Politics

Microsoft makes Anthropic’s Claude models default for most Copilot tenants amid privacy concerns

Tuesday, 9 December 2025 5:11PM UTC

Starting January 2026, Microsoft will enable Anthropic’s Claude models by default for most commercial customers, raising compliance and data residency considerations, particularly within the EU and government clouds.

From 7 January 2026 Microsoft will enable Anthropic’s Claude models by default for most commercial tenants of Microsoft 365 Copilot, a change that brings Claude under Microsoft’s subprocessor model and its Product Terms and Data Protection Addendum rather than the separate commercial terms Anthropic previously required, industry sources say. ^[1]^[2]

According to the original report, the shift removes the prior “opt in to Anthropic’s commercial terms” toggle; organisations that do not want Claude processing their Copilot workloads must proactively opt out before the January 7 deadline. For most commercial tenants the default will be “on” and will activate automatically unless administrators disable it. Customers in the EU, EFTA and the UK will have the default set to “off” because Anthropic is not included in Microsoft’s EU Data Boundary or in‑country processing guarantees. ^[1]^[2]

Under the new arrangement Anthropic operates as a Microsoft subprocessor, which Microsoft says simplifies compliance and security by covering Claude’s data processing activities under existing contractual commitments. The company said in documentation that Enterprise Data Protection rules continue to apply to any workloads using Claude models, preserving the baseline security and compliance controls relied on by large organisations. ^[2]^[4]

However, the absence of Anthropic from the EU Data Boundary and from in‑country processing commitments has immediate legal and operational implications for organisations subject to GDPR and other localisation rules. Independent analysis notes that Claude, when used via certain Copilot agents such as the Researcher Agent, runs on AWS infrastructure in the United States, meaning data submitted may be transferred outside the EU/EEA and not covered by Microsoft’s residency assurances unless customers take action. EU organisations handling personal or sensitive data are therefore advised to disable the feature at an administrative level if their compliance posture requires it. ^[3]^[2]

Government cloud customers face the tightest restrictions: Anthropic models will not be available in GCC, GCC High, DoD environments or sovereign clouds, and administrators in those environments will not see an enable/disable toggle. Microsoft frames this exclusion as necessary given the additional certifications and operational standards required of government‑focused clouds. ^[2]

The move represents an evolution from the initial September 2025 trial, when Claude Sonnet 4 and Claude Opus 4.1 were available only to customers who explicitly opted in and accepted Anthropic’s separate terms. Charles Lamanna, President of Microsoft’s Business and Industry Copilot division, said at the time: “Copilot will continue to be powered by OpenAI’s latest models, and now our customers will have the flexibility to use Anthropic models too.” Microsoft and independent reporting indicate the company is adopting a multi‑model strategy across Copilot and other products , GitHub Copilot paid users reportedly now “primarily rely on Claude Sonnet 4” under automatic model selection, and Claude is being tested in Excel and PowerPoint. ^[1]

For enterprise strategy the decision point is straightforward: accept Anthropic’s integration under Microsoft’s contractual umbrella and embrace a multi‑model approach that routes tasks to the models best suited to them, or retain tighter control by restricting which AI providers may process organisational data. Industry data shows that different models excel at different use cases , Claude is noted for deep reasoning and extended‑context tasks , but data residency, regulatory risk and sectoral controls will drive divergent choices. Microsoft has signalled continued investment in data residency capabilities, expanding in‑country processing for Copilot interactions to 15 countries through 2026, and completing the EU Data Boundary project for core services, but those commitments do not currently cover Claude’s processing footprint. ^[1]^[5]^[6]^[7]

Organisations must therefore treat the January 7 change as an operational and compliance milestone: review admin settings now, determine whether Claude’s processing location and contractual posture meet regulatory and commercial requirements, and document any opt‑out decisions before the deadline. ^[1]^[2]^[3]^[4]

##Reference Map:

^[1] (UC Today) - Paragraph 1, Paragraph 2, Paragraph 6, Paragraph 7, Paragraph 8
^[2] (Microsoft Learn: Connect to AI subprocessor) - Paragraph 1, Paragraph 2, Paragraph 3, Paragraph 4, Paragraph 5, Paragraph 8
^[3] (Ragnar Heil blog) - Paragraph 4, Paragraph 8
^[4] (Microsoft Learn: Enterprise Data Protection) - Paragraph 3, Paragraph 8
^[5] (Microsoft Microsoft 365 blog) - Paragraph 7
^[6] (Microsoft On the Issues: European digital commitments) - Paragraph 7
^[7] (Microsoft On the Issues: EU Data Boundary completion) - Paragraph 7

Source: Noah Wire Services

More on this

https://www.uctoday.com/unified-communications/microsoft-365-copilot-to-enable-anthropic-models-by-default-what-compliance-leads-need-to-know/ - Please view link - unable to able to access data
https://learn.microsoft.com/en-us/copilot/microsoft-365/connect-to-ai-subprocessor - Microsoft has integrated Anthropic's Claude models into Microsoft 365 Copilot as a subprocessor, eliminating the need for separate contractual agreements. This change simplifies compliance and security under Microsoft's enterprise framework, with Anthropic's data processing now covered by Microsoft's Product Terms and Data Protection Addendum. However, Anthropic models are excluded from the EU Data Boundary and in-country processing commitments, affecting organizations operating under GDPR and similar frameworks. Customers concerned about data processing have until January 7 to opt out. For most commercial tenants, Anthropic defaults to 'on' and will activate automatically unless administrators opt out before the deadline. Customers in the EU, EFTA, and UK will have their default set to 'off' due to data residency limitations. Government cloud customers face the most restrictive scenario, as Anthropic models are not available in GCC, GCC High, DoD environments, or sovereign clouds, and no admin toggle will appear in these environments. This exclusion reflects the additional security and compliance requirements of government-focused cloud services, where all subprocessors must meet specific certifications and operational standards. This update also removes the previous 'opt in to Anthropic's commercial terms' toggle completely. As a result, IT leaders must make a conscious choice: either accept Anthropic's integration under Microsoft's terms or proactively disable it before the deadline.
https://ragnarheil.de/anthropic-claude-ai-in-microsoft-365-copilot-a-data-boundary-hurdle-for-the-eu/ - The integration of Anthropic's Claude AI models into Microsoft 365 Copilot raises significant compliance concerns for European Union (EU) customers. The Claude AI model, when used via the Microsoft 365 Researcher Agent, runs exclusively on Amazon Web Services (AWS) in the United States, meaning that data submitted to the Researcher Agent, if it includes personal data, is transferred and processed outside the EU/EEA, a transfer not covered by typical EU contractual safeguards. This integration does not fall under Microsoft's established data residency and EU Data Boundary commitments and is not covered by standard Microsoft agreements, such as the Product Terms Data Protection Addendum (DPA) or specific data residency licenses. EU organizations using Microsoft 365 Copilot and processing personal or sensitive data are strongly advised to deactivate this feature immediately at the administrative level to ensure compliance with EU data protection regulations.
https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection - Microsoft 365 Copilot and Microsoft 365 Copilot Chat support compliance with existing privacy, security, and compliance commitments to Microsoft 365 commercial customers, including the General Data Protection Regulation (GDPR) and European Union (EU) Data Boundary. However, the EU Data Boundary does not apply to web search queries, which are processed outside the EU. When using agents in Microsoft 365 Copilot, it's important to review the privacy statement and terms of use of the agents to determine how they handle your organization's data. The specific controls will vary depending on a customer's Microsoft subscription plans.
https://www.microsoft.com/en-us/microsoft-365/blog/2025/11/04/microsoft-offers-in-country-data-processing-to-15-countries-to-strengthen-sovereign-controls-for-microsoft-365-copilot/?msockid=14b2ac69d9ff6cff36a8bac9d88b6d79 - Microsoft is expanding in-country data processing for Microsoft 365 Copilot interactions to 15 countries by the end of 2026, including Switzerland. This expansion aims to provide customers, particularly those in government and highly regulated industries, with greater control over their data by processing Copilot interactions in data centers located within their respective countries. The in-country data processing option is designed to enhance governance, security, and regulatory compliance, offering improved performance by reducing latency and delivering a more responsive Copilot experience. The rollout includes countries such as Australia, the United Kingdom, India, Japan, Canada, Germany, Italy, Malaysia, Poland, South Africa, Spain, Sweden, Switzerland, the United Arab Emirates, and the United States.
https://blogs.microsoft.com/on-the-issues/2025/04/30/european-digital-commitments/ - Microsoft has completed the EU Data Boundary project, offering European customers the ability to store and process their data within the EU and European Free Trade Association (EFTA) regions. Since January 2024, European commercial and public sector customers can store and process their data and personal identifiers for Microsoft core cloud services—including Microsoft 365, Dynamics 365, Power Platform, and most Azure services—within the EU and EFTA regions. This initiative reflects Microsoft's commitment to providing European customers with greater control over their data and ensuring compliance with EU data protection regulations.
https://blogs.microsoft.com/on-the-issues/2025/02/26/microsoft-completes-landmark-eu-data-boundary-offering-enhanced-data-residency-and-transparency/ - Microsoft has completed the EU Data Boundary for the Microsoft Cloud, enabling European commercial and public sector customers to store and process their data and pseudonymized personal data for Microsoft core cloud services—including Microsoft 365, Dynamics 365, Power Platform, and most Azure services—within the EU and European Free Trade Association (EFTA) regions. This completion provides European customers with enhanced data residency and transparency, ensuring compliance with EU data protection regulations and offering greater control over their data.

Noah Fact Check Pro

The draft above was created using the information available at the time the story first emerged. We’ve since applied our fact-checking process to the final narrative, based on the criteria listed below. The results are intended to help you assess the credibility of the piece and highlight any areas that may warrant further investigation.

Freshness check

Score: 8

Notes: The narrative is recent, published on December 9, 2025, and discusses a forthcoming change effective January 7, 2026. The earliest known publication date of similar content is September 29, 2025, when Microsoft announced support for Anthropic's Claude models in Copilot Studio. ([microsoft.com](https://www.microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/anthropic-joins-the-multi-model-lineup-in-microsoft-copilot-studio/?msockid=1fffa93510546a242a24bf8d11d96b7f&utm_source=openai)) The report is based on a press release from Microsoft, which typically warrants a high freshness score. No discrepancies in figures, dates, or quotes were found. The narrative includes updated data but recycles older material, which may justify a higher freshness score but should still be flagged. ([microsoft.com](https://www.microsoft.com/en-us/microsoft-365/blog/2025/09/24/expanding-model-choice-in-microsoft-365-copilot/?utm_source=openai))

Quotes check

Score: 9

Notes: The report includes direct quotes from Charles Lamanna, President of Microsoft's Business and Industry Copilot division, and other sources. The earliest known usage of these quotes is from the September 29, 2025, announcement. ([microsoft.com](https://www.microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/anthropic-joins-the-multi-model-lineup-in-microsoft-copilot-studio/?msockid=1fffa93510546a242a24bf8d11d96b7f&utm_source=openai)) No identical quotes appear in earlier material, and no variations in wording were noted. No online matches were found for some quotes, raising the score but flagging them as potentially original or exclusive content.

Source reliability

Score: 7

Notes: The narrative originates from UC Today, a reputable organisation in the unified communications sector. However, it is not as widely recognised as major outlets like the Financial Times or Reuters, which introduces some uncertainty. The report cites official Microsoft documentation and other reputable sources, enhancing its credibility.

Plausability check

Score: 8

Notes: The narrative makes plausible claims about Microsoft's integration of Anthropic's Claude models into Copilot, aligning with previous announcements from Microsoft. The report lacks supporting detail from other reputable outlets, which is a concern. The language and tone are consistent with corporate communications, and the structure is focused on the main topic without excessive or off-topic detail. The tone is formal and appropriate for the subject matter.

Overall assessment

Verdict (FAIL, OPEN, PASS): OPEN

Confidence (LOW, MEDIUM, HIGH): MEDIUM

Summary: The narrative is recent and based on official Microsoft documentation, enhancing its credibility. However, the reliance on a single source and the lack of supporting detail from other reputable outlets introduce some uncertainty. The quotes are consistent with previous announcements, but some may be original or exclusive content. The plausibility of the claims is supported by prior information, but the lack of corroboration from other reputable sources is a concern.

AI
Microsoft 365
Data privacy