Dataflow for Microsoft 365 Copilot

Question

Good Monday Morning,

Im doing an internal assessment/documentation for our use of Copilot for Microsoft 365. I need to document the data flow that happens when using several of the features in regards to the Copilot functionalities.

I have some questions in regards to the data flows, and when data is sent to Microsoft servers and when (if any) requests are handled only at the client.

Example 1: Copilot used in Word to summarize the document

Is the data (meaning body text) sent to Microsoft servers (or in other ways leaving the machine) or is the summarization done "locally" on the machine?

Example 2: Indexing and "passive" data aggregation

When having Copilot enabled and not actively using it (meaning having in the Word site pane or similar), is Copilot indexing or in other ways gathering data from the document/material you are working with, or would you have to actively ask Copilot before it starts accessing the data?

Example 3: Editing and suggestion features

When using Copilot to make editing suggestions or automatic corrections within a document, does the data (such as body text) get sent to Microsoft servers for processing, or are these suggestions generated locally on the machine?

Also a broad question: Is ANY Copilot functionality actually done locally?

Answer 1

Microsoft Copilot for Microsoft 365 is a sophisticated processing and orchestration engine that provides AI-powered productivity capabilities by coordinating the following components: Large language models (LLMs), content in Microsoft Graph, such as emails, chats, and documents that you have permission to access, and the Microsoft 365 productivity apps that you use every day, such as Word and PowerPoint. When you enter prompts using Microsoft Copilot for Microsoft 365, the information contained within your prompts, the data they retrieve, and the generated responses remain within the Microsoft 365 service boundary, in keeping with our current privacy, security, and compliance commitments. Microsoft Copilot for Microsoft 365 uses Azure OpenAI services for processing, not OpenAI’s publicly available services. Azure OpenAI doesn't cache customer content and Copilot modified prompts for Copilot for Microsoft 365.

Regarding the specific examples provided:

1. When using Copilot in Word to summarize the document, the data is sent to Microsoft servers for processing.
2. When having Copilot enabled and not actively using it, Copilot is not indexing or gathering data from the document/material you are working with. It would have to be actively asked before it starts accessing the data.
3. When using Copilot to make editing suggestions or automatic corrections within a document, the data is sent to Microsoft servers for processing.

To answer the broad question, it appears that all Copilot functionality involves sending data to Microsoft servers for processing, rather than being done locally on the machine.

---

References:

• Data, Privacy, and Security for Microsoft Copilot for Microsoft 365
• Microsoft Copilot for Microsoft 365 overview
• Frequently asked questions about Copilot