---
title: "Microsoft 365 Copilot (Microsoft)"
url: "https://ailawframework.com/software/microsoft-365-copilot"
type: "software_profile"
site: "AI Law Framework"
id: "microsoft-365-copilot"
vendor: "Microsoft"
category: "General-purpose"
segment: "General-purpose assistants"
confidence: "high"
last_reviewed: "2026-09-20"
---

# Microsoft 365 Copilot (Microsoft)

> Assistant inside Word, Outlook and Teams that grounds on Microsoft Graph. Optional Legal Agent for Word. Third-party models and web search change the risk profile and must be configured off if not wanted.

Canonical page: https://ailawframework.com/software/microsoft-365-copilot  
Last reviewed: 2026-09-20

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Organisational Microsoft 365 Copilot (USD 30/user/month) and Copilot Chat on eligible Entra tenants. Optional Legal Agent for Word, Copilot Studio agents, Anthropic/OpenAI model routes. Consumer Copilot is out of scope.

## Capabilities

- Document summarisation
- Contract drafting
- Contract review and redlining
- Knowledge search
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, United States, European Union / EEA, United Kingdom, Multiple specified locations |
| Australian region | On request |
| Model providers | Microsoft, Anthropic (optional subprocessor), OpenAI (optional subprocessor) |
| Assurance | ISO 27001, ISO/IEC 42001, ISO 27018, HIPAA, GDPR |
| Training on customer content | No |
| Retention | Prompts and responses stored as Copilot activity history aligned with Microsoft 365 content commitments; exact tenant retention is a Purview setting. |
| Integrations | Microsoft Graph, SharePoint, OneDrive, Teams, Purview, iManage (via connectors if licensed) |
| Legal content coverage | Grounds on the tenant’s Microsoft 365 content. Not a licensed Australian case-law service. Legal Agent is a Word workflow, not a citator. |
| Pricing | Published per-user Copilot add-on. Copilot Chat included with eligible Microsoft 365. Agents and Studio capacity metered separately. Annual auto-renewal. |
| Australian presence | Yes. Microsoft 365 AU datacentres and ADR exist; Copilot query processing for non-EU tenants may still leave Australia unless geo commitments are confirmed. |
| Website | https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan in scope | Public claim only | This profile covers Microsoft 365 Copilot for organisations (USD 30 per user per month, annual, auto-renews) plus Copilot Chat (included with eligible Microsoft 365 Entra subscriptions). Legal Agent for Word was announced 30 Apr 2026. Copilot Studio agents and metered connectors are extra. Consumer Copilot and Copilot Studio as a standalone product need separate review. | Confirm whether we are licensing Microsoft 365 Copilot, Chat-only, Legal Agent for Word, and which Copilot Studio agents. | [Microsoft 365 Copilot enterprise pricing](https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise); [Artificial Lawyer — Legal Agent for Word (30 Apr 2026)](https://www.artificiallawyer.com/2026/04/30/microsoft-launches-its-own-legal-agent-for-word/); [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Deployment | Public claim only | Runs inside Microsoft 365 (Word, Outlook, Teams, Excel, PowerPoint). Copilot is a covered workload in Microsoft data-residency commitments (from 1 Mar 2024). Advanced Data Residency and Multi-Geo include Copilot. Customers outside the EU may have queries processed in the US, EU or other regions. Anthropic-hosted models are excluded from the EU Data Boundary. | What is our Microsoft 365 geo, is ADR/Multi-Geo in place, and will Anthropic or OpenAI model routes be enabled? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Data residency for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-service-copilot?view=o365-worldwide); [Anthropic models in Microsoft Online Services](https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor) |
| Legal Agent and grounding | Public claim only | Legal Agent in Word is described as generating redlines and reviewing counterparty changes with structured legal workflow. Copilot grounds on Microsoft Graph content the user can already access. It is not a licensed Australian primary-law research product. | Is Legal Agent for Word in our SKU, and does it cite Graph documents versus the model’s general knowledge? | [Artificial Lawyer — Legal Agent for Word (30 Apr 2026)](https://www.artificiallawyer.com/2026/04/30/microsoft-launches-its-own-legal-agent-for-word/); [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Australia | Public claim only | Microsoft has an Australian commercial presence and AU datacentres for Microsoft 365. Copilot query processing for non-EU customers may still leave Australia. Confirm ADR for our tenant. | Will Copilot prompts and grounding data stay in Australia for our tenant, including any Anthropic/OpenAI route? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Data residency for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-service-copilot?view=o365-worldwide) |
| Pricing | Public claim only | Published USD 30 per user per month, paid yearly, annual subscription that auto-renews. Requires a qualifying Microsoft 365 licence. Copilot Chat is included at no extra seat cost for eligible Entra users. Agents require Azure or Copilot Studio capacity packs. | Quote our user count, qualifying M365 SKU, agent metering, and auto-renewal notice window. | [Microsoft 365 Copilot enterprise pricing](https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise) |
| Word, Outlook, Graph, Entra | Public claim only | Native in Word, Outlook, Teams, Excel, PowerPoint. Uses Microsoft Graph with existing permissions. Entra identity, Conditional Access and Purview sensitivity labels apply. Overshared Graph content is still visible to Copilot. | Demonstrate permission inheritance, label honouring, and that overshared sites are remediable before rollout. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Support | Not confirmed | Microsoft Unified/Premier support is typically contractual via the Microsoft customer agreement. This review did not inspect our specific support SKU. | What severity response times and Australian-hours coverage apply to Copilot incidents on our agreement? | [Microsoft Products and Services DPA](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) |
| Quality | Public claim only | Microsoft documents grounding citations in stored interaction history and tells users to review and fact-check. No independent Australian-law hallucination benchmark for Copilot or Legal Agent was published on the pages reviewed. | Supply error rates for Legal Agent redlines on our document types, including Australian-style agreements. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Artificial Lawyer — Legal Agent for Word (30 Apr 2026)](https://www.artificiallawyer.com/2026/04/30/microsoft-launches-its-own-legal-agent-for-word/) |
| Task fit | Not confirmed | Strong fit for summarising Graph-accessible mail and documents and for Word drafting with human review. Web-grounded Copilot Chat is a different risk. Legal Agent targets contract redlining. Court documents, affidavits and Australian authorities remain lawyer-led. | Which tasks will use Graph-only Copilot versus web-enabled Chat versus Legal Agent? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Artificial Lawyer — Legal Agent for Word (30 Apr 2026)](https://www.artificiallawyer.com/2026/04/30/microsoft-launches-its-own-legal-agent-for-word/); [Microsoft 365 Copilot enterprise pricing](https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise) |
| Client-facing | Not confirmed | Copilot is an internal Microsoft 365 assistant. It does not present as a lawyer to clients unless the firm pastes output into client communications. No AU client-disclosure template was found. | How will we disclose Copilot use to clients where outside-counsel guidelines require it? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Model providers | Public claim only | Microsoft Copilot uses Microsoft-hosted models. Admins can enable Anthropic and OpenAI models as subprocessors; additional terms apply. Anthropic routes are currently excluded from the EU Data Boundary. | Which model providers are enabled in our tenant, and can we restrict Copilot to Microsoft-hosted models only? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Anthropic models in Microsoft Online Services](https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor) |
| Subprocessors | Public claim only | Microsoft Online Services subprocessors plus optional Anthropic and OpenAI AI subprocessors. Web search (Bing) has separate controller terms outside the Microsoft DPA and EU Data Boundary (as described in Copilot web-search documentation referenced from the privacy article). | Provide the current Copilot-specific subprocessor list and confirm Bing/Anthropic/OpenAI on or off. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Anthropic models in Microsoft Online Services](https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor); [Microsoft Products and Services DPA](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) |
| Training | Public claim only | Prompts, responses and Graph data are not used to train foundation LLMs used by Microsoft Copilot. Same statement for connected-experience personal data. | Confirm this no-training commitment is in our Microsoft Product Terms for Copilot, including optional Anthropic/OpenAI routes. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Feedback | Public claim only | Optional customer feedback may be used to improve Copilot like other Microsoft 365 services, but Microsoft states it is not used to train foundation LLMs. Admins can manage feedback. | Disable optional Copilot feedback for our tenant if we do not want interaction content leaving the productivity-improvement channel. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Retention | Public claim only | Prompts and responses are stored as Copilot activity history, encrypted, aligned with other Microsoft 365 content commitments. Retention can be managed with Microsoft 365 retention policies; exact default period should be confirmed in Purview. | What is the default Copilot activity-history retention in our tenant and can we set 30 days? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Deletion | Not confirmed | Microsoft 365 DPA and Product Terms govern deletion on exit. This review did not extract a Copilot-specific certified-deletion clause from the DPA viewer scrape. | Confirm Copilot prompts, responses, embeddings and agent logs are deleted with our Microsoft 365 data on instruction and on tenant offboarding. | [Microsoft Products and Services DPA](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA); [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Vendor access | Public claim only | Microsoft describes physical security, background screening and layered encryption. Support access follows Microsoft 365 Online Services practices (Customer Lockbox available on eligible SKUs — confirm if purchased). | Is Customer Lockbox in our SKU for Copilot-related support access? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Microsoft Products and Services DPA](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) |
| Identity | Public claim only | Entra ID, Conditional Access, MFA, sensitivity labels and usage rights. Agents may be blocked from encrypted content depending on usage rights. | Require compliant devices and MFA, and show that a disabled Entra user loses Copilot immediately. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Encryption | Public claim only | Service-side encryption at rest and in transit (BitLocker, per-file encryption, TLS, IPsec). Purview labels honoured. Customer Key is a Microsoft 365 add-on — confirm Copilot coverage. | Does Customer Key / Double Key Encryption cover Copilot interaction stores? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Assurance | Public claim only | Microsoft documents GDPR, ISO 27001, HIPAA and ISO/IEC 42001 for Copilot. SOC reports are available under NDA via Microsoft compliance portal. Reports not inspected here. | Provide current SOC 2 / ISO 27001 / ISO 42001 scope statements covering Microsoft 365 Copilot and Legal Agent. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Contract | Public claim only | Microsoft Customer Agreement / Enterprise Agreement plus Products and Services DPA. Copilot is an Online Service under those terms. Exact liability cap and forum follow the firm’s Microsoft agreement, not a Copilot-specific MSA. | Confirm Copilot is listed as an Online Service on our DPA and whether web search is excluded. | [Microsoft Products and Services DPA](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA); [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Transfers | Public claim only | ADR/Multi-Geo and EU Data Boundary can apply. Non-EU queries may be processed in US/EU/other regions. Anthropic models excluded from EU Data Boundary. Bing web queries can leave the DPA boundary. | Map APP 8 for Graph grounding, Copilot processing, Anthropic/OpenAI routes and Bing. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Data residency for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-service-copilot?view=o365-worldwide); [Anthropic models in Microsoft Online Services](https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor) |
| Incidents | Not confirmed | Microsoft Online Services incident process applies. The DPA viewer scrape did not yield a readable 72-hour clause in this review; inspect the signed DPA. | Confirm Copilot incidents are notified under our Microsoft DPA with NDB-usable content. | [Microsoft Products and Services DPA](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) |
| Changes | Public claim only | Microsoft may add model providers and agents. Legal Agent launched Apr 2026. Annual auto-renewal on the published Copilot plan. Admins can disable third-party models. | What notice before a new model provider is enabled by default in our tenant? | [Microsoft 365 Copilot enterprise pricing](https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise); [Anthropic models in Microsoft Online Services](https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor); [Artificial Lawyer — Legal Agent for Word (30 Apr 2026)](https://www.artificiallawyer.com/2026/04/30/microsoft-launches-its-own-legal-agent-for-word/) |
| Exit | Not confirmed | Microsoft 365 offboarding and data export tools should include Copilot activity history if it is stored as customer content. Confirm with a trial export. | Show export of Copilot activity history and deletion after we remove the Copilot add-on. | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Microsoft Products and Services DPA](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) |
| Connectors and agents | Public claim only | Graph is the primary connector. Copilot Studio connectors and agents are metered. Admins control agent use. Encrypted content may block agents. | List enabled agents and connectors and confirm unused ones are off. | [Microsoft 365 Copilot enterprise pricing](https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise); [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |
| Web search | Public claim only | Copilot Chat can use web grounding. Microsoft documents that Bing-generated web queries have separate treatment. Disable web for privileged workspaces if required. | Can we disable web search tenant-wide for Copilot while leaving Graph grounding on? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy); [Microsoft 365 Copilot enterprise pricing](https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise) |
| Agents | Not confirmed | Copilot Studio and Word Legal Agent can edit documents. Admins manage who can use agents. No independent kill-switch beyond Entra disable and agent admin was documented. | Do Legal Agent redlines require explicit accept-as-tracked-changes, and how do we stop an in-flight agent? | [Artificial Lawyer — Legal Agent for Word (30 Apr 2026)](https://www.artificiallawyer.com/2026/04/30/microsoft-launches-its-own-legal-agent-for-word/); [Microsoft 365 Copilot enterprise pricing](https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise) |
| Oversight | Public claim only | Microsoft tells users to review, fact-check and adjust content. Activity history stores prompts, responses and citations. Admin Copilot reports exist. | Can we export Copilot usage and activity to our SIEM for supervision? | [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) |

## Notes

Signed Microsoft DPA notice period not extracted from the viewer scrape. Anthropic/OpenAI routes optional. Legal Agent availability in Australia not separately confirmed.

## Sources

- [Data, Privacy, and Security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) (checked 2026-09-20)
- [Microsoft 365 Copilot enterprise pricing](https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/enterprise) (checked 2026-09-20)
- [Data residency for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-service-copilot?view=o365-worldwide) (checked 2026-09-20)
- [Anthropic models in Microsoft Online Services](https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor) (checked 2026-09-20)
- [Artificial Lawyer — Legal Agent for Word (30 Apr 2026)](https://www.artificiallawyer.com/2026/04/30/microsoft-launches-its-own-legal-agent-for-word/) (checked 2026-09-20)
- [Microsoft Products and Services DPA](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) (checked 2026-09-20)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.