Microsoft AI services run on a contract that splits Customer Data, Prompt and Completion content, and product telemetry. This article maps the clauses, the gaps, and the seven privacy levers procurement carries to the EA.
Microsoft AI services run on top of three overlapping contracts. The Microsoft Customer Agreement (MCA) or Enterprise Agreement (EA), the Microsoft Online Services Terms (Product Terms), and the Microsoft Privacy and Data Protection Addendum (DPA). Every clause on AI data usage lives in one of these documents.
The 2025 and 2026 Product Terms versions added specific language on Copilot, Azure OpenAI Service, Azure AI Foundry, and Microsoft 365 Copilot Studio. The clauses split Customer Data, Prompt content, Completion content, and product telemetry into different commitments.
Read this alongside the Microsoft hub, the Copilot licensing guide, the Microsoft services page, and the Vendor Shield subscription.
The Microsoft Product Terms define a precise taxonomy of data types involved in AI services. Each category carries different processing, retention, and training commitments.
| Data type | Definition | Training commitment |
|---|---|---|
| Customer Data | Documents, emails, files, structured data customer provides | Not used to train foundation models |
| Prompts and Completions | User input and AI generated output for AI features | Treated as Customer Data under current Product Terms |
| Telemetry and Service Data | Operational metrics, error logs, usage counters | Used to operate and improve the service |
| Abuse Monitoring Data | Stored prompts for safety review | Retained for 30 days, not used for training |
| Customer Fine Tuning Data | Customer documents and examples used to fine tune a model | Used to train customer specific model, not foundation |
Microsoft has stated and contracted that Customer Data is not used to train foundation models. The clause sits in the Product Terms and the DPA.
Prompts (user input) and Completions (AI generated output) are the heart of every AI service interaction. Microsoft's contract treatment has evolved through multiple Product Terms versions in 2024 and 2025.
The 2024 EU Data Boundary commitment and the 2025 expansion to additional regions changed the residency conversation for European buyers.
| Option | Coverage | Applicable services |
|---|---|---|
| EU Data Boundary | Customer Data processed within EU and EFTA | M365, Dynamics 365, Azure, Power Platform |
| UK Data Boundary | Customer Data processed within UK | M365, Azure (subset) |
| Microsoft Cloud for Sovereignty | Sovereign control plane for regulated buyers | Azure, M365 (subset) |
| Azure OpenAI Service regional | Customer chooses Azure region for OpenAI inference | Azure OpenAI |
| Azure AI Foundry regional | Customer chooses region for model deployment | Azure AI Foundry |
A European financial services group pilots M365 Copilot for 5,000 seats and Azure OpenAI Service for 12 application teams. The regulator requires EU Data Boundary processing and Article 28 processor commitments on every data category.
The eight step checklist takes a Microsoft AI deployment from a tactical pilot to a contracted, privacy ready production.
No. Microsoft's Product Terms commit that Customer Data, including Prompts and Completions for Copilot and Azure OpenAI Service, is not used to train foundation models. The commitment sits in the Product Terms and the Data Protection Addendum.
Customers should verify the commitment in the version of Product Terms in force on the contract effective date, and track Product Terms updates quarterly.
Standard Azure OpenAI Service retains prompts for 30 days for abuse monitoring. The retention applies to all prompts, not just suspect ones. The data is used to detect abusive or harmful content, not to train models.
Enterprise customers can apply for a modified abuse monitoring posture with limited or no prompt retention, subject to Microsoft approval. The exception is common for regulated financial services, healthcare, and government workloads.
The EU Data Boundary commits Microsoft to process Customer Data within EU and EFTA regions for M365, Dynamics 365, Azure, and Power Platform. The 2024 launch covered Customer Data, and the 2025 expansion brought in service generated data and professional services data.
Buyers should confirm specific service coverage and named region inside the contract addendum, not just rely on the boundary commitment.
Microsoft offers an IP indemnity on the output of Commercial Copilot products under defined conditions. The commitment includes Microsoft defending the customer against third party IP infringement claims based on Copilot output, subject to scope and exclusions.
The scope and exclusions are detailed in the Product Terms. Buyers should pull the current scope and confirm it covers the planned Copilot deployment.
GitHub Copilot Business and Enterprise commit that customer code suggestions and customer code repositories are not used to train the underlying models. The commitment is similar to Azure OpenAI Service but lives in GitHub specific terms.
Buyers with strong code IP positions should confirm the scope in writing during the GitHub Copilot Enterprise contracting process and review the code suggestion filtering settings.
Redress runs Microsoft AI advisory inside the Vendor Shield subscription, the Software Spend Assessment, the Renewal Program, and on engagement basis where an AI rollout is in flight. Every engagement is led by a former Microsoft commercial professional on the buyer side.
The output is a data taxonomy map, a Product Terms version lock memo, an abuse monitoring exception application, a residency clause set, and a Customer Copyright scope memo.
Redress runs Microsoft AI advisory inside the Vendor Shield subscription, the Software Spend Assessment, the Renewal Program, and on engagement basis where an AI rollout is in flight.
Read the related Microsoft hub, the Microsoft services page, the Copilot licensing guide, the EA renewal playbook, the AI licensing guide, the Azure ELA negotiation guide, the M365 optimizer, the benchmarking page, the about us page, and the contact page.
Buyer side reference on the Microsoft EA renewal. AI privacy clauses, Copilot terms, MACC sizing, BYOL preservation, and the seven levers procurement carries to the table.
Independent. Buyer side. Written for CIOs, CFOs, privacy officers, and procurement leaders carrying a Microsoft Enterprise Agreement with AI in scope. No Microsoft kickback. No conflict on the table.
Open the white paper in your browser. Corporate email only.
Open the Paper →The Microsoft AI privacy contract is not one document. It is three documents stitched by reference. The buyer side wins by reading all three and locking the version of every one of them into the contract package.
We have run 500+ enterprise clients across 11 publishers. Every engagement starts with one conversation.
Product Terms version notes, residency clause patterns, abuse monitoring exception templates, Customer Copyright Commitment scope notes, and AI privacy lessons from every Microsoft engagement we run on the buyer side.
Once a month. Audit patterns, renewal benchmarks, vendor commercial signals across Oracle, Microsoft, SAP, Salesforce, IBM, Broadcom, AWS, Google Cloud, ServiceNow, Workday, Cisco, and the GenAI vendors. No follow up sales pressure.
Free providers (Gmail, Yahoo, Outlook) cannot subscribe. Work email only. Unsubscribe in one click.
