Does Copilot Flex Routing leave the EU?

How to turn off Copilot Flex Routing

1. Sign in as AI Administrator. Open the Microsoft 365 admin center with an account that has the AI Administrator role (or equivalent).
2. Open Copilot settings. Go to Copilot → Settings → View all.
3. Open Flex Routing. Select Flex routing during peak load periods (wording may read “Flexible inferencing during peak load periods”).
4. Do not allow flex routing. Choose Do not allow flex routing. LLM inferencing then stays inside the EU Data Boundary even at peak demand. Capacity and latency can differ; test in a pilot.
5. Record it, then check Power Platform. Write the date, the value and the owner into the DPIA or transfer register. If you use Copilot Studio, Dynamics 365 Copilot or Power Platform Copilot, confirm “Allow flex routing during periods of peak load” is at least as restrictive.

What Microsoft Learn actually says

Microsoft Learn, Flex routing (EU and EFTA), updated 5 May 2026: “Flex routing lets customers in the European Union (EU) and the European Free Trade Association (EFTA) allow large language model (LLM) inferencing to occur outside the EU Data Boundary during periods of peak demand to help maintain a consistent Copilot experience.” That sentence is true. It is also incomplete as a board answer.

Learn is describing inferencing — the step that turns a prompt plus Graph grounding into a completion. It is not describing Exchange or SharePoint at rest. Customer data at rest remains inside the EU Data Boundary. Inferencing, when the setting is allowed, may run in the United States, Canada or Australia. Encryption in transit still applies. Encryption is not residency. A DPIA line that says “Copilot runs in the EU Data Boundary” while Flex Routing is allowed is quoting the product headline, not the tenant.

MC1269223 and the 2026 default

Message Center MC1269223 is the change notice. It told EU and EFTA administrators that Flex Routing would be enabled by default, with a path to opt out. Microsoft Learn later documented the same dates: on by default for eligible tenants created after 25 March 2026, and from 17 April 2026 for many tenants that already existed. New tenants inherit on. Old tenants that nobody opened are often still on.

The failure is not the default. The failure is an unrecorded default. Customer security questionnaires now ask for the setting by name. “We use the EU Data Boundary” without the Flex Routing line, the MC item and the date checked is a weak answer in 2026. Adjacent item MC1269241 (Anthropic models) is a different exclusion — not the same toggle, not covered by turning Flex Routing off.

GDPR is not the only statute that cares

If prompts or grounding contain personal data and inferencing runs outside the EEA, treat Flex Routing as a Chapter V transfer until counsel says otherwise. That is the GDPR row. NIS2 and DORA ask a neighbouring question: do you know where ICT processing actually runs, and can you evidence it? An unreviewed default is a residency gap and an operational-resilience gap. Sector boards in finance, health and public administration will not accept “the disks are in Amsterdam” as the whole answer.

Multi-Geo is not a quieter Flex Routing

If the organisation purchased or used Multi-Geo Capabilities, Microsoft says the tenant is not in scope for the Microsoft 365 EU Data Boundary even when the billing address is in the EU. The Flex Routing control may not appear in the Microsoft 365 admin center at all. That is a different gap: you cannot cite Boundary language you are not in. Record it. Do not answer this questionnaire as if the toggle were off.

Power Platform does not follow automatically in both directions

The Microsoft 365 admin center setting covers Microsoft Copilot and Copilot Chat. Copilot Studio, Dynamics 365 Copilot and Power Platform Copilot have their own checkbox: “Allow flex routing during periods of peak load”. Microsoft’s rule is that Power Platform honours the Microsoft 365 value unless Power Platform is more restrictive. If Microsoft 365 disallows Flex Routing, Power Platform is off and you cannot turn it on there. If Microsoft 365 allows it, Power Platform is independently configurable. Check both if you run agents.

What to write in the DPIA

One sentence is enough to start: “Prompts and grounding data may be inferred outside the EU Data Boundary at peak load unless Flex Routing is set to Do not allow.” Then the current value, the MC1269223 date for this tenant, the role that checked it, and whether Power Platform matches. If you keep it on, name the regions Microsoft lists, state that data at rest stays in the Boundary, and say why residual risk is accepted — including NIS2/DORA if they apply. If you turn it off, say that peak-load capacity may differ and that a pilot confirmed it.

Sources

• Flex routing (EU and EFTA) — Microsoft Learn
• Services that transfer a subset of Customer Data (Copilot flex routing) — Microsoft Learn
• Geographical availability and flex routing — Power Platform — Microsoft Learn

Read first

• Where do Copilot web-grounding queries go?

  Generated search queries sent to Bing fall outside the EU Data Boundary. Treat web search as a conscious configuration choice.

• Does the EU AI Act replace GDPR for Copilot?

  Most organisations using Copilot as a deployer have lighter AI Act duties than providers. GDPR obligations remain fully applicable.

FAQ

Other assessments — not the same questionnaire

• Is Microsoft 365 Copilot in the EU Data Boundary?

  Eligible Microsoft 365 Copilot is an EU Data Boundary service. That sentence is true and incomplete. Data at rest can stay in Europe while Flex Routing sends inferencing to the United States, Canada or Australia. Anthropic models and Copilot web grounding (Bing) sit outside the Boundary even when Copilot is listed as in-scope. Multi-Geo tenants are not in scope for the Microsoft 365 EU Data Boundary. Azure AI Foundry is a different product: Copilot settings do not govern Global vs Data Zone deployments.

• Is Microsoft’s Copilot DPIA Template Enough?

  Microsoft’s “Build your own” Microsoft 365 Copilot DPIA is a starting file, not the record. Article 35 still needs tenant facts the template cannot know: the Flex Routing value and whether extra-EU inferencing is a transfer, whether historically overshared SharePoint still grounds Copilot, whether DLP lists Microsoft 365 Copilot as a location, web grounding, Anthropic models, commercial vs consumer licensing, and a named owner. A score is not that file.

• Copilot EUDB ≠ Foundry Data Zone ≠ Global

  No. Copilot EU Data Boundary, Foundry Data Zone EU, and Foundry Global are three different commitments. Copilot tenant settings do not govern Foundry. A regional EU resource stores data in that geo; a Data Zone EU deployment may infer anywhere in Microsoft’s EU data zone; a Global deployment may infer in any Foundry region worldwide. Claude / Anthropic on Foundry did not offer a European data zone comparable to Azure OpenAI in 2026.