Is Microsoft 365 Copilot SOC 2 compliant?

Yes

Microsoft · Productivity

Yes. Microsoft holds a SOC 2 report covering Microsoft 365 Copilot, which gives independent assurance over its security controls.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

SOC 2 report: Confirmed; Microsoft reports a SOC 2 attestation. Request the current report and relevant bridge letter during procurement.
ISO 27001: Confirmed; Microsoft also reports ISO/IEC 27001 certification.
Default data training: No by default; Microsoft 365 Copilot is a paid commercial add-on; with enterprise data protection, prompts/responses are not used to train foundation models.
Business-tier training: No by default; Prompts, responses, and Microsoft Graph data accessed by Microsoft 365 Copilot are not used to train the foundation LLMs.

Practical risk: Copilot inherits the user's existing permissions, so over-shared SharePoint/OneDrive content becomes far easier for employees to surface. That is an oversharing and governance risk rather than a training one.

How to make a decision

Check the precise account tier, written contract and intended data before approving Microsoft 365 Copilot. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Microsoft 365 Copilot

Is Microsoft 365 Copilot HIPAA compliant?Is Microsoft 365 Copilot GDPR compliant?Is Microsoft 365 Copilot ISO 27001 certified?Does Microsoft 365 Copilot train on your data?

See the full Microsoft 365 Copilot risk profile, with every data-handling fact and its source, or browse all rated AI tools.