Microsoft Copilot
Microsoft · Generative AI assistant
Ayliea's assessment: Low RiskAyliea recommends: ApproveIn Ayliea's curated list
Verified . Risk classification and recommended policy are Ayliea's subjective assessments — not vendor certifications.
- Data residency
- Tenant-aligned (depends on M365 setup)
- Zero retention available
- Yes (commercial / Enterprise tier)
- Certifications
- SOC 2 Type II, ISO 27001, ISO 27018, HIPAA, FedRAMP High
Why this rating
Inherits the M365 tenant's compliance boundary, DPA, and data residency. Strong default protections; prompts and grounding data stay within the tenant.
Considerations before deploying
- Verify Copilot is enabled only for licensed users (E3/E5 + Copilot add-on)
- Apply DLP labels to sensitive SharePoint content before broad rollout
Sources
- Microsoft Trust Center (www.microsoft.com)
- Copilot Data Protection (learn.microsoft.com)
Want this for every tool on your network?
A scoping call starts an expert assessment that maps your full AI surface — sanctioned and shadow — from the log metadata you share.