During a data residency review, an organisation in the European Union must confirm where Microsoft 365 Copilot processes the tenant's data. Which statement correctly describes how Copilot handles data location and boundaries?
- ACopilot copies the tenant's data to a shared public model for training before returning any response.
- BCopilot processes the request within the Microsoft 365 service boundary and honours the tenant's data residency commitments. Correct
- CCopilot stores every prompt indefinitely in a region chosen at random to balance load.
- DCopilot bypasses tenant residency settings because generative processing must occur in the United States.
Why A is wrong: Tempting because people worry generative AI trains on their content, but Microsoft states that tenant data is not used to train the foundation models, so this describes a boundary violation that does not occur.
Why B is correct: Correct: Copilot operates inside the Microsoft 365 trust and compliance boundary, grounding responses on tenant content through Microsoft Graph while honouring the tenant's data residency commitments, which is what the residency review needs to confirm.
Why C is wrong: Tempting because load balancing is real in cloud services, but Copilot does not place customer data in random regions or retain prompts outside governed compliance and residency controls, so this contradicts the data boundary model.
Why D is wrong: Tempting because some early cloud services centralised processing, but Copilot is bound by the same Microsoft 365 residency commitments as the rest of the service, so it does not override them by forcing processing to one country.