What Microsoft 365 (Outlook, Exchange Online, SharePoint, OneDrive)'s terms say about your data

Who owns the data the customer puts in?

The customer · covers all customer data (mail, files, sites)

1. Headline Every plan covers all customer data (mail, files, sites)

   The customer

   As between the parties, Customer retains all right, title and interest in and to Customer Data and Professional Services Data.

   Microsoft Products and Services Data Protection Addendum (DPA), English, May 2026 (download from the DPA licensing page) (data processing addendum), read 2026-10-23 · link to this fact

   DPA "Nature of Data Processing; Ownership". Next sentence: "Microsoft acquires no rights in Customer Data or Professional Services Data, other than the rights Customer grants to Microsoft in this section." The DPA is part of the Product Terms and the Customer Agreement, so it covers Business and Enterprise subscriptions alike.

2. Supporting Every plan covers customer data in Microsoft online services

   The customer

   If you leave the service, we take the necessary steps to ensure the continued ownership of your data.

   Data management at Microsoft (Trust Center) (privacy policy), read 2026-10-23 · link to this fact

   Trust Center, under the heading "You own your data". Not contract text.

3. Detail Every plan covers output of Microsoft generative AI services (Copilot)

   The customer

   Microsoft does not own Customer's Output Content

   Microsoft Product Terms: Universal License Terms for Online Services (terms), read 2026-10-23 · link to this fact

   Product Terms, Universal License Terms, "Output Content": the line before it is "Output Content is Customer Data"

Does the vendor train AI on it?

Generative: no. Other models: the terms don't say · covers all customer data, Copilot prompts and responses included; all customer data

1. Headline Every plan covers all customer data, Copilot prompts and responses included

   Generative: no

   Microsoft Generative AI Services will not use Customer Data to train any generative AI foundation model, except pursuant to Customer's documented instructions.

   Microsoft Product Terms: Universal License Terms for Online Services (terms), read 2026-10-23 · link to this fact

   Product Terms, Universal License Terms for Online Services, "Use of Content for Training". The only exception is the customer's documented instructions; there is no default opt-in or opt-out.

2. Headline Every plan covers all customer data

   Other models: the terms don't say

   When providing Products and Services, Microsoft will not use or otherwise process Customer Data, Professional Services Data, or Personal Data for: (a) user profiling, (b) advertising or similar commercial purposes, or (c) market research aimed at creating new functionalities, services, or products or any other purpose, unless such use or processing is in accordance with Customer's documented instructions.

   Microsoft Products and Services Data Protection Addendum (DPA), English, May 2026 (download from the DPA licensing page) (data processing addendum), read 2026-10-23 · link to this fact

   Every terms, AI and DPA document was read, the Microsoft Customer Agreement included (first read 2026-10-23); none says whether non-generative models are trained on customer content. The DPA limits use to providing the service, which it defines to include "enhancing user productivity, reliability, efficacy, quality, and security", and to listed business operations; the Customer Agreement has no AI or training terms and points to the Product Terms and DPA.

3. Supporting Every plan covers Copilot prompts, responses and Microsoft Graph data (mail, files, chats)

   Generative: no

   Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.

   Data, Privacy, and Security for Microsoft Copilot (ai policy), read 2026-10-23 · link to this fact

   Same page on feedback: "We don't use this feedback to train the foundation LLMs used by Microsoft Copilot." Optional feedback may be used to improve Copilot; admins control it.

4. Supporting Every plan covers enterprise customer data, for Microsoft's generative AI models

   Generative: no

   We do not use our enterprise customers' data without their permission.

   Data for AI model development (Microsoft Trust Center) (ai policy), read 2026-10-23 · link to this fact

   Trust Center "Data for AI model development", under "First party data", which covers consumer services (Copilot, Bing, MSN) used for training. Not contract text.

Does the vendor keep a right to use it aggregated, de-identified or as usage data?

Reserved · covers usage logs and statistics, not content

1. Headline Every plan covers usage logs and statistics, not content

   Reserved

   to create aggregated statistical, non-personal data from data containing pseudonymized identifiers (such as usage logs containing unique, pseudonymized identifiers)

   Microsoft Products and Services Data Protection Addendum (DPA), English, May 2026 (download from the DPA licensing page) (data processing addendum), read 2026-10-23 · link to this fact

   DPA "Processing for Business Operations": preceded by "Customer authorizes Microsoft:" and followed by "to calculate statistics related to Customer Data", "in each case without accessing or analyzing the content of Customer Data", limited to billing and account management, compensation, internal reporting and business modeling, and financial reporting. Narrow: no content, no new products.

What can the customer export, and who can run it?

1. Headline Business covers email, contacts and calendar, one mailbox at a time

   Everything by any member through a self-serve screen^*

   To export an Outlook Data File (.pst), go to Settings > Files > Export

   Export emails, contacts, and calendar items to Outlook using a .pst file (help article), read 2026-10-23 · link to this fact

   Reading: Outlook (new or classic) exports a whole mailbox to .pst, so every mailbox can be exported by its user or by an admin with access to it. Not an org-wide export. Classic Outlook may sync only the past year until the slider is set to All. Org-wide eDiscovery export on Business plans is unclear: the Exchange Online service description lists eDiscovery content search on Business Basic, Standard and Premium, but Get started with eDiscovery requires E3 or E5 for cases.

2. Detail Business covers which Exchange Online compliance features each plan has

   Everything by an admin through an admin screen^*

   These features are available to some plans - caveats apply see footnotes for further information (this table may change without notice).

   Exchange Online service description (features by plan) (plans page), read 2026-10-23 · link to this fact

   Reading of the table under that line: "eDiscovery content search" is marked yes on Business Basic, Standard and Premium, so an admin may search and export mail; "In-Place Hold, Litigation Hold" and Exchange Online Archiving are yes on Business Premium and E3/E5 only. Conflicts with Get started with eDiscovery (E3 or E5 for cases); not settled.

3. Headline Enterprise covers mailboxes, SharePoint and OneDrive content found in an eDiscovery search

   Everything by an admin through an admin screen

   When you export search results, you download mailbox items in PST files or as individual messages.

   Export search results in eDiscovery (help article), read 2026-10-23 · link to this fact

   Microsoft Purview portal, by a user with eDiscovery permissions. Next sentence: "When you export content from SharePoint and OneDrive sites, you export copies of native Office documents and other documents." PST packages up to 10 GB each; exports expire 14 days after they are created.

4. Supporting Enterprise covers eDiscovery licensing

   Everything by an admin through an admin screen

   Both admins and users working with eDiscovery cases require a Microsoft 365 Enterprise E3 or E5 license.

   Get started with eDiscovery (help article), read 2026-10-23 · link to this fact

   Premium eDiscovery (review sets, analytics) needs E5 or an E5 add-on.

5. Detail Enterprise covers eDiscovery export packages

   Everything by an admin through an admin screen

   After 14 days, the export and all data contained in the export package are automatically deleted and can't be recovered.

   Export search results in eDiscovery (help article), read 2026-10-23 · link to this fact

   Download the package within 14 days of creating the export.

6. Headline SharePoint and OneDrive covers files and folders in SharePoint sites and OneDrive

   Everything by any member through a self-serve screen

   You can download files and folders from Microsoft OneDrive, or from SharePoint in Microsoft 365, SharePoint Server Subscription Edition, or SharePoint Server 2019 to your computer with just a few clicks.

   Download files and folders from OneDrive or SharePoint (help article), read 2026-10-23 · link to this fact

   Limits on the same page: "250GB file size limit; total number of files limit: 10,000; folder size limit: 10000 files." Any user can download what they can open; the sync client is the other route. On Enterprise, eDiscovery exports site content as native files (see the Enterprise export fact).

How much history does the plan keep?

All of it^* · covers email in mailboxes (Inbox, Sent, folders)

1. Headline Outlook and Exchange Online covers email in mailboxes (Inbox, Sent, folders)

   All of it^*

   The Default MRM Policy doesn't include a default tag to automatically delete content from the Deleted Items folder as per extended email retention for deleted items in Office 365

   Default Retention Policy in Exchange Online (help article), read 2026-10-23 · link to this fact

   Reading: the default policy, applied to every new Exchange Online user, only moves mail to the archive after 2 years (when an archive is on) and deletes Junk Email after 30 days; no page sets a limit on other mail. Admins can add retention policies that delete. Mailbox size limits apply per plan.

2. Detail Outlook and Exchange Online covers hard-deleted mail (Recoverable Items folder)

   14 days, older data deleted

   The default deleted item retention period for Exchange Online is 14 days

   Recoverable Items folder in Exchange Online (help article), read 2026-10-23 · link to this fact

   Change how long permanently deleted items are kept: "You can change how long items are kept, up to a maximum of 30 days." A mailbox on Litigation Hold keeps them past the limit.

3. Supporting Outlook and Exchange Online covers hard-deleted mail (Recoverable Items folder)

   14 days, older data deleted

   You can change how long items are kept, up to a maximum of 30 days.

   Change how long permanently deleted items are kept for an Exchange Online mailbox (help article), read 2026-10-23 · link to this fact

   Same page: "If you place a mailbox on litigation hold, the retention limit is ignored."

4. Headline SharePoint and OneDrive covers files in SharePoint sites and OneDrive

   All of it^*

   In SharePoint in Microsoft 365, items are retained for 93 days from the time you delete them from their original location.

   Restore deleted items from the site collection recycle bin (help article), read 2026-10-23 · link to this fact

   Reading: no page sets a time limit on current files; only deleted items expire (93 days in the recycle bins). Version history limits are set by admins and site owners.

5. Detail SharePoint and OneDrive covers OneDrive of a deleted user

   30 days, older data deleted

   The default retention period for OneDrive is also 30 days, but you can change this in the SharePoint admin center

   OneDrive retention and deletion (help article), read 2026-10-23 · link to this fact

   When a user is deleted, the manager gets access to the OneDrive by default; after the retention period it is deleted. Relevant to closing companies removing staff accounts before an export.

How long is data kept after the account ends, and can it still be exported?

90 days to export · covers all customer data

1. Headline Every plan covers all customer data

   90 days to export

   Except for free trials and LinkedIn services, Microsoft will retain Customer Data that remains stored in Online Services in a limited function account for 90 days after expiration or termination of Customer's subscription so that Customer may extract the data.

   Microsoft Products and Services Data Protection Addendum (DPA), English, May 2026 (download from the DPA licensing page) (data processing addendum), read 2026-10-23 · link to this fact

   DPA "Data Retention and Deletion". Next sentence: after the 90 days Microsoft "will disable Customer's account and delete the Customer Data and Personal Data stored in Online Services within an additional 90 days" (gone by 180 days).

2. Supporting Every plan covers subscriptions disabled at expiration

   90 days to export

   Customer will have 90 days to extract Customer Data from a disabled account, but the subscription cannot be reactivated.

   Microsoft Product Terms: Universal License Terms for Online Services (terms), read 2026-10-23 · link to this fact

   Product Terms, on subscriptions set to be disabled immediately upon expiration.

3. Supporting Every plan covers customer data in Microsoft 365

   90 days to export

   If a paid subscription ends or is terminated, Microsoft retains customer data stored in Microsoft 365 in a limited-function account for 90 days to enable the subscriber to extract the data.

   Data retention, deletion, and destruction in Microsoft 365 (Service Assurance) (help article), read 2026-10-23 · link to this fact

   Same page: "No more than 180 days after expiration or termination of a subscription to Microsoft 365, Microsoft disables the account and deletes all customer data from the account."

4. Detail Business covers Microsoft 365 for business subscriptions

   90 days to export

   Any customer data that you leave behind might be deleted after 90 days and will be deleted no later than 180 days after cancellation.

   What happens to my data and access when my Microsoft 365 for business subscription ends? (help article), read 2026-10-23 · link to this fact

   Lifecycle Active > Expired (30 days, users keep access) > Disabled (90 days, "Data is accessible to admins only") > Deleted. Monthly subscriptions cancelled inside the cancellation window skip Expired.

5. Detail Business covers SharePoint and OneDrive content when a subscription is deleted, not left to expire

   Deleted at once

   If you explicitly delete a subscription, it skips the Expired and Disabled statuses and SharePoint Online data and content, including OneDrive, is immediately deleted.

   What happens to my data and access when my Microsoft 365 for business subscription ends? (help article), read 2026-10-23 · link to this fact

   A seller should export files before deleting a subscription; letting it expire keeps the 90-day window.

What the read couldn't settle

• Plans grouped like Teams: Business = Microsoft 365 Business Basic, Standard, Premium; Enterprise = Microsoft 365 / Office 365 E3, E5. E1, F plans and consumer Outlook.com are out of scope. Both plan pages return a bot block from this environment (unreachable); plan contents come from the Exchange Online and Purview service descriptions.
• Microsoft Customer Agreement read for the first time: the picker page posts to /licensing/docs/api/CustomerAgreement/GetPreviewDocument ({LocaleParam: 'English(US)', GeographyParam: 'United States', AudienceParam: 'Commercial', CustomerTypeParam: 'Enterprise Customer'}), which returns a short-lived WOPI viewer link; its WOPI file info gives a signed .docx download (expires in about an hour). No stable static PDF or .docx URL exists, so m365-mca keeps the picker page URL and no fact quotes it; the quote checker would need that flow to read it. Same applies to the Teams entry (msteams-mca).
• The Customer Agreement says nothing on AI or model training; it points to the Product Terms and DPA ('The Product Terms and DPA provide additional terms regarding the disclosure and use of Customer Data.'). With it read, other_models is scored not_stated: no read document says whether non-generative models are trained on customer content. The Teams entry's open item can be settled the same way.
• Export on Business is our reading: each mailbox can be exported to .pst from Outlook; whether Business plans can run an org-wide eDiscovery export is unclear (the Exchange Online service description marks 'eDiscovery content search' yes on Business Basic, Standard and Premium, while Get started with eDiscovery says cases need an E3 or E5 license). Business Premium also gets litigation hold and archiving.
• Email retention 'keeps all' is our reading of the default MRM policy (only move-to-archive tags and a 30-day Junk Email delete tag; no default delete for Deleted Items). Recoverable Items (hard-deleted mail) is purged after 14 days by default, up to 30.
• SharePoint and OneDrive file retention: no page sets a time limit on current files; version history limits are admin-set and their organization default was not stated on the page read.
• Product Terms pages and the Trust Center pages show no last-updated date (version null). The Customer Agreement .docx shows no version date.

Documents

21 of 21 read. Each fact above names the one it comes from.

1. Microsoft Products and Services Data Protection Addendum (DPA), English, May 2026 (download from the DPA licensing page) Data processing addendum · version 2026-05-22 · read 2026-10-23
2. Microsoft Product Terms: Universal License Terms for Online Services Terms · read 2026-10-23
3. Microsoft Customer Agreement (United States, English, Enterprise Customer; text read as the .docx the page's preview service returns) Terms · read 2026-10-23
4. Data, Privacy, and Security for Microsoft Copilot AI policy · version 2026-07-09 · read 2026-10-23
5. Data for AI model development (Microsoft Trust Center) AI policy · read 2026-10-23
6. Data management at Microsoft (Trust Center) Privacy policy · read 2026-10-23
7. What happens to my data and access when my Microsoft 365 for business subscription ends? Help article · version 2026-06-08 · read 2026-10-23
8. Data retention, deletion, and destruction in Microsoft 365 (Service Assurance) Help article · version 2024-06-24 · read 2026-10-23
9. Default Retention Policy in Exchange Online Help article · version 2026-05-29 · read 2026-10-23
10. Change how long permanently deleted items are kept for an Exchange Online mailbox Help article · version 2024-05-30 · read 2026-10-23
11. Recoverable Items folder in Exchange Online Help article · version 2026-09-25 · read 2026-10-23
12. Export search results in eDiscovery Help article · version 2026-06-23 · read 2026-10-23
13. Get started with eDiscovery Help article · version 2026-04-01 · read 2026-10-23
14. Export emails, contacts, and calendar items to Outlook using a .pst file Help article · version 2026-09-18 · read 2026-10-23
15. Download files and folders from OneDrive or SharePoint Help article · version 2026-10-08 · read 2026-10-23
16. Restore deleted items from the site collection recycle bin Help article · version 2026-10-13 · read 2026-10-23
17. OneDrive retention and deletion Help article · version 2026-06-02 · read 2026-10-23
18. Exchange Online service description (features by plan) Plans page · version 2025-06-09 · read 2026-10-23
19. Microsoft Purview service description (licensing guidance) Plans page · version 2026-08-03 · read 2026-10-23
20. Compare all Microsoft 365 business plans Plans page · read 2026-10-23 · couldn't be reached
21. Microsoft 365 Enterprise plans and pricing Plans page · read 2026-10-23 · couldn't be reached