Is Microsoft 365 Copilot ISO 27001 certified?

Yes

Microsoft · Productivity

Yes. Microsoft is ISO/IEC 27001 certified for Microsoft 365 Copilot, the international information-security management standard.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

ISO/IEC 27001: Confirmed; Microsoft reports ISO/IEC 27001 certification. Ask for scope and current certificate dates before treating it as supplier assurance.
SOC 2: Confirmed; Microsoft also reports a SOC 2 attestation, which can complement but does not replace ISO scope evidence.
Default data training: No by default; Microsoft 365 Copilot is a paid commercial add-on; with enterprise data protection, prompts/responses are not used to train foundation models.
Business-tier training: No by default; Prompts, responses, and Microsoft Graph data accessed by Microsoft 365 Copilot are not used to train the foundation LLMs.

Practical risk: Copilot inherits the user's existing permissions, so over-shared SharePoint/OneDrive content becomes far easier for employees to surface. That is an oversharing and governance risk rather than a training one.

How to make a decision

Check the precise account tier, written contract and intended data before approving Microsoft 365 Copilot. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Microsoft 365 Copilot

Is Microsoft 365 Copilot HIPAA compliant?Is Microsoft 365 Copilot GDPR compliant?Is Microsoft 365 Copilot SOC 2 compliant?Does Microsoft 365 Copilot train on your data?

See the full Microsoft 365 Copilot risk profile, with every data-handling fact and its source, or browse all rated AI tools.