Microsoft Copilot Data Residency Australia: What Stays Local and What Doesn't

What Microsoft actually commits to

Microsoft 365 Copilot was added as a covered workload under Microsoft's data residency commitments in the Microsoft Product Terms and Data Protection Addendum on 1 March 2024. In practice, this means Copilot is included under Microsoft's Advanced Data Residency (ADR) and Multi-Geo Capabilities offerings, the same framework that governs where core Microsoft 365 data like email and documents is stored for customers who've configured it.

The gap: EU customers get a stronger guarantee than everyone else

This is the detail that matters most for Australian businesses. Microsoft's documentation states plainly that Copilot calls to the underlying language model are "routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods." European Union customers have an additional safeguard, the EU Data Boundary, which is a stronger baseline commitment than Australia has. That guarantee is narrower than it used to be, though: since April 2026, Microsoft's "Flex Routing" feature has been enabled by default for EU and EFTA tenants, allowing inference processing to occur outside the EU during high-demand periods unless a tenant explicitly disables it. Microsoft's own wording for non-EU customers, including Australia, remains direct: queries "may have their queries processed in the US, EU, or other regions."

What this means in practice

Your organisation's stored Microsoft 365 content, emails, documents, and Copilot interaction history, can be kept within an Australian data residency boundary if your tenant is configured for it. What isn't guaranteed to stay local is the momentary processing step where a Copilot prompt is sent to the language model for a response. During normal load this likely stays close to Australia, but Microsoft's documentation explicitly allows it to route elsewhere when regional capacity is constrained. For a business with no dedicated IT department, the practical takeaway is: don't assume "Australian data residency" configured for Microsoft 365 automatically means every Copilot interaction never leaves the country.

Why this differs from a straightforward ChatGPT comparison

Microsoft's setup is genuinely more configurable than most standalone AI tools, since it inherits your existing Microsoft 365 tenant's residency settings rather than being a separate service with its own fixed location. That's a real advantage over tools with no residency configuration options at all. It's also more complicated to reason about for exactly that reason, since the guarantee depends on your specific tenant configuration and the workload in question, not a single blanket answer. For the broader picture across all major AI tools, see our anchor guide to where AI tools store your data.

What to actually ask Microsoft or your partner

Ask specifically whether your tenant has Advanced Data Residency or Multi-Geo configured, and whether that configuration extends to Copilot workloads specifically, not just core Microsoft 365 services. Ask what happens during high-utilisation periods for your region. If your business handles data with a genuine hard requirement to never leave Australia, get this in writing from Microsoft or your reseller rather than relying on general marketing language. Our AI vendor due diligence checklist covers the broader set of questions worth asking any AI vendor, not just Microsoft.

What Advanced Data Residency and Multi-Geo actually mean

These two terms come up constantly in Microsoft's own documentation, and it's worth understanding them in plain English rather than treating them as interchangeable jargon. Advanced Data Residency designates a specific home geography for a tenant's core data, effectively telling Microsoft's systems where your organisation's data should default to living. Multi-Geo is a related but separate capability aimed at larger organisations with staff or data requirements spread across multiple regions, letting different parts of the same tenant have different home geographies rather than one setting for the whole organisation. Neither of these is switched on by default for every Microsoft 365 customer, they typically require a specific licensing tier and configuration step, which is exactly why asking whether your tenant is actually configured for this is a meaningfully different question from asking whether Microsoft offers it at all.

How to read a vague answer from a partner or reseller

If a Microsoft partner or reseller responds to a residency question with a blanket assurance that Microsoft keeps Australian data in Australia, without qualifying it further, treat that as an incomplete answer rather than a confirmed one. A specific, trustworthy answer names the actual configuration (Advanced Data Residency or Multi-Geo), confirms whether it's actually enabled on your tenant specifically, and addresses the Copilot processing gap described above directly rather than folding it into a general statement about Microsoft 365 data. If a partner can't distinguish between your stored documents staying in Australia and your Copilot prompts always staying in Australia, it's worth escalating the question to someone at Microsoft directly, or getting the answer in writing before relying on it for a genuinely hard requirement.

Related reading: our can staff upload customer data to AI tools, our AI and the Privacy Act guide, and our AI data residency in Australia.

Related reading: our free AI staff policy template, our Claude AI review for Australian business, and our Microsoft Copilot pricing in Australia.

Related reading: our AI governance by region.

Try our free AI Privacy Risk Scorer to score your current AI tool setup against Privacy Act requirements.

Does Australia get the same data residency guarantee as the EU?

No, though the gap has narrowed. The EU Data Boundary remains a stronger baseline commitment than Australia has. But since April 2026, Microsoft's "Flex Routing" feature has been enabled by default for EU tenants, meaning EU queries can also be processed outside the EU during high demand unless a tenant explicitly opts out. Australian customers' Copilot queries may be processed outside Australia during high utilisation, per Microsoft's own documentation, with no equivalent EU-style boundary option available at all.

Is my regular Microsoft 365 data (email, documents) also affected by this gap?

Core Microsoft 365 data residency commitments are separate and can be configured for your region if your organisation has set up Advanced Data Residency or Multi-Geo. The gap discussed here is specific to the momentary Copilot LLM processing step, not your stored documents and email.

Does this mean Copilot is less safe than other AI tools for Australian businesses?

Not necessarily less safe, but the residency guarantee is more conditional than a simple "stays in Australia" claim would suggest. Compare this honestly against your specific requirements rather than assuming Microsoft's enterprise reputation automatically means stricter data handling than every alternative.

Who is Anthropic and why are they mentioned in Microsoft's Copilot documentation?

Microsoft has added Anthropic's models as an available option within some Copilot experiences. Microsoft's documentation explicitly states Anthropic models are out of scope for the EU Data Boundary and in-country processing commitments, meaning even the strongest existing guarantee has exceptions depending on which underlying model handles your request.

Do I need an enterprise Microsoft 365 plan to get Advanced Data Residency?

Advanced Data Residency and Multi-Geo are generally available on higher enterprise licensing tiers rather than standard small-business plans, and typically involve an additional configuration step rather than being automatic. Confirm current eligibility and cost directly with Microsoft or your reseller for your specific plan, since licensing tiers and inclusions change over time.

I already use Copilot and don't know if my tenant has data residency configured. How do I check?

Your Microsoft 365 admin centre shows tenant-level configuration details, or your IT partner/reseller can check this on your behalf. If nobody at your business has confirmed this before, that's itself a sign worth acting on, particularly if you handle any data with a genuine requirement to stay in Australia.