OpenAI Subprocessor Role Changes Copilot’s Risk Profile

Microsoft added OpenAI as a Microsoft Online Services subprocessor for certain Microsoft 365 Copilot (M365 Copilot) and Copilot Studio services as of June 2026. This means that Copilot requests can be handled by OpenAI-operated infrastructure rather than by Microsoft-operated Azure OpenAI infrastructure, the default for M365 Copilot. This is similar to the existing subprocessor arrangement with Anthropic, which is governed by Microsoft’s Product Terms, Data Protection Addendum, enterprise data protection commitments, and contractual safeguards.

As of July 24, 2026, OpenAI-operated models were enabled in M365 tenancies for eligible commercial customers, although it’s not clear how these models will be visibly distinguished from Azure OpenAI models in the Copilot model selector. Admins can disable the OpenAI service or manage access to it using security groups without affecting the Azure OpenAI services used by M365 Copilot. OpenAI models are included in the E.U. Data Boundary, but they are not available in government or sovereign clouds.