Three Flavours of Copilot
First, it's crucial to understand that not all Copilots are created equal. There are three main tiers. The free version of Copilot (formerly Bing Chat) is available to anyone with a Microsoft account and is grounded in public web data. Then there's Copilot Pro,
a paid subscription for individuals on Microsoft 365 Personal or Family plans. This unlocks Copilot features within Office apps like Word and PowerPoint for personal use. Finally, there's Copilot for Microsoft 365, the enterprise-level solution designed for businesses. This version is the most powerful, as it can access and reason over your organization's internal data—emails, Teams chats, SharePoint files, and more—all while being governed by strict commercial data protection policies. The key difference lies in the data they can access and the privacy guarantees they offer.
The Blended Account Scenario
The confusion often arises when a user has a personal Microsoft account (like an outlook.com address) but their employer assigns a Copilot for Microsoft 365 license to it. Another common scenario is when an employee with a personal Copilot Pro subscription wants to use it on work documents. Microsoft's ecosystem is designed to accommodate this. Within Microsoft 365 apps like Word or Excel, you can be signed in to multiple accounts simultaneously—your personal one and your work or school one. The system is built to differentiate between the contexts. The license simply enables the Copilot functionality; the context in which you use it determines which data it can see and what privacy rules apply. Simply having the license on your personal account doesn't automatically grant Copilot access to your work files, nor does it expose your personal data to your employer.
Commercial Data Protection is Key
The most important concept to grasp is "commercial data protection." This is Microsoft's promise to business customers. When you are signed in with a work or school account (an Entra ID account) and use Copilot, this protection automatically applies. It guarantees that your prompts, the data Copilot accesses on your behalf, and the responses it generates will not be saved, will not be used to train the public AI models, and will not be seen by Microsoft engineers. Your organization's data remains within your Microsoft 365 tenant, protected by the same security and compliance policies that govern the rest of your work data. So, if you're using a Copilot for Microsoft 365 license to analyze a work document stored in your company's SharePoint, your interactions are protected, regardless of whether that license is technically tied to a personal Microsoft account login.
What About Your Personal Data?
Conversely, when you are using Copilot in a purely personal context—say, drafting a family newsletter in Word using a document saved to your personal OneDrive—the enterprise-grade commercial data protection does not apply. Instead, Microsoft's standard consumer privacy policies take effect. For users with a Copilot Pro plan, Microsoft states that prompts and content are not used to train the foundation models. For free users, you have an option in your privacy settings to opt out of having your conversation history used for model training. Your employer has no visibility or control over your activity in this personal context. The boundary is clear: work data is governed by work policies, and personal data is governed by personal account settings.
The Practical Workflow: Who Sees What?
In practice, Copilot's access is determined by the file's location and the account you're actively using. If you open a work document from your company's SharePoint, Copilot operates under your work identity, respecting all organizational permissions. It cannot access a file you don't have permission to see. Your IT admin can set policies and audit usage related to this work activity. If you then switch to a personal document on your own OneDrive, Copilot operates in a different mode. It cannot see your work files, and your employer cannot see your personal activity. Chat history is also separated. Enterprise chats are managed by company retention policies, while your personal chat history can be managed through your Microsoft account's privacy dashboard. The system is designed to keep these worlds separate, even when they exist within the same app.
