Copilot signed in with your work or school account comes with enterprise data protection: your firm's contract with Microsoft covers prompts and responses, and they are not used to train foundation models. Copilot signed in with a personal Microsoft account falls under consumer terms between you and Microsoft, and client documents do not belong there. At work, the more common problem is oversharing: Copilot can find any file you already have access to, including files that were shared too widely.
Two Copilots with one name
As of October 2026, the work product formerly called Microsoft 365 Copilot is named Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat. The consumer app for personal accounts is also called Microsoft Copilot. So the name does not tell you which one you have in front of you; the account you are signed in with does.
| Work or school account (Microsoft Entra ID) | Personal Microsoft account | |
|---|---|---|
| Terms | Your organization's Data Protection Addendum and Product Terms; Microsoft acts as a data processor | Microsoft Services Agreement, Copilot Terms of Use and Microsoft Privacy Statement |
| Training on your prompts | Not used to train foundation models | Depends on the app version and your settings (see below) |
| Who can see the history | Logged in your organization's Microsoft 365; IT can search and audit it | Your personal account; your firm has no access |
| Firm's labels, retention, DLP | Apply | Do not apply |
For the personal app, Microsoft's pages differ by version. For the older app, the privacy FAQ says conversations, including uploaded files, can be used for model training unless you opt out, and are kept for 18 months by default. For the app version released on August 18, 2026, Microsoft's activity history page says prompts, responses and file contents are not used to train foundation models. Either way, the contract is between you and Microsoft, not between your firm and Microsoft. Your firm's confidentiality duties to its clients are not part of it.
How to tell which one you are using
- Copilot Chat shows a green shield at the top, next to the New Chat button, when enterprise data protection applies. No shield: do not paste client material.
- Click your profile icon. You should see your work email address, not a personal Outlook.com, Hotmail or Gmail address.
- Edge can keep a work profile and a personal profile open at the same time. Copilot in the sidebar uses the account of the profile it runs in.
What Microsoft commits to for work accounts
Microsoft's documentation for enterprise data protection and data, privacy and security for Microsoft Copilot says:
- Prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.
- Prompts and responses are processed within the Microsoft 365 service boundary and covered by the same terms as the firm's email in Exchange and files in SharePoint.
- Copilot shows a user only the data that user can already open. Files encrypted with a sensitivity label need the user's VIEW and EXTRACT rights before Copilot can use them, and new content made from labeled files inherits the label where supported, according to the data protection architecture page.
- Prompts and responses are logged. Admins can find them with audit and eDiscovery tools and set retention policies for them. Files you upload to Copilot Chat are stored in your OneDrive.
Two exceptions are worth knowing. Web searches go to Bing as a few words generated from your prompt, without user or tenant identifiers, and Bing handles them under its own terms, with Microsoft as an independent data controller. And for EU firms: the EU Data Boundary does not cover web search queries, and as of October 2026 Microsoft says Anthropic models available in Copilot are excluded from it too.
These commitments describe how Microsoft handles the data. They do not decide whether you may send a given client's documents to an AI service in the first place. That is up to the client agreement, your professional rules and your firm's policy.
The real risk at work: oversharing
Copilot does not get new access rights. It runs in the security context of the user who asks. The problem is access that users already have and never noticed.
Think of a folder of a client's due diligence files shared with "Everyone except external users" years ago, an HR site that anyone with the link can open, or a file from a partner's OneDrive sent to the whole team. Before Copilot, finding those files took effort. Now a colleague asks "what do we know about the Acme acquisition?" and Copilot can quote a document they did not know existed and should not have been able to open.
The same applies to email. With a Microsoft Copilot license, Copilot can work over your mailbox, calendar, chats and files. A summary of "everything about this client" pulls in whatever your account can reach.
What IT can do about it
Microsoft documents several controls for this. Which ones your firm has depends on its licenses.
| Control | What it does |
|---|---|
| Data access governance reports (SharePoint Advanced Management) | Find sites that are shared broadly or hold sensitive content |
| Restricted Content Discovery | Keeps a SharePoint site out of organization-wide search and Copilot answers while its permissions are reviewed. It does not change permissions: people with access can still open the files. |
| Restricted Access Control | Limits a SharePoint site or OneDrive to members of chosen groups. Others cannot open its files, even with an earlier share link, and Copilot does not show those files to them. |
| Sensitivity labels | Mark and encrypt confidential files; Copilot respects the usage rights |
| Purview DLP for Copilot | Stops Copilot from using files and emails with chosen labels, refuses prompts that contain chosen types of sensitive data, and can block web searches for such prompts |
One limit from Microsoft's DLP documentation: DLP checks the text typed into a prompt, but it cannot scan files uploaded directly into the prompt. A client file you attach is not checked.
Rules for handling client documents
- Look for the shield and your work account before you paste or upload anything. If either is missing, stop.
- Never put client files into Copilot with a personal account. That includes the Copilot app on a home PC and the Edge sidebar in a personal profile.
- Ask IT three questions. Is Copilot approved for client data? Which sensitivity labels should I apply to client files? Are web searches turned on for Copilot?
- Label client files. A label travels with the file, and Copilot output based on it inherits the label where supported.
- If Copilot shows you a file you should not see, report it. Tell the file owner or IT, and do not use what you read. It is a sign of a wider permissions problem.
- Check the client agreement. Some engagement letters, NDAs and client policies forbid sending identifying data to any AI service. Work Copilot is still an AI service. In that case, give it a safe copy in which names, addresses and account numbers are replaced with placeholders.
For the wider list of checks, see our client-confidentiality checklist for AI. If you also use ChatGPT, Claude or Gemini, our guide to AI data settings compares their business plans. If you are unsure whether a client's contract allows any of this, ask your firm's lawyer or data protection officer before you start.
Frequently asked questions
Can Copilot read my confidential emails?
Copilot with your work account can use the emails in your mailbox when you ask it something. It cannot open mailboxes you have no access to. Your firm can stop it from using emails with certain sensitivity labels, or emails from outside senders, through a DLP policy; the outside-sender option is in preview as of October 2026.
Can my employer see what I ask Copilot?
With a work account, yes. Prompts and responses are logged in your organization's Microsoft 365, and admins can search them with audit and eDiscovery tools.
Is the free Copilot Chat at work covered too?
Yes, when you sign in with your work account. Microsoft says enterprise data protection is available in Copilot Chat at no extra cost. Without the paid Microsoft Copilot license, its reach into your work data is narrower: it works with the files you upload, the document you have open and, in Outlook, your own mail and calendar.
Does a safe copy make a document fit for consumer Copilot?
It lowers what is exposed, but your firm's policy may still forbid personal accounts for any work. Check the policy first.
ClientSafe makes the safe copy on your PC: it replaces client names, addresses, account and ID numbers with placeholders such as Person_1, and puts the real names back into Copilot's answer. Detection is not perfect, so review the list before you copy.