Where do Copilot web-grounding queries go?

Generated search queries sent to Bing fall outside the EU Data Boundary. Treat web search as a conscious configuration choice.

Reviewed by Datalegale · last source check 24 August 2026. About 3 min read. This is not legal advice.

What to do next

If your policy requires processing to stay inside the tenant and the EU Data Boundary, disable web search. If you keep it, describe the Bing flow in the DPIA.

Copilot can generate a shortened web query from a user prompt and send it to Bing. Those queries are processed under a different documentary regime from Microsoft 365 customer data in the EU Data Boundary. Web search is useful. It is also a transfer you should choose, not inherit.

Why this is easy to miss

The user still sees a Copilot pane inside Microsoft 365. The data flow is not obvious. Staff may paste customer names into a question that then becomes a web query.

Disable web search if your policy requires processing to stay inside the tenant and the EU Data Boundary. If you leave it on, train people not to put unpublished personal data into prompts that might be grounded on the web, and record the flow.

How to check it

Admin controls for web search live with the other Copilot settings in the Microsoft 365 admin center. Confirm the state for Microsoft 365 Copilot and Copilot Chat separately if your tenant exposes both. Capture the setting for the DPIA annex next to Flex Routing and model choices.

How to decide, not just toggle

Keep web search if staff need public information and you can train them not to mix unpublished personal data into those prompts. Disable it if your transfer policy is strict, or if you cannot yet explain the Bing flow to a supervisory authority in one paragraph.

This is independent of Flex Routing. You can disable one and keep the other. The mistake is leaving both as unreviewed defaults and describing Copilot as “EU-only processing” in the DPIA.

Is Copilot GDPR compliant? Flex Routing FAQ

Does the whole prompt go to Bing?

Copilot generates a shortened web query from the user prompt. Treat that query as data leaving the Boundary, even if it is not a verbatim dump of the Graph.

Is web search required for Copilot to be useful?

No. Many enterprise uses are tenant-grounded. Web search is for public information. That is a product choice, not a compliance requirement.

Related guides

Is work Copilot the same as consumer Copilot?
Commercial Microsoft 365 Copilot under Enterprise Data Protection is a different product, contractually and technically, from consumer Copilot.

This guide pairs with

A short questionnaire on this topic only. Score before email. The guide stays if you never convert.

Is Microsoft 365 Copilot in the EU Data Boundary? · 7 questions

Read, then start