Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The statement establishes that in the event of a conflict between this privacy statement and the terms of a customer's enterprise agreement with Microsoft, the enterprise agreement terms govern. This applies specifically to Enterprise and Developer Products.
This analysis describes what Microsoft Azure's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a hierarchy of contractual terms that is directly relevant to enterprise customers assessing their privacy and data protection posture under Microsoft contracts, and determines which document governs data processing obligations in the enterprise context.
Microsoft now discloses that it may contact you by phone for marketing using automated dialers and AI-generated voices if you have consented to marketing communications, which represents a new disclosure of contact method and technology type. The company has also reorganized its data retention policy to state it retains data for broader business purposes including improving products and protecting systems, while removing previous specific examples and retention criteria, making it less clear exactly how long specific types of your data will be kept. You should review your consent settings for marketing communications and verify what contact methods you have authorized, particularly if you have concerns about automated or AI-generated calls.
View change record →Microsoft's privacy policy now provides a less detailed explanation of how long your data is retained. Previously, the policy included specific examples, such as how long deleted emails remain in your system before final deletion, and listed criteria for deciding retention periods. Now those details are consolidated into a more general statement pointing readers to separate product documentation. This means you'll need to consult multiple documents to understand retention timelines for specific services, which reduces transparency at the point of reading the main privacy policy.
View change record →Microsoft's updated retention policy provides greater specificity about how long your data persists and under what conditions it is deleted. The policy now explicitly states that deleted items from OneDrive and Outlook.com may remain in Microsoft's systems for up to 30 days before permanent removal, even after you empty the Deleted Items folder. Additionally, the updated terms clarify that retention periods depend on whether you have an expectation that Microsoft will keep the data until you actively remove it, and whether automated controls exist to let you access and delete data yourself. You can review Microsoft's privacy dashboard to exercise available deletion controls and understand which services retain your data under these criteria.
View change record →Under these terms, enterprise customers who have negotiated separate agreements with Microsoft for Enterprise and Developer Products should rely on those agreement terms rather than this privacy statement where the two conflict. End users of enterprise Microsoft deployments should review their organization's policies and contact their organization's administrator with privacy-related questions.
Cross-platform context
See how other platforms handle Enterprise Agreement Controls Over Privacy Statement and similar clauses.
Compare across platforms →Monitoring
Microsoft Azure has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control. You can also learn more about our Enterprise and Developer Products' features and settings, including choices that impact your privacy or your end users' privacy, in product documentation.Excerpt from Microsoft Azure's Microsoft Privacy
1. REGULATORY LANDSCAPE: This provision affects the determination of which contractual terms govern data processing for enterprise customers, which has direct implications for GDPR Article 28 Data Processing Agreement requirements, CCPA service provider agreements, and applicable sector-specific data protection obligations. The FTC Act's prohibition on unfair or deceptive practices applies to the adequacy of disclosures about the relationship between this privacy statement and enterprise agreement terms. 2. GOVERNANCE EXPOSURE: Medium. Enterprise customers may assume that this public privacy statement governs their data processing relationship with Microsoft, when in fact their specific contractual agreements may contain materially different terms. The Products and Services Data Protection Addendum referenced in the statement governs data processing for enterprise online services, and enterprise customers should review this document in conjunction with their service agreements. 3. JURISDICTION FLAGS: GDPR Article 28 requires that processing by a processor on behalf of a controller be governed by a contract that specifies the subject matter, duration, nature and purpose of processing, type of personal data, and obligations and rights of the controller. Enterprise customers in the EU and EEA should confirm that their agreements with Microsoft satisfy these requirements and that the enterprise agreement terms align with their GDPR compliance obligations. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams reviewing Microsoft enterprise agreements should specifically identify any provisions that deviate from this privacy statement and assess the compliance implications of those deviations. The Products and Services Data Protection Addendum should be reviewed as a component of the contractual data processing framework. Indemnification and liability provisions in enterprise agreements should be assessed in light of the privacy statement's general liability framework. 5. COMPLIANCE CONSIDERATIONS: Legal teams should maintain a current copy of all applicable Microsoft enterprise agreements and Data Processing Addenda and conduct periodic reviews to confirm alignment with current regulatory requirements. Any negotiated deviations from Microsoft's standard DPA terms should be documented and assessed for GDPR, CCPA, and other applicable law compliance.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a hierarchy of contractual terms that is directly relevant to enterprise customers assessing their privacy and data protection posture under Microsoft contracts, and determines which document governs data processing obligations in the enterprise context.
Under these terms, enterprise customers who have negotiated separate agreements with Microsoft for Enterprise and Developer Products should rely on those agreement terms rather than this privacy statement where the two conflict. End users of enterprise Microsoft deployments should review their organization's policies and contact their organization's administrator with privacy-related questions.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Microsoft Azure.