Microsoft Copilot (commercial licensed): BAA available by default under the Microsoft DPA · Does not train on your prompts · Not named in Microsoft’s SOC 2 Type 2 in-scope list
Formerly "Microsoft 365 Copilot." Copilot Chat is a separate tier included with eligible subscriptions.
| Commercial licensed tier | |
|---|---|
| HIPAA BAA | Yesby default under the Microsoft Online Services Data Protection Addendum; Copilot named in the HIPAA in-scope services list |
| Trains on your data | Noprompts, responses and Microsoft Graph data are not used to train foundation LLMs |
| Survives deletion | Yesuser deletion via the My Account portal does not override tenant Purview retention policies or eDiscovery; retention period not publicly stated |
| Deployer / admin log access | YesMicrosoft Purview Content search and retention policies; Teams Export APIs for Teams chats |
| Third-party attestation | Not namedSOC 2 Type 2 in-scope list covers Office 365 and Copilot Studios but does not name Microsoft Copilot |
Copilot Chat (included free with eligible M365 subscriptions, web-grounded) and consumer Copilot/Copilot Pro, which the commercial DPA does not cover; also renamed - "Microsoft 365 Copilot" is now "Microsoft Copilot"
Vendor terms change without notice. This page reflects what Microsoft Copilot published as of September 1, 2026. Re-verified quarterly.
If you need a scored Go / Conditional Go / No-Go verdict for a vendor decision — including a vendor not listed here — that's an AI Vendor Risk Assessment: three binary industry gates, nine scored criteria, four provenance fields on every finding. $997, delivered in 48 hours.
See how AVRA works →Want all 13 tools in one file?
Covers 22 tiers across 13 tools — same sourcing, side by side, printable for a vendor file.