Skip to content

Legal Tech / Enterprise copilots used in firms

Microsoft 365 Copilot

Microsoft · HQ US · founded 1975 · Last checked 2026-09-03

Visit website

Last checked = the date we last re-opened the vendor's published pages. Facts are what the vendor documents, not what it claims in marketing.

LLM orchestration over Microsoft Graph content in Word, Excel, Outlook and Teams; add-on licence to Microsoft 365 with GCC/GCC-High/DoD variants; ISO 42001 in scope; EU Data Boundary for EU customers.

Category
Enterprise copilots used in firms · office productivity, chat, agents, Graph-grounded
Built for
Large firms, Mid-sized firms, In-house legal, Courts, Public sector
Model providers (disclosed)
Microsoft, OpenAI, Anthropic
Data residency options
EU, US
Pricing
per-seat · Microsoft 365 Copilot Business add-on ₹1,745/user/month (promo ₹1,495.73 yearly); Business Standard with Copilot ₹1,955/user/month yearly; Business Premium with Copilot ₹2,660/user/month yearly
Markets
US, EU, UK
Last checked
03 Sept 2026

What the vendor documents

Recorded from the vendor's own trust, privacy and terms pages. "Not disclosed" means we found no public statement, not that the control is absent.

No training on customer data
documented yessource
SOC 2
documented yessource
ISO 27001
documented yessource
ISO 42001
documented yessource
Zero retention with model providers
not disclosedsource
DPA offered
documented yessource
Private deployment
documented nosource

What the public documentation states

Microsoft Learn describes Microsoft 365 Copilot, now named Microsoft Copilot, as a processing and orchestration engine that coordinates LLMs, Microsoft Graph content and Microsoft 365 apps such as Word and PowerPoint. The OpenAI sub-processor article dated 24 July 2026 names OpenAI operated models; the Anthropic article dated 2 September 2026 says Anthropic does not use retained data for model training without express permission and may retain some data up to 30 days. The Anthropic article also says Anthropic models are excluded from the EU Data Boundary, while the privacy article updated 18 August 2026 states prompts, responses and Graph data are not used to train foundation LLMs, admins can set retention policies in Purview, and EU traffic stays within the EU Data Boundary. It lists ISO 27001, ISO 42001 and HIPAA; SOC 2 was not found in the checked Copilot pages. Pricing is published per user, with one-month trial wording, annual subscription language and a 300-user business-plan cap. The audit found no legal-specific accuracy claim or method.

In the vendor's words

“Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs”
Microsoft Learn, updated 18 August 2026
“EU traffic stays within the EU Data Boundary”
Microsoft Learn, updated 18 August 2026
“OpenAI operated models”
Microsoft Learn, dated 24 July 2026
“offers zero data retention”
Microsoft Learn, dated 24 July 2026

Not disclosed on public pages

"Not disclosed" records that no public statement was found where we looked, on the date shown. It does not assert that the control, term or figure is absent.

Not published on pages we read on 2026-09-06: legal-specific accuracy claim, accuracy method, terms last-updated date, private-deployment option and a SOC 2 statement in the checked Copilot pages. Several Microsoft.com licensing and pricing pages returned 403 to our fetch. Procurement and DPIA records normally document those items to assess client confidentiality, GDPR Art. 28 processor terms, retention and residency controls, and lawyer supervision for general-purpose AI output.

Questions to put to the vendor

  1. For OpenAI operated models and Anthropic models, which prompts or files leave the tenant boundary and which regions are used?
  2. How does the Anthropic exclusion from the EU Data Boundary apply to EU/EFTA and UK legal users?
  3. Which SOC reports in the Service Trust Portal are scoped to Microsoft Copilot?
  4. Can Purview retention policies enforce matter-specific deletion dates for Copilot interaction history?
  5. What legal-domain accuracy testing has Microsoft performed for Copilot responses?

Accuracy evidence

Related incidents

No incidents are recorded for this tool as of 2026-09-03.

Ownership · Public company (NASDAQ: MSFT). Copilot is opted out of Azure OpenAI abuse-monitoring human review; interaction history retained in tenant under Purview controls. Anthropic models currently excluded from the EU Data Boundary.

News and analysis about Microsoft Copilot →

Sources

Report an issue with this record →

Cite this record

SafeLegalAI Legal Tech Tools, "Microsoft 365 Copilot", safelegalai.com/tools/microsoft-365-copilot (last checked 2026-09-03, accessed 2026-10-07). Data: CC BY 4.0.

Documented facts, side by side

Facts from both vendors' pages in one table; never a ranking. All comparisons.

Also in Enterprise copilots used in firms

SafeLegalAI is a research publication, not a law firm. Nothing here is legal advice, and no lawyer–client relationship arises from reading it. Rules change; always check the official document linked on each record and take advice on your own situation. Researched and drafted with AI assistance; verified against primary sources and edited by SafeLegalAI. The linked official documents are the record — our summaries are not the law and are not legal advice.

Vendor, product, court and regulator names and logos are the property of their respective owners and are used solely to identify the product, body or document referred to; SafeLegalAI claims no rights in them. SafeLegalAI is not affiliated with, endorsed by, sponsored by or approved by any listed vendor, except where a record is labelled an affiliated product. Facts are recorded from vendors' published pages on the date shown; "not disclosed" means not found on the pages read, not that the vendor lacks it. No ranking, rating, review, recommendation or warranty is implied. Mark owners who prefer a text-only reference, and vendors seeking a correction, may write to the report page. Trade mark and quotation policy.