Data sovereignty
Does Copilot stay inside the EU Data Boundary?
Eligible Microsoft 365 Copilot is an EU Data Boundary service. That sentence is true and incomplete. Data at rest can stay in Europe while Flex Routing sends inferencing to the United States, Canada or Australia. Anthropic models and Copilot web grounding (Bing) sit outside the Boundary even when Copilot is listed as in-scope. Multi-Geo tenants are not in scope for the Microsoft 365 EU Data Boundary. Azure AI Foundry is a different product: Copilot settings do not govern Global vs Data Zone deployments.
Rows checked 24 August 2026 against Microsoft Learn EU Data Boundary transfer lists and Flex routing (EU and EFTA).
Reviewed by Datalegale · last source check 24 August 2026Score before any emailNot legal advice
What to do next
Draw an inside / outside map for the tenant you have, not the product brochure. Flex Routing, Anthropic, web grounding, Multi-Geo and Foundry Global are separate rows.
Questionnaire and contact
This is a self-assessment, not a certificate and not legal advice. Work through the questionnaire at /assessments/eu-data-boundary/start. You see a result before any email. If your organisation needs consultation, implementation or development of Microsoft 365 Copilot controls in an EU tenant — or you simply have a question — write to hello@datalegale.com.
Inside or outside the EU Data Boundary
Copilot vs Flex Routing vs Anthropic vs web grounding vs Foundry. “In” means Microsoft’s EU Data Boundary (or Azure EU Data Zone) applies to that path when the tenant is otherwise eligible. Not legal advice. Check the live Learn article; catalogues move.
| Path | In the EU Data Boundary? | Leaves or excluded when | What to check |
|---|---|---|---|
| Microsoft 365 Copilot (eligible tenant, Flex Routing off) | Yes — listed EUDB service | You are not eligible (e.g. Multi-Geo), or you enable an excluded model / web grounding | Org profile; Copilot is an EUDB workload |
| Copilot Chat (work, commercial, eligible) | Yes, same catalogue | Same exceptions as Copilot | Enterprise data protection / DPA applies to work identity |
| Data at rest (prompts stored, Graph content) | Yes, stays in the Boundary | Limited pseudonymized operational data may be stored outside | Do not confuse storage geo with inferencing geo |
| Flex Routing on — LLM inferencing | No, at peak load | US, Canada or Australia during peak demand | Copilot → Settings → Flex routing |
| Anthropic models in Copilot | No — excluded | Enabled as a Copilot model / subprocessor | Copilot settings + Message Center |
| Web grounding / Bing search queries | No | Web search is on; generated queries go to Bing | Copilot → Settings → web search |
| Copilot Studio / Power Platform agents | Only if the environment geo is in the Boundary and Flex Routing is disallowed | Environment outside EU; or Power Platform Flex Routing allowed | Power Platform admin center environment region + flex checkbox |
| Multi-Geo tenant | Not in scope for Microsoft 365 EUDB | Purchase or use of Multi-Geo Capabilities | Organization profile. Do not cite EUDB language you are not entitled to |
| Azure AI Foundry — regional EU resource | Not Copilot EUDB. Azure residency of that region | The resource was not placed in an EU region | Azure portal → resource → Region |
| Foundry Data Zone EU | Azure EU Data Boundary / Data Zone — not Copilot settings | You picked Global instead, or the model has no EU zone | Deployment type on the model |
| Foundry Global Standard / Global Provisioned | No. Inferencing may run in any Foundry region | Deployment type labelled Global | Azure Policy can block Global deployments |
| Claude / Anthropic on Foundry | No European data zone comparable to Azure OpenAI (as of 2026) | Those models are used on EU personal data | Model card + Anthropic as independent processor |
What Microsoft Learn actually says — and what it does not
Microsoft Learn’s Copilot privacy article states that Microsoft Copilot, for commercial customers, is compliant with existing privacy, security and compliance commitments, including the GDPR and the EU Data Boundary. That sentence is the featured snippet on the head query. It is true as a product commitment. It is not a map of your tenant.
The Boundary is a residency commitment for listed Microsoft 365 workloads. Copilot is in that catalogue for eligible tenants. Storage location of Exchange is the wrong proxy. Flex Routing (inferencing), Anthropic models (excluded), web grounding (Bing queries), Multi-Geo (not in scope) and Foundry Global (a different product) each change whether personal data in a prompt stays in Europe. Draw the inside/outside table for the tenant you have. Do not paste the Learn callout into a DPIA as the whole answer.
Flex Routing in 2026
Flex Routing lets Microsoft run Copilot LLM inferencing outside the EU Data Boundary when EU capacity is tight. For many European tenants it has been on by default. The control lives in Microsoft 365 admin center → Copilot → Settings (AI Administrator). Disabling it is a policy choice: processing stays inside the Boundary at the cost of peak-load capacity. Leaving it on is also a policy choice. The failure is not the default. The failure is an unrecorded default.
A DPIA that says “Copilot runs in the EU Data Boundary” while Flex Routing is enabled is describing a product headline, not the tenant. Customer security questionnaires have started to ask the setting by name. “We use EU Data Boundary” without the Flex Routing line is now a weak answer.
Anthropic models and other non-Boundary subprocessors
Some models available in Copilot experiences are explicitly excluded from the EU Data Boundary. Anthropic is the example organisations hit in 2026 Message Center posts. Enabling those models is a deliberate extra-EU subprocessor path, even when the rest of Copilot is in-Boundary. If nobody in the tenant can say whether they are on, the transfer register is already wrong.
The same logic applies to Copilot Studio and Power Platform agents. Environment geo and cross-geo movement are not Copilot tenant settings. An EU Copilot configuration can sit next to a global-default Studio environment. Map the workloads. Do not assume the Boundary follows the brand name “Copilot”.
Web grounding and Bing
When web search / web grounding is enabled, Copilot can send generated queries to Bing. Those queries can contain prompt-derived personal data. Microsoft’s own Boundary documentation treats this path as outside the EU Data Boundary. For many DPIAs it is a separate purpose: the model is allowed to look at the public web, with a transfer attached. Turning it off is straightforward. Leaving it on without a line in the RoPA is the usual gap.
Foundry is a different product
Azure AI Foundry, Azure OpenAI and custom model endpoints follow the Azure region and the deployment type, not Copilot’s EU Data Boundary toggle. A clean Copilot Boundary configuration does not cover a Global Standard Foundry deployment. Copilot EUDB, Foundry Data Zone EU, and Foundry Global are three different sentences. If both Copilot and Foundry exist, say so in the employee notice. If Foundry is forbidden on personal data, record that too.
Multi-Geo is not extra residency on Copilot
Microsoft’s Flex Routing article is explicit: customers who purchased or used Multi-Geo Capabilities are not in scope for the Microsoft 365 EU Data Boundary even if the tenant is listed in an EU or EFTA country. The Flex Routing setting will not be available in the Microsoft 365 admin center for those customers. Put Multi-Geo on the map as “not entitled to cite EUDB for Microsoft 365”, not as “even more in Europe”.
Sources
7 questions · ~5 min. Score and first risks before any email
Does not score oversharing, DLP or identity.
Read first
- Where do Copilot web-grounding queries go?
Generated search queries sent to Bing fall outside the EU Data Boundary. Treat web search as a conscious configuration choice.
FAQ
If Copilot is in the EU Data Boundary, are we compliant?
No. The Boundary is a residency commitment with documented exceptions. You still need a lawful basis, minimisation, security, transparency and usually a DPIA.
If the tenant is in the EU, is Copilot in the EU Data Boundary?
Not necessarily. Eligibility, Flex Routing, excluded models, web grounding and Multi-Geo each change the answer. Tenant geo for Exchange is the wrong proxy.
Does Flex Routing mean data leaves the EU?
Inferencing can leave (US, Canada, Australia at peak load). Data at rest stays inside the EU Data Boundary, except limited pseudonymized operational data.
Does data at rest leave the EU Data Boundary?
Microsoft’s commitment is that customer data at rest remains inside. Do not write “nothing leaves Europe” if Flex Routing, Anthropic or web grounding is on.
Are Anthropic models in the EU Data Boundary?
No. Microsoft’s enterprise data protection notes exclude Anthropic models from the EU Data Boundary and from in-country processing commitments.
Is web grounding EU Data Boundary compliant?
Generated Bing search queries are not. Microsoft documents this as an optional path outside the Boundary.
Does Multi-Geo keep us in the EU Data Boundary?
The opposite for Microsoft 365: customers who purchased or used Multi-Geo are not in scope for the Microsoft 365 EU Data Boundary, even with an EU billing address.
Is Azure AI Foundry covered by Copilot’s EU Data Boundary?
No. Foundry follows Azure region and deployment type (regional, Data Zone, Global). Copilot tenant settings do not govern it.
Is Foundry Data Zone the same as Copilot EUDB?
No. Data Zone EU is an Azure Foundry commitment that processing of prompts stays in Microsoft’s EU data zone. It is not the Copilot Flex Routing toggle and it is not inherited from a Copilot DPIA.
Does Foundry Global leave the EU?
Yes for inferencing. Prompts and completions on a Global deployment may be processed in any Microsoft Foundry region, including outside the EU, even when the resource was created in Europe.
Is Flex Routing a personal-data transfer?
If prompts or grounding data include personal data and inferencing occurs outside the EEA, treat it as a Chapter V transfer until counsel says otherwise.
Can Datalegale help after the score?
Yes. The questionnaire is a self-check. For consultation, implementation, development, or questions about Copilot in your tenant, write to hello@datalegale.com.
Other assessments — not the same questionnaire
- Copilot Flex Routing: Can Inferencing Leave the EU?
Yes for inferencing. No for data at rest. Microsoft Learn says Flex Routing lets EU and EFTA customers allow LLM inferencing outside the EU Data Boundary at peak demand. That sentence is true, and it is the whole problem: storage is not what it describes. Prompts, responses and grounding data may be processed in the United States, Canada or Australia. Customer data at rest stays inside the Boundary, except limited pseudonymized operational data. Message Center MC1269223 enabled the setting by default for new eligible tenants after 25 March 2026 and for many existing tenants from 17 April 2026.
- Copilot EUDB ≠ Foundry Data Zone ≠ Global
No. Copilot EU Data Boundary, Foundry Data Zone EU, and Foundry Global are three different commitments. Copilot tenant settings do not govern Foundry. A regional EU resource stores data in that geo; a Data Zone EU deployment may infer anywhere in Microsoft’s EU data zone; a Global deployment may infer in any Foundry region worldwide. Claude / Anthropic on Foundry did not offer a European data zone comparable to Azure OpenAI in 2026.
- Is Microsoft’s Copilot DPIA Template Enough?
Microsoft’s “Build your own” Microsoft 365 Copilot DPIA is a starting file, not the record. Article 35 still needs tenant facts the template cannot know: the Flex Routing value and whether extra-EU inferencing is a transfer, whether historically overshared SharePoint still grounds Copilot, whether DLP lists Microsoft 365 Copilot as a location, web grounding, Anthropic models, commercial vs consumer licensing, and a named owner. A score is not that file.