OpenAI models will soon be available as a subprocessor in Microsoft 365 Copilot

🚨 The Signal: Microsoft 365 Copilot will soon use OpenAI-operated models, including GPT-5.6, as a subprocessor. This setting will be enabled by default on July 24, 2026, requiring admin action to disable and control data flow to OpenAI.

The Impact

Security teams and administrators are affected by new data processing locations and must review and configure Copilot settings to manage data exposure risks.

• Security Teams: Risk of data processing outside Microsoft's direct control.
• Administrators: Must configure new Copilot settings to prevent automatic enablement.
• Data Owners: Potential for sensitive data to be processed by a third-party subprocessor.
• Compliance Officers: Need to reassess data residency and privacy impact assessments.

The Action

1. Review Microsoft Learn documentation for details on OpenAI-operated models and data handling.
2. Access the Microsoft 365 admin center to locate the OpenAI subprocessor setting.
3. Before July 24, 2026, explicitly select 'No users' if you do not wish to enable OpenAI-operated models.
4. Update internal data protection and AI governance policies to reflect this change and decision.

Domain: Agentic-AI · Impact: high · Workload: Microsoft Purview