Microsoft Copilot Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Microsoft Copilot

1. 1

   Clarify AI training and data retention terms within 30 days: Request written confirmation from your Microsoft account team or legal contact that customer prompts are not used for model training. Reference the Microsoft Products and Services DPA and ask specifically about Copilot interaction data retention periods and opt-out configurations. Document the response alongside this report.

   DPA Template (GDPR Art. 28)
2. 2

   Obtain the complete Copilot-specific subprocessor list within 30 days: Contact Microsoft's privacy/data protection team and request the current subprocessor list applicable to your Copilot deployment tier. For Microsoft 365 Copilot enterprise customers, start at https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy. Record the received list in your vendor risk register.

   GDPR Subprocessor RulesNIST Supply Chain Risk (SP 800-161)
3. 3

   Request Microsoft's current SOC 2 Type II report for Copilot or the applicable Microsoft 365 service scope: Microsoft does not publish SOC 2 reports publicly, but enterprise customers can request them through the Microsoft Service Trust Portal at https://servicetrust.microsoft.com. Ask your account team for the most recent report and a bridge letter covering any gap period.

   SOC 2 Overview (AICPA)
4. 4

   Verify ISO 27001 certification status via Microsoft's Service Trust Portal: No ISO 27001 certificate was independently confirmed during this assessment. Visit https://servicetrust.microsoft.com and download the current ISO 27001 certificate for the applicable service scope. Confirm the certificate is current (not expired) and covers the Copilot service boundary.

   ISO 27001 Standard
5. 5

   Document complementary user entity controls (CUECs): If Microsoft Copilot is in-scope for your organization's SOC 2 audit boundary, document the controls your organization must implement — including access provisioning/deprovisioning, data classification policies for content shared with Copilot, and monitoring of Copilot permissions. Retain this report with reviewer signature to satisfy CC9.2 evidence requirements.

   SOC 2 Overview (AICPA)
6. 6

   Configure enterprise data controls before broad deployment: Audit your Microsoft 365 admin center settings for Copilot, including Connected Experiences toggles, diagnostic data levels, and any available data residency configurations. Ensure these are set in accordance with your organization's data handling and privacy policies prior to rolling out high data access use cases.

• Web archive history data was unavailable during this assessment. Domain establishment cannot be independently corroborated through archive records, though the 34-year WHOIS registration and enterprise registrar status provide substantial alternative confirmation.
• External cyber risk scoring was not available for this assessment. The SaaS industry benchmark comparison (average score: 76) could not be applied to this vendor at this time.
• The AI data usage policy evidence appears to have been partially truncated during extraction (providerEvidence field contains an incomplete string). The assessment of AI training commitment is based on the available policy text; the full policy at learn.microsoft.com should be reviewed directly.
• Firmographic data (headcount, industry classification, company type) was not available for the copilot.microsoft.com subdomain. Microsoft Corporation is a publicly traded entity (NASDAQ: MSFT); firmographic data is available through public financial disclosures.
• The subprocessor page at copilot.microsoft.com/subprocessors returned placeholder content. No individual subprocessors could be assessed for sanctions or safety signals. This limits supply chain risk evaluation.
• SOC 2 compliance status is not publicly verifiable — no public registry for SOC 2 exists. Compliance teams should request the Type II report and bridge letter directly from Microsoft.