protection Guide (April 2026)
  • Avantiico: Is M365 Copilot safe for businesses (March 2026)
  • Aim Security: Aim Labs EchoLeak Microsoft 365 Copilot Vulnerability disclosure (June 2025)
  • Information Security Media Group: Copilot AI Bug Could Leak Sensitive Data (2025-06-16)
  • CovertSwarm: EchoLeak analysis (July 2025)
  • Sentra: EchoLeak (CVE-2025-32711) — what the Copilot prompt injection vulnerability means (May 2026)
  • Rescana: EchoLeak in-depth analysis (June 2025)
  • Beyond Innovation Substack: No Clicks, No Trace, Still Out (2025)
  • AAAI paper: EchoLeak first real-world zero-click prompt injection exploit
  • AICreative blog: Microsoft Copilot Pro features update (January 2026)
  • Microsoft New Zealand store: compare Microsoft 365 plans (read 24 October 2026)
  • Microsoft New Zealand: Microsoft 365 Copilot Business pricing (read 24 October 2026)
  • Techpartner.news: Microsoft launches 365 Premium with Copilot (2 October 2025; Copilot Pro withdrawn for new subscribers)
  • CVE-2025-32711 record (MITRE): CVSS 3.1 score 9.3, published 11 June 2025 (read 24 October 2026)

Related on AI Leakage

Compare similar tools: Microsoft Copilot is one of 6 tools in AI chat assistants compared, which sets out each one’s rating and what it does with your data, side by side.