The short answer

6 dated Copilot changes to check against your own settings.

Microsoft 365 Copilot, now called Microsoft Copilot, is not the product a firm licensed a year ago. Most of the changes came without your firm choosing them: a model provider switched on, a name changed, a plan retired, a rule added. The table lists the 6 changes since 2026-04-03 that the four briefs in this series read at the source, newest first. When a default changes and nobody decides, the new default decides for your firm. Have your administrator open each setting the table names, decide, and write down the decision with the date.

The log

Newest first. Every row names the brief that read the source. The source itself is listed at the end of the page.

QuestionWhat changedWhat it meansWhere it lives
2026-09-16
page posted		Microsoft renamed its work product from Microsoft 365 Copilot to Microsoft Copilot, and the same Copilot app now serves personal accounts as well as work and school accounts.The name no longer tells anyone which terms apply. The account does, and a staff member signed in with a personal account is outside the settings the firm controls.The account a person signs in with. Read in Governed vs Ungoverned Copilot
2026-07-24GPT models that OpenAI runs itself, as a subprocessor Microsoft hires, switched on by default for all users at eligible commercial customers, unless an administrator turns them off.A second outside provider reaches prompts unless someone decided otherwise. Microsoft excludes it from its promises to run the model in the customer's own country, where those apply.Microsoft 365 admin center, Copilot, Settings, View all, AI providers operating as Microsoft subprocessors. Read in Governed Copilot vs Claude
2026-07
stated as a month		Microsoft added a setting that lets non-federal customers in GCC, one of its government clouds, use Anthropic models. It came the same week OpenAI's own models were switched on by default.GCC customers gained a choice they did not have. Anthropic models remain unavailable to federal customers in GCC and to any customer in GCC High or Department of Defense environments.The same AI providers setting, for GCC tenants. Read in Governed vs Ungoverned Copilot
2026-07-09Copilot's GPT-based features began running on models that OpenAI operates itself, not only on the GPT models Microsoft runs in its own cloud.Same feature, different company running the model, different processing commitments. The company changed first, two weeks before the default followed.The same AI providers setting. Read in Governed Copilot vs Claude
2026-06-16Copilot Cowork, which carries out tasks rather than answering questions, became generally available. It runs on Anthropic models and stays off until an administrator turns it on.An AI that takes actions is a different risk from one that answers questions. This one is off by default, so turning it on is a decision you can date.An administrator switch, off until turned on. Read in Governed Copilot vs Claude and Claude's Microsoft 365 Connector
2026-04-03Microsoft changed the timeline and scope of in-country processing for Copilot, its November 2025 commitment to run the model inside a customer's own country. The United States is still expected by the end of 2026.Where the model runs is still not a commitment for U.S. tenants. Where the prompt and the response are stored is settled and separate: in the firm's Microsoft 365 default geography, committed for the United States.Nothing to set; a Microsoft roadmap date. Read in Governed Copilot vs Claude and Governed vs Ungoverned Copilot
Dates are Microsoft's own, as printed in the brief that cites the source. A date marked "page updated" is the source page's date, because the page gives none for the change itself.

How to read this log

Each row is one change, one source, one date.

§

The columns, the dates, and what is left out

+

Four columns:

  1. the date Microsoft made the change
  2. what changed
  3. what it means for a firm that holds client data
  4. where the setting lives, or who it reaches

The last column also names the brief in this series that read the source, so you can follow every row back to a sentence and a date.

The dates are Microsoft's, not ours. Where Microsoft gives a day, the row shows the day. Where it gives only a month, the row shows the month. Sometimes the source page gives no date for the change itself. Then the row shows the source page's own date, and says so. Every entry was read at the source, in the brief that cites it.

This is not every change Microsoft has made. It is every change the series read at the source while the four briefs were written. We kept only the changes that bear on four things:

  1. what an assistant can read
  2. which models it may use
  3. where the data goes
  4. whether there is a record

A change that touches none of those four is not here.

Two things sit outside the table. First, Microsoft no longer sells Copilot Pro. It said so on October 1, 2025, when it introduced Microsoft 365 Premium and pointed Copilot Pro subscribers to it. That changes what staff can buy, not a setting in your tenant, so it is not a row here. It still matters: a firm can have staff on three different Copilot products at once.

Second, Microsoft expects to offer processing inside the United States for U.S. tenants by the end of 2026. A U.S. tenant is a firm whose Microsoft 365 default geography, the place its Microsoft 365 data is stored, is the United States. That is an expectation with a date, not a change that has happened. It is not a commitment today.

Storage is not on this list at all, because it has not changed. Microsoft stores the prompt and the response in your firm's Microsoft 365 default geography. It commits to that for U.S. tenants today. Every row above is about where the model runs. That is the question that keeps moving.

The date at the top of the page is the last time an entry was added. There is no schedule behind it. A new row appears when a change has been read at the source, and not before.

When a new row appears

When Microsoft changes a default, your firm faces the decision again. If nobody makes it, the new default makes it for you. Five steps, in order.

  1. Open the setting the row names in your firm's Microsoft 365 and note what it says today.
  2. Decide, group by group, whether the new default is what the firm wants for the people who handle client data.
  3. Write the decision down, with the date, in the same place you record your other settings.
  4. Check that the audit log or the retention policy still works: search it once. Then you know it works, instead of assuming it does.
  5. Tell the people it affects, in one line, what changed and what they should do differently, if anything.

If your firm has nowhere to record the decision, that gap is the first thing to fix. Start with Governed vs Ungoverned Copilot.

Sources

§Sources5 sources · Microsoft 5+

Microsoft

  1. Microsoft Support: Copilot app updates for personal, work, and school accounts posted 2026-09-16
  2. Microsoft Learn: Anthropic models in Microsoft Online Services page updated 2026-09-18
  3. Microsoft Learn: OpenAI as a subprocessor in Microsoft Online Services page updated 2026-08-18
  4. Microsoft 365 blog: Copilot Cowork is now generally available posted 2026-06-16
  5. Microsoft 365 blog: in-country data processing for Copilot posted 2025-11-04, editor's note 2026-04-03

Claremont Security sets up governed Microsoft Copilot for regulated firms, and the quarterly posture review is where the rows on this page are checked against the tenant. To see where your firm stands before anyone calls, try the AI Readiness Check. It is free and needs no account: claremontsecurity.com/readiness

claremontsecurity.com/insights/copilot-change-log