What we could verify

Microsoft’s services do not share one universal recipient list. The connections below retain the product, support interaction or enabled AI feature named in their source.

Organizational Copilot, personal Copilot, Microsoft 365 home apps and models sold by Azure have different boundaries. An OpenAI or Anthropic model name alone does not establish that the model provider receives your data.

Choose a service first: Microsoft Copilot account and plan guide.

8 reviewed outbound connections are available in this research. 8 reviewed connections point to this exact company record. This is selected coverage, not a complete recipient list.

Explore Microsoft in the map

Who it works with

Connections from Microsoft, with the purpose and scope attached to each source. A connection documents a relationship; it does not show that your data was transferred.

Processes data on behalf of another company

Anthropic

Microsoft → Anthropic

Providing Anthropic-operated models for enterprise Copilot experiences

Applies to: Microsoft Copilot for organizations (work or school account); Microsoft Copilot Studio.

When this applies

  • Applies to Anthropic models supplied through Microsoft enterprise Online Services with Anthropic acting as Microsoft's subprocessor, subject to tenant and user/group eligibility and model/feature selection.
  • Enabled by default for most commercial-cloud customers outside the EU, EFTA and UK; those regions require administrative opt-in and are excluded from the EU Data Boundary and applicable in-country processing commitments for these models.
  • Non-federal GCC customers require a separate eligible opt-in. Federal GCC, GCC High, DoD and other sovereign clouds are excluded.
  • Copilot Studio creators select the model; additional Power Platform administrative controls apply.
  • Anthropic models with Data Retention are excluded from this subprocessor assertion: those require separate opt-in and Anthropic agreements, with Anthropic acting as an independent processor. Some eligible Fable-class models remain within the Microsoft-subprocessor route as described by the source.

What remains unclear

  • This does not establish use by every tenant, prompt, feature or consumer Microsoft account.
  • Model eligibility and separate Data Retention terms can change; refresh the exact product documentation before revising scope.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Opening; Important; Opt-in regions and exclusions; model settings; Data Retention and Power Platform sections
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: Anthropic models in Microsoft Online Services · Reviewed

Processes data on behalf of another company

Amazon Web Services

Microsoft → Amazon Web Services

Microsoft Purview connectors that scan across clouds

Applies to: Microsoft Purview multi-cloud scanning connectors for AWS.

When this applies

  • The applicable product column names Microsoft Purview, specifically its multi-cloud scanning connectors.
  • Processing location depends on the location of the customer's AWS storage account.

What remains unclear

  • The row also mentions acquired services hosted on AWS before migration to Azure, without naming the acquisitions; this assertion extracts only the explicitly named Purview use.
  • The source label names Amazon Web Services without a legal suffix; this is not an ownership or legal-entity resolution.
Data, location and review details
Data categories
Customer Data; Personal Data consisting of pseudonymized personal identifiers
Locations
Location of the customer's AWS storage account (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Page 4, section 2, Amazon Web Services row and ancillary-services introduction
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: Microsoft Online Services Subprocessors, September 10, 2026 · Reviewed

Processes data on behalf of another company

OpenAI

Microsoft → OpenAI

Providing OpenAI-operated models for enterprise Copilot experiences

Applies to: Microsoft Copilot for organizations (work or school account); Microsoft Copilot Studio.

When this applies

  • Applies to OpenAI-operated models made available through Microsoft enterprise Online Services, when enabled for the user or group; Microsoft-operated Azure OpenAI models are a separate deployment path.
  • The page dates availability to July 9, 2026 and default enablement for eligible commercial customers to July 24, 2026; administrators can select No users or restrict access to specified users and groups.
  • Copilot Studio creators select the model, and additional Power Platform administrative controls apply.
  • OpenAI-operated models are unavailable in GCC, GCC High, DoD and sovereign clouds; applicable in-country processing commitments exclude these models. The page includes them in the EU Data Boundary subject to its linked exceptions.
  • The Microsoft DPA and Product Terms apply subject to documented exclusions. Certain Copilot experiences use the OpenAI Responses API with Zero Data Retention subject to OpenAI's feature-specific limits.

What remains unclear

  • This establishes an optional/eligible provider route, not a guarantee that every Copilot prompt is sent to OpenAI.
  • No consumer Copilot, Microsoft 365 home-plan or ordinary Azure OpenAI route is established by this enterprise article.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Important; opening paragraphs; Manage OpenAI as a subprocessor; user/group access; Exclusions
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: OpenAI as a subprocessor in Microsoft Online Services · Reviewed

Processes data on behalf of another company

Akamai Technologies, Inc.

Microsoft → Akamai Technologies, Inc.

Content delivery network operation and traffic management

Applies to: Microsoft Online Services under the Microsoft DPA.

When this applies

  • The row applies to any Microsoft Online Service within this commercial Online Services disclosure. Processing is conditional on providing the named CDN and network functions.
  • This disclosure does not identify recipients for consumer Microsoft accounts.
Data, location and review details
Data categories
Customer Data; Personal Data consisting of pseudonymized personal identifiers
Locations
Worldwide (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Page 2, section 1, Akamai Technologies, Inc. row and section introduction
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: Microsoft Online Services Subprocessors, September 10, 2026 · Reviewed

Processes data on behalf of another company

Concentrix Solutions Corporation

Microsoft → Concentrix Solutions Corporation

Contact and call-center support

Applies to: Microsoft Commercial Support, including Premier and Unified support.

When this applies

  • Limited to Microsoft Commercial Support interactions, including Premier and Unified support; the list addresses technical support across Microsoft products.
  • Only support data that customers choose to share during their support interactions is in scope. Support data is stored and processed within Microsoft systems.
  • This does not establish routine-product processing or a route from a consumer plan merely because that plan is sold by Microsoft.
Data, location and review details
Data categories
Support data shared by the customer, including customer data or personal data
Locations
Argentina (processing location); Brazil (processing location); Bulgaria (processing location); Canada (processing location); China (processing location); Colombia (processing location); Costa Rica (processing location); Czech Republic (processing location); Egypt (processing location); El Salvador (processing location); France (processing location); Germany (processing location); India (processing location); Israel (processing location); Jamaica (processing location); Japan (processing location); Korea (processing location); Malaysia (processing location); Mexico (processing location); Morocco (processing location); Nicaragua (processing location); Philippines (processing location); Spain (processing location); Turkey (processing location); United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Page 1, Commercial Support introduction and Concentrix Solutions Corporation row; page 5 Notice and Disclaimer
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: Microsoft Commercial Support Subprocessors, September 21, 2026 · Reviewed

Processes data on behalf of another company

Databricks, Inc.

Microsoft → Databricks, Inc.

Deployment, operation and troubleshooting of Azure Databricks

Applies to: Azure Databricks.

When this applies

  • Applies when Azure Databricks is used; it is not a disclosure for all Azure services.
Data, location and review details
Data categories
Customer Data; Personal Data consisting of pseudonymized personal identifiers
Locations
Canada (processing location); France (processing location); Germany (processing location); Netherlands (processing location); United Kingdom (processing location); United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Page 2, section 1, Databricks, Inc. row and section introduction
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: Microsoft Online Services Subprocessors, September 10, 2026 · Reviewed

Processes data on behalf of another company

Scuba Analytics, Inc.

Microsoft → Scuba Analytics, Inc.

Analytics for customer experience

Applies to: Microsoft Teams under the Microsoft DPA; Microsoft Stream under the Microsoft DPA; SharePoint Online; OneDrive for Business.

When this applies

  • The row names Teams, Stream, SharePoint Online and OneDrive for Business under the Online Services disclosure.
  • The asterisk restricts this row to pseudonymous personal data.

What remains unclear

  • The parent-company column separately names Interana, Inc.; no parent-company relationship or identity merge is proposed here.
Data, location and review details
Data categories
Pseudonymous personal data
Locations
United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Page 5, section 2, Scuba Analytics, Inc. starred row; page 4 asterisk definition
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: Microsoft Online Services Subprocessors, September 10, 2026 · Reviewed

Processes data on behalf of another company

Snowflake, Inc.

Microsoft → Snowflake, Inc.

Warehouse storage and processing

Applies to: Viva Engage (formerly Yammer).

When this applies

  • The applicable service is Viva Engage, formerly Yammer.
  • The asterisk restricts this row to pseudonymous personal data.
Data, location and review details
Data categories
Pseudonymous personal data
Locations
United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Page 5, section 2, Snowflake, Inc. starred row; page 4 asterisk definition
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: Microsoft Online Services Subprocessors, September 10, 2026 · Reviewed

Who names Microsoft

These disclosures belong to the companies named below. They do not establish which of Microsoft’s own suppliers are involved further on.

Processes data on behalf of another company

OpenAI

OpenAI → Microsoft Corporation

Cloud infrastructure

Applies to: OpenAI API; ChatGPT Enterprise, Edu and Business.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

What remains unclear

  • The source lists many processing countries; not all copied into this selected assertion.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third Party Sub-processors — Microsoft row
Source retrieved
Claim independently reviewed

Source: OpenAI Sub-processor list · Reviewed

Processes data on behalf of another company

Atlassian

Atlassian → Microsoft Corporation

Cloud hosting

Applies to: Jira Align.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
USA (processing location); Australia (processing location); Netherlands (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Microsoft / Jira Align row
Source retrieved
Claim independently reviewed

Source: List of Data Subprocessors – Atlassian · Reviewed

Processes data on behalf of another company

Bitwarden

Bitwarden → Microsoft Corporation

Provide hosting infrastructure

Applies to: Bitwarden cloud password manager.

When this applies

  • Cloud-hosted service.
  • Neither Bitwarden nor this subprocessor can access unencrypted vault data.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
USA (location type not established); EU (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Bitwarden Subprocessors / Microsoft Corporation
Source retrieved
Claim independently reviewed
· Agent review

Source: Bitwarden Subprocessors · Reviewed

Processes data on behalf of another company

Docusign

Docusign → Microsoft Corporation (Azure)

Cloud hosting

Applies to: Docusign eSignature and related add-ons.

When this applies

  • Country depends on service provisioning.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (location type not established); Australia (location type not established); Canada (location type not established); European Union (location type not established); Japan (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Page 2 — eSignature infrastructure: Microsoft Corporation (Azure)
Source retrieved
Effective date
Claim independently reviewed

Source: Docusign Services Subprocessor List · Reviewed

Processes data on behalf of another company

EasyPost

EasyPost → Microsoft Corporation

Cloud hosting, storage and IT services

Applies to: EasyPost services under the master customer agreement and incorporated DPA.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
USA (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Annex D — Microsoft Corporation row
Source retrieved
Claim independently reviewed

Source: Annex D to DPA — List of Subprocessors · Reviewed

Processes data on behalf of another company

Secureframe

Secureframe → Microsoft

Cloud infrastructure and hosting

Applies to: Secureframe Defense.

When this applies

  • Only for customers using Secureframe Defense.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Secureframe Defense / Microsoft
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: Secureframe Subprocessors · Reviewed

Processes data on behalf of another company

ServiceNow

ServiceNow → Microsoft Corporation

Subprocessor supporting GCC on Azure.

Applies to: Government Community Cloud on Azure.

When this applies

  • GCC on Azure specifically; plain GCC is listed separately with none.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
PDF p.3, Section 2(4)
Source retrieved
Claim independently reviewed

Source: ServiceNow Sub-Processors · Reviewed

Processes data on behalf of another company

Zscaler

Zscaler → Microsoft Corporation (Azure)

Hosting for certain ZPA and ZIA features

Applies to: Zscaler Private Access and Internet Access.

When this applies

  • Applies only to the listed hosted features.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
Global (hosting location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Microsoft Corporation (Azure) row
Source retrieved
Claim independently reviewed

Source: Subprocessor disclosure · Reviewed

Sources behind this explanation

Retrieval records when a source was opened. Review records when a particular claim was independently checked. Neither date guarantees that a source has stayed unchanged.