Understand how organizational data is used and retained in Microsoft 365

You can use organizational data to power various capabilities in Microsoft 365, Microsoft 365 Copilot, and Viva applications and services.

Review the following information to understand how organizational data is used, stored, and deleted.

Data usage

The organizational data you upload might be used by Viva, Microsoft 365 services, and non-Microsoft services that have been given access through the Microsoft Graph API. This data is treated as publicly available within the organization, meaning it might be displayed to any end user in the organization.

For Microsoft User Profile

In the Microsoft 365 User Profile, Microsoft Entra data is given precedence over Organizational Data in Microsoft 365 by default. When a service queries a Microsoft 365 User Profile, if there's both organizational data and Microsoft Entra data for a single attribute, the Microsoft Entra value is returned. For example, a given end user has "Software Engineer" as the jobTitle property in Microsoft Entra ID. The Organizational Data Source Administrator for your organization uses the Organizational Data in Microsoft 365 feature to upload a value of "Senior Software Engineer" for the Microsoft_JobTitle attribute for that same end user. After the upload, both values are stored in the end user's Microsoft 365 User Profile. When an experience like Profile cards in Microsoft 365 queries the Microsoft 365 User Profile to get the jobTitle property for that end user, "Software Engineer" is returned (instead of "Senior Software Engineer").

If, however, there's no data for an attribute in Entra ID, the corresponding organizational data value is used. So, in the previous example, if there's no value for jobTitle in Entra ID, the Profile card in Microsoft 365 uses "Senior Software Engineer" from Organizational Data in Microsoft 365.

Learn more about Viva Insights advanced analysis privacy.

Learn more about Viva Glint security and compliance for data usage.

Assign data precedence to organizational data

Applies to: Microsoft 365 global admin

If you prefer to use the value from your organizational data in the Microsoft 365 User Profile, you can override the default precedence. To do so:

1. In the Microsoft 365 admin center, navigate to Organizational Data in Microsoft 365, and begin a new import.

2. Choose your import type.

3. Import your data using these steps or set up the connector.

4. Select Prioritize Organizational Data in Microsoft 365, then complete your data upload.

   

Alternatively, you can also update data precedence on the settings page using these steps:

1. In the Microsoft 365 admin center, navigate to Organizational Data in Microsoft 365, then on the left select Settings.

2. Under Data prioritization on the right, select Edit data prioritization.

   

3. Select Prioritize Organizational Data in Microsoft 365.

4. At the bottom, select Save, then select Confirm change.

The data precedence you assign only impacts the returned value in Microsoft 365 services and non-Microsoft services when there are different values for the same attribute from different sources. For example, using the same example as above, let's say an end user has "Software Engineer" as the jobTitle property in Microsoft Entra ID, and the Organizational Data Source Administrator for your organization uses the Organizational Data in Microsoft 365 feature to upload a value of "Senior Software Engineer" for the Microsoft_JobTitle attribute for that same end user. If you assign data precedence to organizational data, when an experience like Profile cards in Microsoft 365 queries the Microsoft 365 User Profile to get the jobTitle property for that end user, "Senior Software Engineer" is returned instead of "Software Engineer."

To ensure that the data in the Microsoft 365 User Profile remains up to date and accurate, we recommend that you upload refreshed organizational data regularly (for example, weekly). This prevents the data in the user profile from becoming stale when compared to the data in your organization's human capital management systems.

Ensure that the data you upload matches attribute names and descriptions listed in the Attribute reference. Also avoid uploading sensitive personal data.

Data deletion

The Organizational Data Source Administrator might inadvertently delete personal data by updating the data source with nulled values. See Update or make other changes to organizational data for information about deleting user data. As soon as the update is processed, the associated user data is overwritten with blank fields, meaning their data is effectively deleted immediately.

When a tenant is removed from Microsoft 365, all tenant data is purged within 30 days.

Data retention

Organizational data is stored as long as the end user is active and has a valid license and no deletion request has been made by the end user or the Organizational Data Source Administrator.

Data residency

When you upload organizational data, your data is stored in the geographic location corresponding to the default mailbox location as configured in Microsoft 365. Learn more about:

• Data Residency for SharePoint
• Data Residency for Exchange Online
• Data Residency for Viva Insights
• Data Residency for Viva Glint

Manage data subject requests

A Data Subject Request or DSR is a formal request by a data subject (an end user) to a controller to take an action on their personal data. To understand what data subject rights end users have, see Office 365 Data Subject Requests Under the GDPR and CCPA.

Use the following information to fulfill DSRs from end users:

• Access and Export – End users can access and export organizational data uploaded by an Organizational Data Source Administrator using the resources below.
  • Microsoft 365 User Profile: By using the data export function in the profile card. Learn how.
  • Viva Insights: By using the Power BI Connector. Learn how.
• Edit – See Update or make other changes to organizational data.
• Delete – See Update or make other changes to organizational data and Data deletion.

Access and export audit logs

To monitor security and compliance-related Organizational data in Microsoft 365 events for your organization, turn on audit logging. The audit logs are available in the Microsoft Purview portal or by using the Microsoft 365 Management Activity API. Learn more.

Before you can view the audit log, enable Microsoft 365 audit log search. You only have to do this step once. After you turn it on, it takes a few hours before you can search the logs.

To view the audit log:

1. Go to the Microsoft Purview portal and sign in using your work or school account.

2. In the left pane of the portal, select Audit.

3. Follow the instructions to search audit logs. Learn how.

   • Select Record Type: OrganizationalDataInM365 for metadata events
   • Select Record Type: WorkplaceAnalytics for ingestion events