Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Microsoft's support page, labelled prerelease documentation and checked 2026-09-27, states the Legal Agent is available in Microsoft Copilot for Word desktop and is opened from the + button in the Copilot chat input. Access requires an active Microsoft Copilot licence, enrolment in the Frontier program (the page states the admin account must also be enrolled), and Word version 2604 or higher, with a restart of Word for the agent to appear. The page states the agent is not in the Microsoft Copilot Agent Store and can only be reached from Word.
Ask: Confirm on our Australian order form which Copilot licences carry Frontier enrolment, which users will have the Legal Agent, and whether the agent can be enabled for a named group only.
Release stage and preview terms
Public claim only
The support page states the feature is a preview, that Frontier previews are subject to the existing preview terms of the customer's agreements, and that availability and capabilities may change over time. The Product Terms Previews clause states previews are provided "AS-IS," "WITH ALL FAULTS," AND "AS AVAILABLE", are not included in the SLA for the corresponding Online Service unless separately agreed, may not be covered by customer support, and that Microsoft may change or discontinue previews at any time without notice and may choose not to make a preview generally available. Microsoft's Frontier admin page adds that HIPAA Business Associate Agreement coverage is not included for Frontier experiences.
Ask: How long is the Legal Agent expected to stay in preview, what written notice will we receive if it is withdrawn, and will you agree support and service levels for it while we use it on client matters?
Deployment model
Public claim only
The agent runs in a task pane inside Word on the desktop with processing in the Microsoft 365 Copilot service; no on-premises, private-cloud or self-hosted option is published for it. The Product Terms state that locally installed software may be used only with the Online Service, that the right to use it ends when the Online Service right ends, and that apps installed locally may collect diagnostic data about their use and performance which may be transmitted to Microsoft.
Ask: Is any part of the Legal Agent's processing performed on the device, and what diagnostic data does the Word client send to Microsoft when the agent is used on a client document?
Functions in scope
Public claim only
Microsoft documents three functions, checked 2026-09-27. Chat over the open document returns an answer with numbered clickable citations that highlight the passages relied on, for the whole document or a highlighted section. Editing produces redlines as tracked changes and optionally an explanatory comment, accepted with Accept or Accept with Comment; the page states the redlines are "tuned to resemble those of a legal professional". Review with Playbook takes a playbook as a .docx file from the computer or SharePoint, converts it into a stored reusable "skill" broken into topics with rules and example clauses that the user can edit, add to or remove, then streams a topic-by-topic report marked grey (not relevant), green (complies), light red (at least one change needed) or dark red (whole clauses to be added or removed), with suggested redlines and an Accept All option. The page states reviews can currently be run only from playbooks, not from templates or other documents.
Ask: Is the generated skill stored per user or per tenant, can we lock a firm-approved skill so fee earners cannot edit its rules, and where is the skill held?
Jurisdictions, legal content and Australian availability
Not confirmed
Nothing on the pages read states which jurisdiction's law or drafting conventions the agent's output is aligned to; the redlines are described only as "tuned to resemble those of a legal professional". No primary-law library or citator is part of the product: the agent works on the document open in Word and on the playbook the firm supplies. The Product Terms state that availability, functionality and language versions for each Online Service may vary by country and point to a regional availability list, which was not read; no page read states that the Legal Agent is available to Australian tenants.
Ask: Is the Legal Agent available to an Australian-provisioned tenant today, and has it been tested on Australian-law contracts and Australian drafting conventions?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately for a page or block telling AI models, assistants or crawlers how to describe the product, on 2026-09-27. Phase 2 found no such heading or block on the Legal Agent support page. In this phase the Frontier program page, the universal Online Services terms, the Privacy and Security Terms and the Microsoft Learn Copilot documentation read carried no heading or block addressing AI models, assistants or crawlers. No /ai-info or llms.txt path was sought: microsoft.com is too large for a site map to be useful inside the credit budget, so this check covers only the pages actually read.
Ask: Does Microsoft publish guidance or instructions for AI assistants and crawlers on how to describe Microsoft Copilot or the Legal Agent, and if so at what address?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
Microsoft publishes its own limitation on the support page: "The Legal Agent does not provide legal advice or professional determinations, and is not a substitute for the judgment of a qualified legal professional. AI-generated content may be inaccurate. Users are solely responsible for reviewing, verifying, and deciding whether to rely on any output before taking action." The Product Terms require use of Microsoft AI Services in accordance with the Acceptable Use Policy and the Microsoft Enterprise AI Services Code of Conduct, and place responsibility for complying with legal, regulatory and licensing requirements applicable to the customer's use on the customer. No client-notice or client-consent wording for law firms was found on the pages read.
Ask: What client notice does Microsoft consider necessary before client documents are processed by a preview agent, and will you confirm in writing that our existing Copilot data-protection commitments cover uploading a client contract and a firm playbook to the Legal Agent preview?
Foundation-model providers
Not confirmed
No model is named for the Legal Agent on any page read, and the support page does not identify the model, its version or where it runs. At platform level Microsoft publishes that it offers third-party AI models in Microsoft Copilot "such as Anthropic and OpenAI models", that an admin decides whether to use them and that additional terms may apply, and that it may also deploy other AI models for Copilot that are hosted and operated by Microsoft under the same contractual and data-protection commitments. Phase 2 recorded no named provider from the support page; that remains correct for the agent itself, and the platform-level providers are recorded here as the containing service's published providers, not as the agent's.
Ask: Name the model, model version and operating entity behind each Legal Agent function (chat, redlining, playbook-to-skill conversion, topic review), the region the inference runs in, and the notice we receive before any of them changes.
Subprocessors and AI providers
Public claim only
Microsoft publishes Anthropic and OpenAI as AI providers operating as Microsoft subprocessors for Copilot experiences, with a tenant control at Copilot > Settings > AI providers operating as Microsoft subprocessors that can be scoped to users or Microsoft Entra ID security groups and is stated to be enforced across Microsoft Copilot and Copilot Studio experiences. The same page states that models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary, and that a separate class of "Anthropic models with Data Retention" is off by default for all scenarios; if a tenant admin opts in, Anthropic acts as an independent processor under Anthropic's own commercial terms and data processing addendum rather than the Microsoft Product Terms and DPA, and Anthropic stores most inputs and outputs for up to 30 days, may retain content flagged by its trust and safety classifiers for up to two years and classification scores for up to seven years. The general Microsoft subprocessor list for Online Services was not read.
Ask: Provide the current subprocessor list that applies to the Legal Agent preview on our Australian tenant, naming each AI provider, its processing country, and confirm whether any Anthropic models with Data Retention can be reached from the agent while that setting is off.
Training on customer content
Public claim only
The Product Terms state under Microsoft Generative AI Services that "Microsoft Generative AI Services will not use Customer Data to train any generative AI foundation model, except pursuant to Customer's documented instructions", and that Output Content is Customer Data which Microsoft does not own. Microsoft's Copilot documentation repeats that prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs, including those used by Microsoft Copilot, and that the stored content of interactions is not used for that training. The documented-instructions carve-out is the exception on the face of the clause; the Privacy and Security Terms show that Microsoft uses exactly that mechanism elsewhere, instructing training on customer content for Microsoft Dragon Copilot.
Ask: Confirm in writing that no documented-instruction exception applies to our tenant, and that the no-training commitment covers the playbook we upload, the generated skill, the agent's redlines and any preview telemetry.
Feedback, evaluation and quality monitoring
Public claim only
The Product Terms Previews clause states that providing Feedback about preview services is voluntary and that by providing it the customer irrevocably and perpetually grants Microsoft and its affiliates a worldwide, non-exclusive, fully paid-up, royalty-free, transferable, sub-licensable licence to use and commercialise that Feedback without attribution. Microsoft's Copilot documentation states that optional customer feedback may be used to improve Microsoft Copilot but is not used to train the foundation LLMs, and that customers can manage feedback through admin controls. The Product Terms also state that as part of providing Microsoft AI Services, Microsoft may run automated classifiers and other automated evaluation systems to detect violations of the Acceptable Use Policy and the Code of Conduct.
Ask: Which in-product actions in the Legal Agent count as Feedback under the Previews clause, does a thumbs-down on a redline transmit the document text to Microsoft, and can feedback be switched off tenant-wide for this agent?
Retention of prompts, outputs, playbooks and skills
Public claim only
Microsoft publishes that it stores the "content of interactions" with Copilot, being the prompt and the response including citations to the information used to ground it, that this is the user's Copilot activity history, that it is processed and stored in alignment with the contractual commitments covering the organisation's other Microsoft 365 content, and that it is encrypted while stored. Microsoft's compliance documentation states Copilot interactions are stored in the user's Exchange Online mailbox with metadata for auditing and compliance, and that Microsoft Purview retention policies manage retention with a configurable period. The Microsoft 365 Data Handling Standard sets maximum retention after deletion of at most 30 days for Customer Content in an active-deletion scenario and at most 180 days in a passive-deletion scenario. No retention period is published for an uploaded playbook or a generated skill.
Ask: State the default and configurable retention for Legal Agent prompts, document extracts, uploaded playbooks, generated skills and review reports on our tenant, and whether each is inside the Purview retention and eDiscovery boundary.
Deletion and certified erasure
Public claim only
Microsoft publishes that users can delete their Copilot activity history, including prompts and responses, from the My Account portal, and that after the retention period data moves to the SubstrateHolds folder and is then permanently deleted unless subject to a legal hold or other retention policy. On subscription end Microsoft retains customer data in a limited-function account for 90 days to allow extraction, then deletes it, and no more than 180 days after a subscription ends disables the account and deletes all data, rendering it commercially unrecoverable; expedited de-provisioning can be requested, with deletion of all user data three days after the administrator enters a Microsoft-supplied lockout code. Device destruction follows NIST SP 800-88. No deletion statement specific to a Frontier preview store or to generated skills was found.
Ask: Will you certify deletion of Legal Agent prompts, uploaded playbooks, generated skills and review reports on request, including from any preview-only store and from any AI subprocessor, and within what period?
Vendor and verifier access to content
Public claim only
Microsoft's Copilot documentation states that while abuse monitoring, which includes human review of content, is available in Azure OpenAI, Microsoft Copilot services have opted out of it. The Product Terms state Microsoft may run automated classifiers and other automated evaluation systems to detect Acceptable Use Policy and Code of Conduct violations. Nothing on the pages read addresses whether Microsoft engineering or product staff can read a Frontier preview's prompts, documents, playbooks or generated skills for debugging or evaluation; the Data Protection Addendum, which sets out Microsoft's personnel and access commitments, was not read.
Ask: For the Legal Agent preview, can Microsoft engineering or the product team read our prompts, document text, playbooks or generated skills, from which countries, under what approval, and is that access logged and visible to us through Customer Lockbox?
Access control, admin controls and audit
Public claim only
Microsoft publishes that Copilot surfaces only organisational data to which the individual user has at least view permissions, that Microsoft Entra ID governs access and that Copilot does not override existing access controls. Admin controls published for the surrounding platform are Frontier enrolment in the Microsoft 365 admin center (including for the admin account), AI provider access scoped to users or security groups, and Copilot Credit spending policies with user and group scoping. The support page names no per-user or per-group control for the Legal Agent itself and no control over who can create or edit a stored skill.
Ask: Can Legal Agent access be limited to a named security group, are generated skills private to the creating user or visible tenant-wide, and can we export a complete audit log of Legal Agent prompts and accepted redlines?
Encryption in transit and at rest
Public claim only
The Privacy and Security Terms state that each Core Online Service complies with the listed control standards and implements and maintains the security measures set out in Appendix A of the Data Protection Addendum for the protection of Customer Data. Microsoft's Copilot documentation states the stored content of interactions is encrypted while it is stored. Appendix A of the DPA was not read, so no algorithm, TLS version or key-management position is recorded, and no customer-managed-key position is established for the Legal Agent.
Ask: Confirm encryption in transit and at rest for Legal Agent prompts, uploaded playbooks, generated skills and review reports, name the algorithms and key management, and state whether Microsoft Purview Customer Key applies to them.
Independent security and AI assurance
Public claim only
The Privacy and Security Terms table records SSAE 18 SOC 1 Type II and SSAE 18 SOC 2 Type II for Office 365 Services, and the definition of Office 365 Services in the same document lists Microsoft 365 Copilot. Microsoft publishes a Microsoft 365 ISO 27001:2022 certificate (2024-2027) and states that Microsoft AI systems undergo regular independent third-party audits for ISO/IEC 42001 compliance, with certificates and audit reports on the Service Trust Portal, which also publishes an Australia IRAP section. The condition is on the face of the same document: "The term 'Core Online Services' applies only to the services in the table below, excluding any Previews", and Microsoft's support page states the Legal Agent is a preview feature, so whether these attestations extend to it is not established.
Ask: Provide the SOC 2 Type II and ISO/IEC 42001 report sections that cover the Legal Agent preview, or confirm in writing that a preview feature sits outside the audited scope, and provide the current IRAP assessment covering Copilot in the Australia geo.
Contract, DPA and Australian contracting entity
Public claim only
Microsoft's Frontier admin page states that Frontier experiences are governed by the customer's existing agreements including the Product Terms and the Microsoft Data Protection Addendum, that they are preview features allowing personal data processing as described in the DPA, and that they may be subject to additional Frontier-specific preview terms where applicable. Both the universal Online Services terms and the Privacy and Security Terms state that the DPA prevails over any conflicting term in the customer's licensing agreement. The Australian contracting entity and its ACN or ABN are not stated in any document read; the Product Terms name no contracting entity. Microsoft's partner documentation lists Australia-specific amendment templates, including a Government Customer Applicable Law and Venue amendment for Australia (February 2024) and Australia CPS 230 operational risk management amendments for customers under the Australian Prudential Regulation Authority standard.
Ask: Name the Microsoft contracting entity and its ACN or ABN for our Australian Copilot subscription, state the governing law and venue that will apply to us, and provide any Frontier-specific preview terms and the current DPA version.
Cross-border transfers, APP 8 and Australian residency
Public claim only
The Privacy and Security Terms commit that where a customer provisions its tenant in Australia (among other named geographies) Microsoft will store listed Customer Data at rest only within that geo, including "any stored content of interactions with Microsoft 365 Copilot or Microsoft 365 Copilot Chat" to the extent not already covered. Microsoft's data residency documentation records Microsoft 365 Copilot as added to the Product Terms commitment on 1 March 2024 and lists Australia as a geography with Product Terms, Multi-Geo and Advanced Data Residency options. Two published limits apply. First, the same Product Terms section states the Core Online Services definition excludes any Previews, and the Legal Agent is documented as a preview. Second, storage is not inference: Microsoft publishes that Copilot calls to the LLM are routed to the closest data centres in the region and can call into other regions where capacity is available, and that customers outside the EU may have their queries processed in the US, the EU or other regions. Microsoft also publishes that Anthropic models operating as a subprocessor are currently excluded from the EU Data Boundary.
Ask: For an Australian-provisioned tenant, list every country in which Legal Agent prompts, document text, playbooks, generated skills and backups are processed and stored, state whether the Australian at-rest commitment covers preview features, and say whether inference in Australia only is available.
Incident notification and history
Public claim only
Microsoft publishes that whenever it becomes aware of a breach of security involving unauthorised loss, disclosure or modification of customer data it notifies affected customers within 72 hours as set out in the Data Protection Addendum, that the clock starts on the official security incident declaration, and that the notification describes the nature of the breach, approximate user impact and mitigation steps, with next steps and timelines where the investigation is incomplete. The customer must promptly notify Microsoft of an incident that could affect Microsoft, as defined in the DPA. No incident history involving Frontier preview features or the Legal Agent was found on the pages read, and no Australian Notifiable Data Breaches cooperation clause was read.
Ask: Confirm the 72-hour DPA notification applies to a Frontier preview feature, name who at our firm is notified and how, and state how you will assist an assessment under the Australian Notifiable Data Breaches scheme.
Change notice for models, terms and subprocessors
Public claim only
The Product Terms state that Microsoft may make commercially reasonable changes to each Online Service from time to time, that previews may be changed or discontinued at any time without notice, that Microsoft may provide information and notices electronically with notice given as of the date it is made available, that when Microsoft introduces new features it may make updates to the terms applying to them, and that on renewal or a new purchase the then-current terms apply and do not change during that subscription. Microsoft's Frontier admin page states Frontier experiences may be modified, suspended or discontinued. A recorded example of a change to model access is Microsoft's statement that the Anthropic independent processor setting was decommissioned on 1 May 2026, after which Anthropic models require enablement as a Microsoft subprocessor.
Ask: What written notice will we receive before the model behind the Legal Agent changes, before the agent leaves preview, is withdrawn or becomes chargeable, and before a new AI subprocessor becomes reachable from it?
Export and exit
Public claim only
The Product Terms state that for online services not renewed at the end of the term access continues for 30 days and may continue in successive one-month Extended Term periods, and that a customer will have 90 days to extract Customer Data from a disabled account, which cannot be reactivated. Microsoft's compliance documentation states that after a paid subscription ends customer data is kept in a limited-function account for 90 days to allow extraction and is deleted no more than 180 days after the subscription ends. For the interaction records, Microsoft publishes that admins can view and manage stored Copilot interactions using Content search or Microsoft Purview and, for Teams, the Teams Export APIs. No export path or file format is published for a generated skill or a Legal Agent review report.
Ask: How do we export generated skills, uploaded playbooks and Legal Agent review reports on exit, in what format, and will they be produced through Purview eDiscovery or only from within Word?
Connectors and third-party components
Not confirmed
The support page states a playbook can be added from the user's computer or from SharePoint and must be a .docx file, and that the agent is not in the Microsoft Copilot Agent Store and is reachable only from Word. Microsoft's Copilot documentation states that when using agents the customer should check the agent's own privacy statement and terms of use to determine how it will handle organisational data. The Product Terms state that third-party agent templates, instructions and code samples made available for use with Microsoft AI Services are Non-Microsoft Products subject to the separate terms for Non-Microsoft Products, and that separate privacy and security terms govern Non-Microsoft Products. No list of connectors or data sources reachable by the Legal Agent is published.
Ask: Can the Legal Agent reach any connector, MCP server, Copilot Studio agent or non-Microsoft component, and can we restrict its SharePoint access to one nominated playbook library?
Open-web search and grounding
Not confirmed
Nothing on the support page states whether the Legal Agent grounds any part of its answer on the open web; the documented inputs are the open document, a highlighted section and the uploaded playbook. At platform level Microsoft publishes that Copilot web grounding generates a search query from the prompt and sends it to the Bing search service, that those queries do not include user or tenant identifiers, and that administrators can exclude up to 1,000 sites from web grounding using a PowerShell script. The Product Terms state that where Bing is optionally available through an Online Service its use is governed by the Microsoft Services Agreement and Microsoft Privacy Statement, and that the Data Protection Addendum does not apply to use of Bing functionality as a connected service with an Online Service or component of one.
Ask: Does the Legal Agent send any query, document extract or playbook text to Bing or any other search service, and can web grounding be disabled for this agent specifically rather than for Copilot as a whole?
Agent actions and confirmation
Public claim only
The support page states the agent works out whether to give an answer or to generate edits, proposes redlines as tracked changes and may propose a comment, and that the user clicks Accept to insert the changes or Accept with Comment to include the commentary; an Accept All button inserts all of the agent's suggested edits at once. Reviews can currently be run only from a playbook-derived skill. No action outside the open document — saving, sending, filing or calling another service — is documented, and no policy control over Accept All is described.
Ask: Confirm the agent cannot alter, save, send or file a document without a user click, and whether Accept All can be disabled by tenant policy.
Human review before use
Public claim only
Microsoft's own statement on the support page is that users are solely responsible for reviewing, verifying and deciding whether to rely on any output before taking action, and that the Legal Agent does not provide legal advice or professional determinations. The documented flow puts review points in the product: the generated skill is presented for the user to check that rules were properly extracted and to edit, add or remove topics before the review runs; citations are clickable so the user can see the passages relied on; and each topic's suggested redline is accepted or dismissed individually, unless Accept All is used. No product control requires a nominated supervising practitioner to approve an accepted redline.
Ask: Is there any tenant setting that requires a named supervising practitioner to approve an accepted redline or a completed playbook review, or is that entirely a matter of firm process?
