isacco@gianlucaiunco:~$
IT Leggi in italiano

Automatic translation from Italian. The Italian version is the reference text.

guide · series AI at the office, part 1

How can I use Microsoft Copilot Chat at work without exposing office data?

With a work account your text is not used to train the models, but there are rules to know. Here is how to recognise the protection, what not to type and how to delete your history.

In short

With a work account, Copilot Chat has enterprise data protection (green shield) and your text does not train the models; the history is still kept in your organisation, and passwords or sensitive data stay out of the chat.

Is Copilot Chat with a work account different from the personal one?

Yes, and it is the most important difference. When you sign in with your Microsoft 365 work account (the one with your company's address), Copilot Chat is covered by enterprise data protection. Microsoft acts as data processor, under the same contractual commitments that apply to your email in Exchange and your files in SharePoint. If you use the version with a personal Microsoft account, different consumer terms apply, and that is not the right route for office data.

To check where you are at a glance, look at the top, next to the button for starting a new chat: when protection is active, a green shield appears. If you cannot see it, stop and check which account you signed in with before typing anything.

The basic protection in Copilot Chat does not need a separate licence: it is included at no extra cost. What does change is the set of control features available, which depends on your Microsoft 365 plan.

Is my text used to train AI?

According to Microsoft's official documentation, no: prompts, responses and data retrieved through Microsoft Graph are not used to train the foundation models. Content is encrypted and kept separate from other customers' data.

Two useful points:

  • History is kept. Prompts and responses are logged within your organisation, for example for auditing and legal discovery. Whoever administers the tenant can apply retention rules and review this data. Do not treat the chat as a space that is secret from your own company.
  • Web search has its own rules. When Copilot looks for information on the internet, it sends Bing a few words derived from your request, without your username or organisation data. These searches are handled differently from chats, and are not covered by the EU data boundary commitments.

Which office data can Copilot Chat see?

In a plain chat, Copilot Chat relies on the web, not on your archives. Company content comes into play only in a few cases:

  1. you type, paste or upload it yourself: with the + button, by dragging a file in, or by typing / to find a file you can access. Uploaded files end up in your OneDrive for Business;
  2. you use the Word, Excel or PowerPoint agents, which see only the document you have open;
  3. you use it from Outlook, where it can read email, calendar, meetings, chats and some files;
  4. you use an agent connected to company data, for example a SharePoint site.

Access to the full range of work data is reserved for people with the full paid Microsoft Copilot licence. In every case Copilot shows only what the person can already open: if a shared folder is visible to everyone, it will be visible to the assistant too. Before rolling out its use, it is worth tidying up permissions.

What should I not type into the chat?

Active protection does not replace your internal rules. As good practice, avoid entering:

  • passwords, access codes and keys;
  • health or criminal-record data or other special categories of personal data, unless you have assessed it carefully;
  • confidential client contracts or documents, if you do not have permission to process them this way.

Where you can, replace names and figures with placeholders ("Client A", "amount X") and paste only the part you need. Always check the result: answers are not guaranteed to be correct and should be read before you send them to anyone.

How do I delete my chat history?

With a work or school account you can delete your Copilot activity history from your personal space:

  1. open myaccount.microsoft.com and sign in with your work account;
  2. go to Data and Privacy and then Data options;
  3. in the Copilot activity history section choose Delete;
  4. in the dialog tick Microsoft Copilot and confirm with Delete.

The request is not instant. Apps that are already open may keep showing the old history until you close them. The tick box covers all apps together (Word, Outlook, Teams and the rest): you cannot delete just part of it. Text that Copilot helped you write and that you saved in a file stays in the file. If you cannot find the option, check that you used your work account and ask whoever administers Microsoft 365.

What should the Microsoft 365 administrator check?

Whoever manages the tenant can decide which agents to allow from the Microsoft 365 admin center, in the integrated apps section, where they can see the permissions requested and the privacy statement of each agent. They can also choose whether to use third-party models (Anthropic and OpenAI) in Copilot features: Microsoft states that Anthropic models are currently outside the EU data boundary. Finally, it is wise to decide how long to keep interactions and to keep permissions and sensitivity labels in order.

Sources

Need a hand at your company?

I provide IT and AI consulting for small businesses and professionals, in Apulia and remotely.

Services

Guide written with AI assistance and checked by me before publication.