AI tool privacy · Microsoft
Microsoft Copilot and your company’s data
By David Michaelson, MS Last checked October 23, 2026
The short answer
Microsoft 365 Copilot at work does not use your prompts, responses, or files to train its foundation models; the free personal Copilot app lets you opt out of model training and keeps conversations for 18 months by default.
Safer setup: Use Microsoft 365 Copilot signed in with your work account. On the personal Copilot app, opt out of model training and delete old conversations.
Plan by plan
Each answer comes from Microsoft’s own policy or help pages, with the link and the date we read it. Setting names are quoted exactly as Microsoft writes them.
We could not confirm 2 answers on Microsoft’s own pages. Those answers say so in plain words and link to the page we checked.
| Question | Copilot app, personal Microsoft account | Microsoft 365 Copilot (work account) |
|---|---|---|
| Trains on your data by default? | You can opt out. Microsoft says you control whether it can use your conversations to train its generative AI models, and you can opt out at any time. Read on October 23, 2026 Source: support.microsoft.com | No. Microsoft says prompts, responses, and data accessed through Microsoft Graph are not used to train its foundation models. Optional feedback may be used to improve Copilot, and admins can manage it. Read on October 23, 2026 Source: learn.microsoft.com |
| How long your data is kept | 18 months by default. Files you share are kept no longer than 18 months and then deleted automatically. Read on October 23, 2026 Source: support.microsoft.com | Prompts and responses are stored with your organization’s other Microsoft 365 content. Admins can set retention policies for Copilot chats in Microsoft Purview. Read on October 23, 2026 Source: learn.microsoft.com |
| Who can see it | Not described on the page we read. Page checked: support.microsoft.com, October 23, 2026 | Admins can view and manage stored prompts and responses with Content search or Microsoft Purview. Read on October 23, 2026 Source: learn.microsoft.com |
| Where data is stored | Not stated on the page we read. Page checked: support.microsoft.com, October 23, 2026 | For EU customers, Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, the EU, or other regions. Read on October 23, 2026 Source: learn.microsoft.com |
| How to delete | Delete one conversation, or your entire conversation history, at any time from your conversation history. Read on October 23, 2026 Source: support.microsoft.com | Each person can delete their Copilot activity history, including prompts and responses, in the My Account portal. Read on October 23, 2026 Source: learn.microsoft.com |
Safer setup, step by step
- In the personal Copilot app, opt out of use of your conversation activity for model training. Microsoft says you can do this at any time. Source: support.microsoft.com for this step
- Delete individual conversations, or your entire conversation history, when you no longer need them. Source: support.microsoft.com for this step
- For a team, have your admin set retention policies for Copilot chats in Microsoft Purview. Source: learn.microsoft.com for this step
What to write in your policy
Staff may use Copilot for work only while signed in with a company Microsoft 365 account. Customer data never goes into the personal Copilot app.
Building your own approved tools list? The SafeStart Handbook includes one, with company accounts and safer privacy settings.