// Trust & Security Report
Microsoft Corporation
Microsoft 365 Copilot for Education
Certifications held
9
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on learn.microsoft.com“Office 365, Office 365 U.S. Government, Office 365 U.S. Government - High, Office 365 U.S. Government Defense [are explicitly listed as in-scope for the SOC 2 Type 2 attestation report]. Microsoft commissions a full SOC 1 Type 2 and SOC 2 Type 2 examination of Office 365 annually.”
Verify on learn.microsoft.com“Microsoft commissions a full SOC 1 Type 2 and SOC 2 Type 2 examination of Office 365 annually.”
Verify on learn.microsoft.com“Auditors review Office 365 cloud services at least annually against the ISO 27001:2013 standard. [Certificate reference:] Microsoft 365 - ISO 27001:2022 Certificate (2024-2027)”
Verify on learn.microsoft.com“Your control over your data is reinforced by Microsoft's commitment to comply with broadly applicable privacy laws, such as the GDPR, and privacy standards, such as ISO/IEC 27018, the world's first international code of practice for cloud privacy.”
Verify on learn.microsoft.com“Microsoft 365 Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.”
Verify on learn.microsoft.com“Microsoft 365 Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.”
Verify on learn.microsoft.com“In the Online Services Terms Data Protection Addendum (DPA), Microsoft agrees to be designated as a 'school official' with 'legitimate educational interests' in customer data as defined under FERPA. When Microsoft handles student education records, Microsoft agrees to abide by the limitations and requirements imposed by 34 CFR 99.33(a) just as school officials do.”
Verify on learn.microsoft.com“Microsoft 365 Copilot, including Microsoft 365 Copilot Search, is compliant with our existing privacy, security, and compliance commitments to Microsoft 365 commercial customers, including the General Data Protection Regulation (GDPR) and European Union (EU) Data Boundary.”
Verify on learn.microsoft.com“Microsoft is committed to complying with all laws and regulations applicable to Microsoft, including the EU AI Act, to enable our AI solutions to meet evolving standards for trustworthy and responsible AI.”
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
EU Data Boundary for EU customers (LLM processing stays within EU); Advanced Data Residency (ADR) and Multi-Geo options available for enterprise customers; Copilot added as covered workload in data residency commitments as of March 1, 2024; customers outside the EU may have queries processed in US, EU, or other regions unless ADR is purchased.
Prompts, responses, and data accessed through Microsoft Graph are not used to train foundation LLMs, including those used by Microsoft 365 Copilot. Optional user feedback is also not used to train foundation LLMs. Interaction data is encrypted at rest and stored within the Microsoft 365 service boundary. DPA available at https://aka.ms/DPA covers customer data including student records under FERPA school official designation.
// Security controls
Bug Bounty Program
Microsoft-operated MSRC in-house program (not HackerOne or Bugcrowd). Dedicated Microsoft Copilot Bounty Program pays $250-$30,000 USD per qualifying submission. Scope includes Copilot on web, Edge, mobile, Windows, and integrated experiences.
microsoft.comThird-Party Audits
Annual ISO 27001 and SOC 2 Type 2 examinations by independent AICPA-accredited CPA firms. Mid-year SOC Type 1 audits also conducted for new services. Quarterly bridge letters issued.
learn.microsoft.comEncryption at Rest
BitLocker and per-file encryption for all stored data including Copilot interaction history.
learn.microsoft.comEncryption in Transit
Transport Layer Security (TLS) and Internet Protocol Security (IPsec) for all data in transit.
learn.microsoft.comContent Safety Filters
Hate/Fairness, Sexual, Violence, and Self-harm filters active on prompts and responses; jailbreak and cross-prompt injection attack (XPIA) classifiers; protected material detection for text and code.
learn.microsoft.comZero Trust and Tenant Isolation
Logical isolation of customer content within each tenant via Microsoft Entra authorization and role-based access control. Copilot only surfaces data the individual user is authorized to access.
learn.microsoft.comLLM Processing
Azure OpenAI Services used for processing (not public OpenAI). Azure OpenAI does not cache customer content or Copilot-modified prompts. Abuse monitoring with human review has been opted out of for M365 Copilot services.
learn.microsoft.comAudit Reports Access
SOC and ISO audit reports available via Microsoft Service Trust Portal (servicetrust.microsoft.com) to verified subscribers.
servicetrust.microsoft.com// Products & data scope
data: Full Microsoft Graph access within tenant boundary; prompts and responses stored in M365 and governed by DPA and FERPA school official designation; no data used to train LLMs; EU Data Boundary and ADR apply.
Requires Microsoft 365 E3/E5 or equivalent Education license plus Copilot add-on. Full SOC2, ISO27001, HIPAA, GDPR, and FERPA coverage. Admins can control agent access, retention policies, and data deletion.
data: Enterprise data protection applies when signed into school or work account; web search queries are explicitly NOT covered by DPA or FERPA; prompts and responses stored under Microsoft privacy statement when no DPA is in effect.
Available free to students 13+ and educators via Microsoft 365 Education. FERPA compliance is limited: chat content is protected but web search queries fall outside FERPA scope. Admins should review configuration before student use involving sensitive records.
data: Training completion data and certifications earned; governed by Microsoft Privacy Statement; no student record processing.
Non-AI training platform at education.microsoft.com. Free for all educators. Not an AI product generating content; outside FERPA scope.
data: Student reading fluency data processed within school M365 tenant; governed by FERPA school official designation in DPA; data does not leave tenant for LLM training.
Free tools included in Microsoft 365 Education licenses. Covered under same SOC2 and ISO27001 scope as Office 365 Commercial. Recommended for K-12 use with FERPA-covered student populations.
// What to watch
- FERPA coverage has an important gap: web search queries generated by Copilot Chat are explicitly NOT covered by the Data Protection Addendum and therefore fall outside FERPA protections; institutions must disable web search for FERPA-sensitive workflows.
- Anthropic models are used as a subprocessor for some M365 Copilot experiences and are explicitly out of scope for the EU Data Boundary and in-country LLM processing commitments per Microsoft's own documentation.
- Bug bounty is operated through Microsoft's own MSRC portal, not a third-party platform such as HackerOne or Bugcrowd.
- Microsoft 365 Copilot (paid add-on) and free Copilot Chat have different compliance scopes; the free tier lacks the same DPA protections and FERPA designation unless configured under a school enterprise agreement.
// At a glance
Pricing model
Tiered: free AI education tools and Copilot Chat via Microsoft 365 Education; licensed Microsoft 365 Copilot add-on for full generative AI features (approx. $30/user/month on top of M365 Education license); enterprise volume licensing via Microsoft EA
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Microsoft Corporation's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
microsoft.com