Claude in Microsoft 365 Copilot: UK Checks

Anthropic’s Claude models are available inside Microsoft 365 Copilot, Copilot Studio, and Power Platform, under Microsoft’s subprocessor arrangement. For UK, EU, and EFTA tenants they are disabled by default, and an administrator with the AI Administrator or Global Administrator role must opt in. Before opting in, we would check three things. The models sit outside the EU Data Boundary and in-country processing commitments, and the governing terms are Microsoft’s rather than Anthropic’s. The decision also belongs in change control, with your records of processing updated, instead of being made as a quick toggle in the admin centre.

UK tenants: off by default, and an administrator must opt in.
The models are outside the EU Data Boundary today, which affects you if your compliance position relies on it.
Claude via the API or Microsoft Foundry is a separate assessment, so do not merge the three.

The full supplier assurance picture for Claude is in our Claude GDPR guide.

Microsoft’s decision to put Anthropic’s Claude models inside its own productivity AI shows how far the model market has moved. Model choice is now a Microsoft 365 feature rather than a procurement exception. For users, it means Copilot experiences such as Researcher and Copilot Studio agents can run on Claude models as well as OpenAI’s.

For UK administrators and compliance teams, it means a specific decision has appeared in the admin centre, and it can be checked against Microsoft’s documentation. The detail behind the headline is what needs checking.

What exactly is on offer, and what is the default?

Anthropic models are available in Microsoft 365 Copilot (which Microsoft has since renamed Microsoft Copilot), Copilot Studio, and Power Platform under Microsoft’s subprocessor arrangement with Anthropic. Two facts shape the rest of the assessment:

For UK, EU, and EFTA tenants, the models are disabled by default. An administrator holding the AI Administrator or Global Administrator role opts in through the Microsoft 365 admin centre. Reports that Claude is ‘on by default’ describe tenants outside these regions, so that assumption should not carry over into a UK governance discussion.
The governing terms are Microsoft’s. Anthropic operates as a subprocessor under Microsoft’s Product Terms and Data Protection Addendum, and Microsoft states its Customer Copyright Commitment applies to Anthropic models in covered products. Your organisation’s relationship remains with Microsoft, and that is why the assessment differs from using Claude directly.

One exception within the offering needs its own line in any assessment. ‘Preview models with Data Retention’ (Anthropic’s most advanced preview models) work differently.

For those models, Anthropic acts as an independent data processor under its own Commercial Terms and Data Protection Addendum, and data is retained by Anthropic. They remain default-off for every tenant with separate admin controls, even where the standard Anthropic models are on by default. Opting in to Anthropic models generally does not enable them.

How the EU Data Boundary affects the decision

Microsoft states that Anthropic models in these products are currently excluded from the EU Data Boundary and, where applicable, from in-country processing commitments. For organisations whose Microsoft 365 data protection position relies on the EU Data Boundary, enabling Anthropic models changes that position for whatever runs on them.

That is not automatically a blocker. UK GDPR permits international transfers with appropriate safeguards, and plenty of UK organisations already operate Microsoft 365 workloads on that basis. It is still a change to a documented position, which makes it a governance event. We would expect it to have an owner, a risk assessment, and an update to the records of processing, rather than being switched on because a team asked for it.

Keep the three Claude routes separate

Most poor decisions in this area come from confusing three different routes to Claude:

Claude in Microsoft 365 Copilot: Microsoft’s product, Microsoft’s terms, Anthropic as subprocessor, admin opt-in for UK tenants, and outside the EU Data Boundary today. This is the route this post covers.
Claude in Microsoft Foundry: a developer platform offering for building your own applications, generally available with Azure billing and governance, in Global and US data zones only. Our Claude on Azure decision guide covers it.
Claude via the Anthropic API (or AWS Bedrock and Google Vertex AI): your own contractual relationship with Anthropic or a hyperscaler, with the residency and retention options analysed in the Claude GDPR guide.

Each route has different terms, different residency positions, and different configuration surfaces. An assessment done for one does not transfer to the others.

A practical checklist before opting in

Confirm what your commitments say. Check client contracts, internal policies, and any reliance on the EU Data Boundary or in-country processing. If a commitment rules out processing outside the boundary, that settles the question before anything else.
Read the current Microsoft documentation on the day you decide. The subprocessor page is the source of truth, and the boundary position is the fact most likely to change.
Scope the enablement. Decide which experiences and user groups need it. An opt-in for a Copilot Studio pilot is a different decision from tenant-wide enablement.
Run it through change control. Record the decision with a named owner, carry out a data protection impact assessment (DPIA) where personal data processing changes materially, and update the records of processing.
Tell users what changed. Model choice affects behaviour, and support teams will field the questions either way. They handle them better when they have been told in advance.
Diarise a review. Microsoft’s boundary coverage and model line-up both change over time, so a decision made against today’s exclusions should be revisited on a regular cycle.

Applying the same supplier discipline to workplace AI

Model choices that used to concern only developers now reach the workplace AI estate as well. The governance discipline is the same: know which models process what, under whose terms, and in which geography, and keep the records accurate. Organisations that already treat AI suppliers in the way our ISO 27001 and AI post describes will find this a routine extension of that work.

If your organisation is weighing the opt-in, or working through the three Claude routes across productivity and development estates, book a consultation and we will map it with you.

Frequently asked questions

Are Claude models on in Microsoft 365 Copilot for UK tenants?

Not by default. Anthropic models in Microsoft Copilot (formerly Microsoft 365 Copilot), Copilot Studio, and Power Platform are disabled by default for UK, EU, and EFTA tenants. An administrator holding the AI Administrator or Global Administrator role must opt in through the Microsoft 365 admin centre. Tenants elsewhere have them enabled by default, which is why UK organisations sometimes assume the same applies to them.

Is Claude in Microsoft 365 Copilot covered by the EU Data Boundary?

No. Microsoft states that Anthropic models in these products are currently excluded from the EU Data Boundary and, where applicable, in-country data processing commitments. If your Microsoft 365 compliance position relies on the EU Data Boundary, enabling Anthropic models changes that position for the workloads that use them, and that change should go through your governance process.

Whose terms govern Claude inside Microsoft 365 Copilot?

Microsoft's. Anthropic acts as a subprocessor under Microsoft's arrangement, governed by Microsoft's Product Terms and Data Protection Addendum rather than Anthropic's own commercial terms. That makes it a different assessment from using Claude via the Anthropic API or Microsoft Foundry, where your contractual relationship and configuration options differ.

Should we opt in?

We would treat it as a change-control decision rather than a simple toggle. Many UK organisations can opt in comfortably once they have checked their data residency commitments, updated their records of processing, and documented the decision. Organisations with in-country processing commitments or a strict reliance on the EU Data Boundary may need to wait, or to scope the enablement carefully.

Claude in Microsoft 365 Copilot: What UK Organisations Should Check Before Opting In