Sample Vendor Chain Audit: Microsoft 365 Copilot

Sample. This is a free public sample of a Vendor Chain Audit. It is not a paid engagement, not a customer report, and not legal advice. Unknowns are left unknown. No edge in this sample was inferred from a product name, a purpose string, or a vendor's reputation.

Microsoft's own documentation says Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat, with no change to the security, compliance, and privacy commitments described on that page. This sample keeps the requested name and records that rename.

What was run

Tiers 1 and 2 come from the internal Vendor Chain Audit CLI on a fresh cache:

node --experimental-strip-types tools/audit/cli.ts --max-depth 2 --cache /tmp/m365-audit/cache --delay-ms 200 --out /tmp/m365-audit/cli.md microsoft.com

• Started: 2026-10-19T22:26:26Z
• Finished: 2026-10-19T22:26:36Z
• Exit code: 0
• Report generated: 2026-10-19T22:26:26.542Z
• Full CLI output: microsoft-365-copilot-cli.md

The CLI summary for that run: 1 input, 343 vendors, 424 edges, 11 AI flags, 0 change-feed entries, 254 gaps, 6 cycles stopped. Those counts are the company-wide Microsoft map at depth 2. They are not a count of Microsoft 365 Copilot subprocessors.

Third Party Index has no vendor page for the product. On 2026-10-19T22:32:50Z these public markdown URLs returned HTTP 404: `microsoft-365-copilot`, `microsoft-copilot`, `copilot`, `microsoft-365`, `m365`, `office-365`. `microsoft` returned HTTP 200. The CLI input was therefore `microsoft.com`, which maps to the company-wide Microsoft list. That list is not a Copilot-only list.

How the tiers are counted

• Tier 1. Names on Microsoft's indexed subprocessor list.
• Tier 2. Names on the lists of those tier-1 vendors, where the index has a tracked vendor and the walk has not already visited that vendor.
• Tier 3. Names on the lists of those tier-2 vendors. This run stopped at depth 2, so the CLI has no tier 3. Tier 3 was checked by hand against the primary pages named below. Those pages do not publish that next hop. No tier-3 edge is recorded.

Tier 1, the path to OpenAI and Anthropic

The CLI read Microsoft's subprocessor CSV from Third Party Index at 2026-10-19T22:26:26.917Z (evidence 3196). Two rows on that list are the OpenAI and Anthropic edges:

The same CSV also lists Fireworks AI, Inc. as a flagged AI-model host, and GitHub, Inc. and SpaceXAI, LLC with purpose text "AI model provider". GitHub, Inc. and SpaceXAI, LLC are not on the AI classification list, so the CLI does not flag them. Purpose text is not a flag. The rest of tier 1, including affiliates and staffing firms, is in the CLI file. A row on that company-wide list is not, by itself, a finding that the row processes Microsoft 365 Copilot data.

Primary source: Microsoft Online Services Subprocessors

Fetched 2026-10-19T22:28:43Z from the document URL named on the Third Party Index Microsoft page and not fetched by the CLI:

https://api.servicetrust.microsoft.com/api/v2/downloadDocuments/115f1cb5-7f7b-4a5e-838d-df6d03c84dda/24924773-fe0a-424d-913e-c17204d4ebf8

The response was a 12-page PDF, `Microsoft Online Services Subprocessors`, date of issue September 10, 2026. Section 3, "Artificial Intelligence Subprocessors", says those subprocessors provide services to support, operate, or maintain AI functionality in Microsoft Online Services, and that they may process, store, or otherwise access customer data and personal data. In that section the PDF names:

The same section also names GitHub, Inc., Fireworks AI, Inc., and SpaceXAI, LLC. The PDF does not contain the word Copilot. The applicable service printed for these rows is Microsoft Online Services, not a Copilot-only product. The PDF's only "Microsoft 365" sentence is about Service Message Center notices for SaaS administrators.

The licensing-docs URL https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA was fetched at 2026-10-19T22:29:48Z. The page that came back does not contain a subprocessor list and does not name OpenAI or Anthropic. This sample does not treat that URL as the DPA text.

Primary source: Microsoft Copilot documentation

Fetched 2026-10-19T22:29:48Z:

Data, Privacy, and Security for Microsoft Copilot

The page title is "Data, Privacy, and Security for Microsoft Copilot". `ms.date` is 2026-07-09. The page's `updated_at` is 2026-10-08T08:51:00Z. It states that Anthropic provides models as a subprocessor within Microsoft Copilot experiences, and that OpenAI provides models as a subprocessor within Microsoft Copilot experiences. It also states that an admin can decide whether those models power the experiences, and that Microsoft may deploy other models that are hosted and operated by Microsoft. For those Microsoft-operated models, the page says no data leaves Microsoft. It points at two further articles.

Fetched 2026-10-19T22:30:10Z:

Anthropic models in Microsoft Online Services

`ms.date` and `updated_at` are 2026-09-18. The article says Anthropic has onboarded as a Microsoft subprocessor, and that Anthropic models are deployed in Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps. It says those models are on by default for most commercial-cloud customers, excluding EU/EFTA and the UK, where they are disabled by default, and that they are currently excluded from the EU Data Boundary and, when applicable, in-country processing commitments. It also says some Anthropic models labeled "Anthropic models with Data Retention" are offered under Anthropic's separate commercial terms and data processing agreement, and must be enabled separately. The article does not list Anthropic's subprocessors.

Fetched 2026-10-19T22:30:10Z:

OpenAI as a subprocessor in Microsoft Online Services

`ms.date` and `updated_at` are 2026-10-09. The article says it applies only to OpenAI models operated by OpenAI, provided by OpenAI as a subprocessor. It says it does not apply to OpenAI models operated by Microsoft (Azure OpenAI). It says OpenAI was added to the Microsoft Online Services Subprocessors List on June 23, 2026, and that OpenAI as a subprocessor is available for use as of July 9, 2026. It says that as of July 24, 2026, OpenAI-operated models are enabled for all users for eligible commercial customers unless an admin sets the control to "No users". It says those models serve GPT-based Copilot experiences, are not currently available in government or sovereign clouds, and are included in the EU Data Boundary except as the EU Data Boundary documentation notes. The article does not list OpenAI's subprocessors.

Fetched 2026-10-19T22:30:10Z:

Understanding AI functionality and models in Microsoft Online Services

`ms.date` and `updated_at` are 2026-09-10. For AI models hosted and operated by Microsoft, including Azure OpenAI, the article says data does not leave Microsoft. An AI subprocessor, in that article's terms, handles data on Microsoft's behalf under Microsoft's Data Protection Addendum. Which of those two arrangements a given tenant uses is an admin setting. This sample does not know any tenant's setting.

Tier 2, OpenAI's and Anthropic's own lists

The CLI fetched OpenAI's CSV at 2026-10-19T22:26:33.487Z and Anthropic's CSV at 2026-10-19T22:26:29.529Z. Those sections are "Via OpenAI" and "Via Anthropic" in the CLI file. Both vendors list Microsoft, so the CLI kept the edge and stopped the walk (a cycle, not a deeper tier).

OpenAI's published list

Rendered 2026-10-19T22:30:41Z from https://openai.com/policies/sub-processor-list/. The page says "Last updated: October 14, 2026". A direct fetch without a browser received HTTP 403; the names below are from the rendered page.

The page says OpenAI engages these entities to process customer data as defined in the OpenAI Data Processing Agreement. The product column on the third-party rows is API and ChatGPT Enterprise, Edu, and Business, with the footnotes printed on that page (zero data retention, customer election). The page does not mention Microsoft 365 Copilot, Microsoft Copilot, or Microsoft Online Services. Whether these same entities process data when OpenAI acts as Microsoft's subprocessor is unknown.

Third-party names on that page: Accenture International Limited; Amazon Web Services, Inc.; Cerebras; Cinder Technologies, Inc.; Cloudflare, Ltd.; CoreWeave, Inc.; Fivetran, Inc.; Google Cloud Platform; Merge API, Inc.; Microsoft Corporation; Oracle Cloud Infrastructure; Pylon Labs; Salesforce; Snowflake, Inc.; TaskUs, LLC; WorkOS, Inc.

Affiliate names on that page: OAI International, Inc.; OpenAI Ireland Ltd.; OpenAI Japan Ltd.; OpenAI UK Ltd.; OpenAI, OpCo, LLC.

Those 21 published names are the same 21 names in the CLI "Via OpenAI" section. Microsoft Corporation is listed there for cloud infrastructure, across the countries printed on the page. That is the cycle the CLI stopped. Cerebras is the only AI-list flag in that section. The CLI marks the affiliate row "OpenAI, OpCo, LLC" as "not on list" even though the resolved vendor slug is `openai`. See CLI gaps.

The page does not name the subprocessors of Microsoft, Amazon Web Services, Google Cloud Platform, Cloudflare, CoreWeave, Oracle, Cerebras, Snowflake, or any other row. Those tier-3 edges are unknown.

Anthropic's published list

Rendered 2026-10-19T22:30:46Z from https://trust.anthropic.com/subprocessors. The HTML shell is a trust-center application; the names below are from the rendered page, including its "All subprocessors" block. The rendered page does not show a last-updated date.

The page scopes rows to Anthropic products (all products, Claude for Work, Claude for Government, Claude Free/Pro/Max, and the exceptions printed on the page). It does not mention Microsoft 365 Copilot or Microsoft Online Services. Whether these entities process data when Anthropic acts as Microsoft's subprocessor is unknown.

Names on that page: Amazon Web Services; Arkose Labs; Boldr; Brave Search; Cloudflare; ElevenLabs; Functional Software, dba Sentry; Google Cloud Platform; Intuition Machines, Inc. (hCaptcha); Intercom; Iterable; Microsoft Azure; Nutun; Palantir Federal Cloud Service (PFCS); Parallel Web Systems, Inc.; Persona; Sift; Stripe; TurboPuffer; Twilio; WorkOS; Yoti.

Those 22 published names are the same 22 names in the CLI "Via Anthropic" section. Microsoft Azure is listed for cloud infrastructure, products "All Products", location Worldwide. That is the cycle the CLI stopped. None of these 22 rows is an AI-list flag. The CLI's purpose cells cut some "[More Information](" links; the rendered page has the full notes.

The page does not name the subprocessors of Amazon Web Services, Google Cloud Platform, Microsoft Azure, Cloudflare, or any other row. Those tier-3 edges are unknown.

Tier 3

No tier-3 edge is recorded.

The CLI was limited to depth 2. The manual check used Microsoft's Online Services subprocessor PDF and the Microsoft Copilot articles above, plus OpenAI's subprocessor page and Anthropic's subprocessor page, at the fetch times in this sample. Microsoft's pages name OpenAI and Anthropic. They do not name OpenAI's or Anthropic's subprocessors. OpenAI's and Anthropic's pages name their own subprocessors and do not name the subprocessors of those subprocessors.

In particular, there is no recorded edge from Microsoft 365 Copilot to a subprocessor of Amazon Web Services, Microsoft Azure, Google Cloud Platform, Cloudflare, CoreWeave, Oracle, Cerebras, Snowflake, or any other tier-2 name. That hop is unknown.

Unknowns left unknown

• Whether a particular tenant has OpenAI-operated models or Anthropic models turned on. Microsoft's articles describe admin controls and defaults. This sample has no tenant configuration.
• Whether Azure OpenAI, which Microsoft operates and describes as data not leaving Microsoft, is the model path a tenant actually uses. That path is not the OpenAI-as-subprocessor path.
• Whether "Anthropic models with Data Retention", which Microsoft says sit under Anthropic's own terms, are enabled.
• Whether OpenAI's ChatGPT and API subprocessors, or Anthropic's Claude subprocessors, are in the path when those companies act as Microsoft subprocessors.
• Any tier-3 name.
• Any Copilot-only subprocessor list. None was found at the URLs fetched here. The Service Trust PDF is the company Online Services list.

CLI gaps hit on this run

• No product input. Slugs for Microsoft 365 Copilot and the nearby names above 404. `microsoft.com` pulls the company-wide list, which mixes affiliates, staffing firms, and product-specific rows such as Azure Databricks, Azure NetApp Files, and Azure Maps.
• The CLI prints the vendor document URL and does not fetch it. The Service Trust PDF was retrieved by hand.
• Depth 2 never requests the subprocessors of OpenAI's and Anthropic's subprocessors. That is the missing tier 3.
• Names with no tracked vendor URL are gaps, not empty chains. OpenAI's CSV has no vendor link for OpenAI Ireland Ltd., OpenAI Japan Ltd., OpenAI UK Ltd., or OpenAI, OpCo, LLC. The report still shows "OpenAI, OpCo, LLC" under slug `openai` because the name folds onto the tracked OpenAI row, and the AI column says "not on list" because the flagger saw the raw name and an empty tracked slug. The tier-1 name "OpenAI OpCo, LLC" is flagged.
• AI flags use the published name, a parenthetical, or the tracked slug. They do not use purpose text. GitHub, Inc. and SpaceXAI, LLC stay unflagged on Microsoft's list despite the purpose "AI model provider". The GitHub tier-2 row whose published name is xAI is flagged. That flag is not a Copilot finding.
• Purpose cells lose markdown link targets. Anthropic rows show a broken "[More Information](" fragment.
• Cited evidence snapshot URLs are not downloaded.
• The company-wide depth-2 map is large (343 vendors, 254 unresolved names) and is the wrong shape for a product question. A product filter, or a fetch of the vendor PDF, would have been the useful next step. Neither exists in the CLI.

Attribution

Tiers 1 and 2 are data from Third Party Index, used under CC BY 4.0. Cite the Microsoft vendor page as Microsoft, Third Party Index, https://thirdpartyindex.com/vendors/microsoft. Evidence quoted by the index remains the vendors' own documents. The PDF and Learn pages, and the OpenAI and Anthropic pages, were fetched separately from those publishers. They are not relicensed by this sample.

Offer

Get the $490 Vendor Chain Audit. It is a one-off. We hand-build the multi-tier subprocessor map, flag AI subprocessors from the published classification list, and give you the chain evidence. Monitoring is $99/mo and is sold separately.