Overview
Microsoft 365 Copilot is the paid AI layer bolted into Word, Excel, Outlook, Teams and SharePoint. It is an add-on rather than a product you can buy on its own: it requires a qualifying Microsoft 365 base plan underneath it, and US list price sits at $30 per user per month on annual billing, with a Copilot Business tier reported at $21 per user for organisations up to 300 seats (as of October 2026).
What is actually being bought is not a chatbot. Copilot indexes the tenant’s Microsoft Graph, so every mail, file, chat, meeting and calendar entry a given user can already open becomes retrievable in natural language by that user. The assistant is the thin part. The index is the product.
Microsoft has also widened the model supply underneath it. Its own privacy documentation now lists Anthropic models as a subprocessor for Copilot, and a German compliance guide dates that addition to 7 January 2026, which matters because it changes who processes the request and where.
What It Knows About You
Microsoft’s documentation states that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models behind Copilot, and that stored interaction history is encrypted at rest. The same commitment appears on the Copilot Chat privacy page. That is a specific written promise rather than a marketing line, and it is more than most products in this Index will say. It is the main reason this entry is a C and not a D.
The exposure sits elsewhere. Copilot interactions are written into a hidden folder in the user’s own Exchange mailbox. The user cannot open that folder and has no self-serve export, but administrators can search it with eDiscovery and govern it with Purview retention policies. Your employer can read what you asked Copilot. A conversation disappearing from your chat pane does not mean the retained copy went with it.
Diagnostic and telemetry data is a separate pile with its own clock. The Dutch SURF assessment, whose latest update is dated 27 May 2026, records that Microsoft retains certain diagnostic and telemetry data for up to 18 months. After Microsoft’s final response of 31 March 2026, SURF still rated two risks at medium and still advised Dutch educational and research institutions to be cautious.
Data residency is conditional rather than guaranteed. Microsoft’s page distinguishes EU traffic, which stays inside the EU Data Boundary, from worldwide traffic that can be sent to other regions for model processing, and it states that Anthropic models used as a subprocessor are currently excluded from the boundary. Bing web grounding is a further seam: for data processed by Bing, Microsoft acts as an independent controller rather than as your processor.
The Real Risks
One email was enough to make it exfiltrate internal data. EchoLeak, tracked as CVE-2025-32711 and reported by Aim Security, was rated 9.3 of 10 on CVSS. A crafted email, with no click from the recipient, caused Microsoft 365 Copilot to pull privileged internal content and route it to an attacker-controlled destination, proxied through a Microsoft Teams preview API that Copilot’s content security policy treated as allowed. It defeated Microsoft’s own cross-prompt injection classifier, the primary defence in the product, and got past link redaction using reference-style Markdown. Microsoft fixed it with a server-side patch requiring no customer action, and no exploitation in the wild has been confirmed. An arXiv case study describes it as the first zero-click prompt injection exploit in a production LLM system. The patch closed one CVE. It did not close the category, and every source on it says so.
It finds the permissions mistake nobody knew about. Copilot grants no new access. It answers from what the asking user could already open, which is precisely the problem in a tenant whose sharing has drifted for a decade. Microsoft publishes its own guidance on mitigating oversharing before rollout, on its Microsoft 365 Copilot blog, and that guidance is itself the admission: a typical tenant is not in a fit state for a natural-language search engine pointed at it. The named culprits are the “Everyone except external users” group applied to sites never meant to be company-wide, broken permission inheritance where a subfolder is more open than the library above it, and anonymous sharing links that never expire. Site-level permission reports can look clean while Copilot, which indexes at file level, surfaces the compensation spreadsheet underneath.
Verification eats part of the saving. The Australian government ran a whole-of-government trial and published its evaluation in October 2024, which remains the most useful independent read on what the product does to real work. Only about a third of participants used Copilot daily. Up to 7% reported that it added time to activities rather than saving it, and the report attributes that to unpredictability and missing contextual knowledge, with the time going into checking and editing output. Copilot in Excel and Outlook did not meet expectations. The trial explicitly did not benchmark accuracy, so the cheerful headline numbers from it, 61% agreeing their work quality improved and 86% wanting to keep access, are self-reported satisfaction rather than measured output.
Leaving is expensive by construction. Copilot’s usefulness is a direct function of how much of your organisation already lives in Microsoft Graph, so the product pays you to consolidate further into one vendor. Custom agents are built in Copilot Studio. The governance tooling you need to deploy it safely is Purview and SharePoint Advanced Management. The interaction record lives in Exchange, and there is no portable export of it: the Interaction Export API returns message IDs and metadata rather than conversation text, and the full-text route is a premium eDiscovery collection run by an administrator. A team that has rebuilt its drafting and retrieval habits on this has nowhere to take them.
Alternatives
- Copilot Chat, which Microsoft includes with many Microsoft 365 plans at no extra per-seat cost. You get web-grounded drafting without buying the Graph indexing, and its privacy page carries the same no-training commitment. This is the obvious first stop for anyone about to spend $30 a seat on a hunch.
- An assistant kept outside the tenant (Claude, ChatGPT Enterprise, Gemini Enterprise), so that model choice is not welded to where the organisation’s files live. You trade one vendor’s data terms for another’s, and you should read the second set as carefully as the first.
- EU-hosted or self-hosted models, for organisations whose actual blocker is residency rather than capability. Higher operating cost, and the evaluation work becomes yours.
- Fix the permissions and buy nothing yet. A meaningful share of the gains in the Australian trial were in search and summarisation, and a tenant with correct permissions and working enterprise search already delivers part of that. The cleanup is required before a Copilot rollout anyway, so doing it first costs nothing and may answer the question.
- Write the first draft yourself. The trial’s own finding was that output needed checking and that checking consumed some of the benefit. For short, high-stakes writing that arithmetic rarely works out.
Our Verdict
C, use with caution. Average risk 5.8 of 10, and the shape of those five numbers matters more than the letter.
Microsoft 365 Copilot does better than most of this Index on the question that usually settles it. It does not train foundation models on your content, it says so in documentation rather than in marketing copy, and the enterprise controls are genuine rather than aspirational: Purview retention, eDiscovery, tenant-level residency settings, admin reporting on oversharing. Privacy scores 5, which here is close to the top of the class.
The C comes from the other four. Lock-in at 8 is the highest number in this entry and the hardest to undo, because the product’s value and the depth of your dependency on Microsoft are the same quantity measured twice. Autonomy at 6 reflects a tool that writes the first version inside the application where you were going to form your own view, which is where automation bias does its work. Job threat at 6 is not speculative: summarising, drafting and information retrieval are what the trial found it absorbing, and those tasks are somebody’s paid job. Microsoft cut about 4,800 roles in July 2026 while its Chief People Officer said the eliminated roles were not being replaced by AI and, in the same breath, that AI is changing how work gets done.
What would move this rating. Downward: EU Data Boundary coverage extended to third-party models without per-tenant configuration, a shorter telemetry retention window, or a user-accessible export of interaction history. Upward: a regulator finding against the telemetry retention, a second EchoLeak-class exfiltration bug, or any evidence that the no-training commitment has exceptions nobody disclosed.