Key takeaways
- Work and school Copilot keeps prompts and responses inside your organisation's Microsoft 365 boundary, follows existing permissions and is not used to train the foundation models.
- Consumer Copilot and GitHub Copilot on personal plans have their own privacy settings; review them once and choose deliberately.
- Copilot only sees what your account can already open, so oversharing in SharePoint and Teams is the real data risk.
- Connectors bring outside systems such as Jira or ServiceNow into Copilot's index, with each item's permissions preserved.
- Choose the Copilot by the job: Microsoft 365 Copilot for work documents, GitHub Copilot for code, Copilot Studio to build agents.
Whether Copilot shares your data depends on which Copilot you use. Microsoft 365 Copilot for work and school keeps your prompts and responses inside your organisation's Microsoft 365 environment, respects existing permissions, and does not use them to train the foundation models. Consumer Copilot for personal accounts and GitHub Copilot have their own privacy settings. This page explains the Copilot app, what is saved and where, whether OpenAI sees your data, how GitHub Copilot handles code, what connectors are, and which Copilot fits which job, with agent examples.
What is the Copilot app?
There are two main Copilot apps. The Microsoft 365 Copilot app, formerly the Microsoft 365 or Office app, is the hub for work files, Copilot Chat and agents. The Microsoft Copilot app is the consumer assistant for personal accounts on Windows, the web and phones.
Also asked as: what is copilot app
The Microsoft 365 Copilot app opens your recent Word, Excel and PowerPoint files, gives you Copilot Chat grounded in the web and, with a licence, in your work data, and lists agents your organisation provides. The consumer Copilot app is a general assistant like ChatGPT: chat, voice, image generation and web answers. GitHub Copilot, by contrast, lives inside code editors, not in a standalone app. If you are unsure which you have, check the account shown in the corner: a work account means the Microsoft 365 version.
Will Copilot share my data?
Microsoft 365 Copilot does not share your work data outside your organisation's tenant, and only shows you content you already have permission to open. Consumer Copilot processes your data under Microsoft's privacy statement, with settings that control some uses.
For work accounts, Microsoft's commitments include: prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models; data stays within the Microsoft 365 service boundary; and existing security, compliance and data residency commitments apply. For personal accounts, review Copilot's privacy settings, which include controls over personalisation and whether your conversations may be used to improve models. In both cases, do not paste passwords, identity numbers or other people's private data into a prompt.
Does Copilot save your data?
Yes, in most cases. Consumer Copilot keeps your conversation history until you delete it. Microsoft 365 Copilot stores interactions within your organisation's environment so they can be governed by retention and compliance policies.
On a personal account, you can delete individual conversations or your whole history from Copilot's settings or your Microsoft privacy dashboard. On a work account, your organisation decides how long Copilot interactions are kept, in the same way it decides for email and Teams chats, and deleting a chat from your view may not delete the organisation's record. Files you upload to Copilot Chat on a work account are typically stored in your OneDrive. Assume what you type into any assistant may be kept and reviewed.
Where is Copilot data stored?
Microsoft 365 Copilot data is stored in Microsoft's cloud within your organisation's Microsoft 365 tenant, under the same data residency commitments as the rest of your Microsoft 365 data. Consumer Copilot data is stored in Microsoft's cloud under its consumer privacy terms.
Also asked as: where copilot data is stored
For organisations, that means Copilot interaction data sits with your mailbox and other Microsoft 365 content, and is covered by tools such as retention policies, audit logs and eDiscovery. Organisations in the EU also have Microsoft's EU Data Boundary commitments. Generated files and uploads usually land in OneDrive or SharePoint, inside the same tenant. If your college or company has specific data residency needs, the Microsoft Learn page on Copilot privacy and the admin centre are the authoritative sources.
Does Copilot share data with OpenAI?
Microsoft states that Microsoft 365 Copilot uses OpenAI models hosted in Microsoft's Azure cloud, not OpenAI's own services, so your prompts and work data are not sent to OpenAI and are not used to train OpenAI's models.
The distinction is between the model and the service. OpenAI builds the GPT models; Microsoft runs copies of them in its own data centres through the Azure OpenAI Service and its Copilot infrastructure. OpenAI does not receive the data flowing through Microsoft's deployment. The same separation applies to the consumer Copilot app, which runs on Microsoft's infrastructure under Microsoft's privacy statement. Microsoft has also added models from other providers in some features, and its documentation notes where data handling differs, so check those notes if your organisation enables them.
Does GitHub Copilot share your data?
GitHub Copilot sends the code context around your cursor and your chat prompts to GitHub's service to generate suggestions. For business and enterprise plans, GitHub states that this data is not used to train its models. Individual plans have settings controlling such use.
On Copilot Business and Enterprise, organisation admins control policies such as which models are allowed and whether suggestions matching public code are blocked. On individual plans, check your GitHub Copilot settings for options about data use for product improvement and choose deliberately. Practical rules for any plan: keep secrets out of source files and prompts, add sensitive files to content exclusions where available, and follow your employer's policy on AI tools. The details per plan are in GitHub's Copilot documentation and trust centre.
What are Copilot connectors?
Copilot connectors, previously called Microsoft Graph connectors, bring content from systems outside Microsoft 365, such as ServiceNow, Jira, Confluence, Salesforce, file shares or websites, into the index that Microsoft 365 Copilot searches.
Without connectors, Copilot only knows your Microsoft 365 content: mail, Teams, SharePoint and OneDrive. With a connector, an employee can ask "what is the status of the onboarding tickets for the new interns?" and get an answer that draws on items in the ticketing system, with links back to them. Microsoft provides prebuilt connectors for many popular services, and developers can build custom ones for internal databases. Admins set them up, so as a user you will see their results appear in Copilot answers and Microsoft Search.
How do Copilot connectors work?
A connector crawls an external system, converts its items into a standard schema with their text, properties and access permissions, and loads them into the Microsoft Graph index. Copilot then retrieves from that index at question time.
The important detail is access control: each item carries an access list, so a user only sees results for items they could open in the original system. Connectors refresh on a schedule, with full crawls and faster incremental crawls, so recent changes appear after a short delay. This is retrieval-augmented generation at company scale: the same pattern I built in RAG.NextUpgrad, where retrieval quality decides answer quality. Clean titles, good metadata and correct permissions in the source system make connectors far more useful.
Which Copilot is right for me?
Pick by the work you do. Microsoft 365 Copilot for documents, email and meetings at work, consumer Copilot for personal questions and creativity, GitHub Copilot for writing code, and Copilot Studio for building your own agents.
A quick guide:
- Student or personal use: the free consumer Copilot, or Copilot Chat through your college account.
- Office worker: Microsoft 365 Copilot if your organisation licenses it; Copilot Chat otherwise.
- Developer: GitHub Copilot in your editor and on GitHub.
- Team that needs a custom assistant: Copilot Studio or Agent Builder.
Microsoft Learn publishes a comparison of the Copilot offerings that is kept up to date; use it to check current features before buying anything.
What are some examples of Copilot agents?
Copilot agents include Microsoft's built-in research and data analysis agents in Microsoft 365 Copilot, meeting and project agents in Teams, GitHub Copilot's coding agent, and custom agents organisations build with Copilot Studio.
Also asked as: examples copilot agents
Examples of custom agents that work well:
- An HR policy agent that answers leave and travel questions from the policy documents, with citations.
- An IT helpdesk agent that answers common questions and creates a ticket when it cannot.
- A sales assistant that summarises an account from CRM records through a connector.
- A college admissions agent that answers questions from the prospectus and fee notices.
- A coding agent that picks up small GitHub issues and opens pull requests for review.
The best agents have a narrow job, trusted knowledge sources, a clear handover to a person, and logs you review every week.
Sources
GenAI engineer and AI product builder with 2+ years shipping production-grade AI systems: RAG pipelines, fine-tuned LLMs, hybrid retrieval and multi-modal apps across vision, speech and OCR, architected end to end from ingestion to deployment. Leads engineering for SCULT INDIA's 14-member team, founded the 500+ member TechVerse Enclave community and has mentored 200+ students. Three hackathon first prizes: Changethon 2025 (IIT Roorkee), Product Genesis at Vividhotsava 2025 (CSJMU) and BYTEBATTLE (MeetKats).
Open to GenAI roles, hackathon judging, mentorship sessions and guest talks at colleges. For campus sessions the inviting institution covers the visit end to end: travel (a First AC train ticket for journeys up to five hours, a flight for anything longer), accommodation, meals, and pickup and drop; the honorarium and workshop fees are negotiable on WhatsApp or on the call, and requests are welcome from institutions that can cover the visit this way. Email pranjulrathour41@gmail.com.
