Does Microsoft Copilot track your activity?

The Short Answer: Yes — But the Rules Differ Sharply by Version

Yes, Microsoft Copilot tracks your activity — in every version. What changes dramatically is what happens to that data afterward, and most people have no idea which rulebook applies to them.

Both enterprise and consumer Copilot log your prompts, Copilot's responses, and the citations used to ground them. In Microsoft 365 environments, this is called the "Copilot activity history," and Microsoft is explicit that IT admins can view logged prompts, Bing queries, and responses through Microsoft's search and audit tools. Your workplace Copilot chats are workplace records.

The critical split is what the data is used for. Microsoft states that enterprise prompts, responses, and Microsoft Graph data are never used to train foundation LLMs, and enterprise Copilot has opted out of Azure OpenAI abuse monitoring, which includes human review of content. Consumer Copilot takes the opposite default: conversations are saved for 18 months by default and used for AI model training unless you opt out, according to Microsoft's consumer privacy FAQ.

Here is where most people get caught out — the practical differences between the two worlds:

• Enterprise: your data trains nothing, but IT can audit everything you type.
• Consumer: your conversations train Microsoft's models by default, and you must actively opt out.
• Consumer users under 18, signed-out users, and users in several excluded countries are automatically kept out of model training.
• Bing web queries sit outside both frameworks — governed by less stringent consumer terms even in enterprise deployments.

That last point deserves emphasis. The DPO Centre flags the Bing search pathway as the weakest link, warning that the search term "will leave the security of your tenancy and is governed by a different, less stringent set of terms" — a potential regulatory violation in highly regulated industries.

The real problem isn't malice — it's ambiguity. The same person often uses Copilot Chat for work tasks on a personal account, or pastes client data into a consumer app assuming enterprise protections apply. The version you're on, and the account you're signed into, determine everything about how your data is handled.

The same principle applies to the agents and skills you connect to Copilot: Microsoft itself requires organizations to check each agent's privacy statement individually, because each one handles your data differently. That's why verification before connection matters — it's the same approach SkillzBench is building into its free agent-skills directory, where every skill gets security-scanned and benchmarked before you equip it. Knowing what tracks you is step one; knowing what you've connected is step two.

What Copilot Actually Logs — and Who Can See It

Every prompt you type into a workplace Copilot becomes a record — and someone in IT can read it. That surprises many users, but Microsoft is explicit about it in its own documentation.

For enterprise users, Copilot Chat logs three things: your prompts (including any work content you paste into them), the Bing search queries your prompts trigger, and Copilot's responses. Microsoft states plainly that your IT admin can use search and audit tools to view this logged information. This stored record is what Microsoft calls the "Copilot activity history."

There's an important trade-off, though. According to Microsoft's privacy documentation, enterprise prompts, responses, and Microsoft Graph data are not used to train foundation models, and enterprise Copilot has opted out of Azure OpenAI abuse monitoring, which would otherwise include human review of content. So your workplace chats are visible to your organization but walled off from model training.

The consumer side works differently — and less favorably. Consumer conversations are saved by default for 18 months, and uploaded files and images are stored for no longer than that before automatic deletion, per Microsoft's consumer privacy FAQ. By default, that conversation activity is also used for AI model training, along with Bing, MSN, and ad-interaction data, though users can opt out at any time.

• Users can delete individual conversations or their entire history via the My Account portal
• Consumer users can opt out of model training and disable personalization
• Copilot's "memory" features can be edited or wiped, and personalized ads are managed separately
• Admins can set retention policies and manage stored data via Microsoft Purview

One wrinkle deserves attention: memory and personalization are on by default where available, and if both personalization and personalized ads are enabled, your conversation history is used to further personalize ads. The same FAQ notes exclusions — organizational accounts, users under 18, opted-out users, and several countries are left out of training data.

The lesson generalizes beyond Copilot: understand what each AI tool logs before you feed it sensitive work. The same vetting discipline applies to the agent skills and connectors you attach to any AI workflow — SkillzBench is building a free directory and MCP connector that security-scans and benchmarks agent skills before you equip them, so you always know what you're connecting.

The Hidden Risks: Bing Queries, Over-Permissioned Access, and Agents

Even when Copilot stays inside your tenancy, three weaker links quietly sit outside the enterprise protections most organizations assume they're getting.

The first is Bing. When Copilot grounds an answer with a web search, it condenses your prompt into a search query and sends it out with user and tenant identifiers removed. Microsoft is clear that these queries aren't shared with advertisers or used to train foundation LLMs, but they're governed by the Microsoft Services Agreement and Privacy Statement — not your enterprise DPA. The enterprise data protection documentation confirms the EU Data Boundary doesn't apply to web search queries, and HIPAA doesn't either. The DPO Centre flags this as a genuine compliance risk: the search term leaves the security of your tenancy under a "less stringent set of terms," which could constitute a regulatory violation in highly regulated industries.

The second weakness is permissions — or rather, Copilot's habit of amplifying the ones you already mishandle. Copilot surfaces any content a user technically has view access to across Microsoft Graph, and it can't tell the difference between legitimate access and accidental over-provisioning. Microsoft's own data shows 95% of granted permissions go unused, with 90% of identities using only 5% of what they've been granted. As identity-security vendor Oleria puts it, Copilot queries data faster than any human could, surfacing documents employees were never meant to find. Enforce least-privilege access before rollout, not after an incident.

The third is agents. Microsoft explicitly requires organizations to check each agent's privacy statement and terms of use individually — enterprise data protections don't automatically extend to every agent you connect. That vetting burden is real, and the stakes are illustrated by EchoLeak (CVE-2025-32711), a zero-click vulnerability that reportedly let attackers exfiltrate Copilot data. The same principle applies to agent skills generally: published research found roughly 26% of agent skills carry at least one vulnerability, which is why SkillzBench is building a free directory that security-scans, version-pins, and benchmarks skills before you connect them through its free MCP tool.

Before relying on Copilot's enterprise guarantees, audit all three surfaces:

• Decide whether web grounding should be restricted in regulated workflows, and run a DPIA if it stays on
• Remediate over-provisioned permissions across SharePoint, Exchange, and Teams before deployment
• Review each agent's privacy terms separately before enabling it for users
• Keep an inventory of which third-party models are enabled — Anthropic subprocessor models are currently excluded from the EU Data Boundary

Copilot's core enterprise commitments are solid, but the edges of the system — outbound search, inherited permissions, and individually vetted agents — are where your data actually leaves the safety perimeter you think you have.

Your Privacy Controls: What Users and Admins Can Do Right Now

The good news is that most of Copilot's data collection is controllable — but only if you know where the switches are. Both individual users and IT admins have concrete levers to pull, and the best time to pull them is before deployment, not after an incident.

For individual users, the first step is deleting your activity history. Enterprise Copilot users can clear their prompt and response history through the My Account portal, as Microsoft documents in its privacy guidance. Consumer users have more to do: conversations are saved for 18 months by default and used for AI model training unless you opt out, according to Microsoft's privacy FAQ for Microsoft Copilot.

Consumer users should take three actions today:

• Opt out of model training in your privacy settings — this stops your conversations and uploads from feeding future models.
• Disable personalization, since memory features are on by default and, combined with personalized ads, use history to further tailor advertising.
• Delete individual conversations or your entire history, and edit or remove anything Copilot "remembers" about you.

For admins, the priority is fixing permissions before rollout. Microsoft's own data shows 95% of granted permissions go unused, and Copilot surfaces anything a user can technically view — it cannot distinguish intentional access from over-provisioned access, as identity-security analysis from Oleria explains. Enforce least-privilege and zero-trust access first, then enable Copilot.

Admins should also use Microsoft Purview to manage stored data, set retention policies, and apply sensitivity labels, which Copilot honors along with IRM encryption rights, per Microsoft's documentation. Decide deliberately which agents to allow — Microsoft requires organizations to check each agent's privacy statement and terms of use. That verify-before-connect principle extends beyond Microsoft's ecosystem: published research found roughly 26% of agent skills carry at least one vulnerability, which is why SkillzBench security-scans and benchmarks every skill in its free directory before it earns a trust score.

Finally, if you operate in a regulated industry, run a Data Protection Impact Assessment before enabling Copilot. The DPO Centre recommends pairing it with a Legitimate Interests Assessment and an updated RoPA, noting that Bing search queries leave your tenancy under less stringent terms — a potential regulatory exposure worth documenting.

The Bigger Lesson: Verify Every AI Connection You Allow

If Copilot's privacy settings teach us anything, it's that "default" is rarely the same as "deliberate." Microsoft gives you controls — but you have to know they exist and choose to use them.

That principle applies far beyond Copilot. Every AI tool you connect to your work involves three questions: what does it log, what can it access, and what have you actually enabled? Copilot answers these transparently — enterprise prompts, responses, and Bing search queries triggered by prompts are logged, and IT admins can view them through Microsoft's search and audit tools. Consumer Copilot, by contrast, saves conversations for 18 months by default and uses them for model training unless you opt out, per Microsoft's privacy FAQ.

The same three questions apply to agent skills — the instruction packages that extend coding agents and chat-app agents. And here the picture is less reassuring: published research found that roughly 26% of agent skills carry at least one vulnerability. Connecting a skill you haven't verified is the AI equivalent of enabling Copilot without checking your permissions first.

Microsoft's own data shows why that matters. Fewer than 1% of granted cloud permissions are actually used, according to Microsoft's 2023 State of Cloud Permissions Report cited by the DPO Centre. Copilot surfaces anything a user technically has view access to — so over-provisioned access gets amplified at AI speed.

Before you connect any AI tool or skill to your workflow, ask:

• What does it log, and who can see those logs?
• What data can it access, and through whose permissions?
• Is my data used for model training by default — and can I opt out?
• Has the tool or skill been security-scanned by anyone independent?

This is the thinking behind SkillzBench, a free, independent directory of agent skills currently being built. Every skill is pinned to a specific version, license-checked, security-scanned, and benchmarked in a sandbox — with and without the skill — so you can see what it actually adds. A free MCP connector lets you toggle exactly which skills each agent sees, so connections happen by choice, not by default.

Copilot's lesson is simple: verify what you allow. That goes double for the skills and connectors you attach to your agents.

CTA: Skills, proven. Join the SkillzBench waitlist and connect agents with intent, not defaults.