Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
For enterprise and developer products, the applicable customer agreement supersedes this privacy statement in the event of conflict. Organizations using Microsoft products with work or school accounts have administrative access to and control over employee or student data, including communications, files, and diagnostic data.
This analysis describes what Microsoft's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that employees and students using Microsoft products through organizational accounts are subject to their organization's data governance policies and that the organization, not Microsoft, is the primary data controller for those interactions. The provision directs end users to their organization's administrator for privacy inquiries rather than to Microsoft.
The updated privacy statement removes the previous detailed list of third-party sources from which Microsoft obtains personal data, including data brokers, public social media posts, location service providers, co-branded partners, and developers. Under the revised language, Microsoft describes obtaining data from 'Microsoft affiliates, subsidiaries, and third parties' without specifying the categories or types of third parties as explicitly as before. The company states it has reorganized the document for greater clarity and accessibility, but the operational effect is that users receive less specific disclosure about where their data originates from outside Microsoft.
View change record →The updated policy establishes additional grounds on which Microsoft may retain personal data. While the prior version tied retention to specific user expectations and available deletion controls, the revised language authorizes retention for 'operating our business, meeting our contractual and legal obligations, improving and developing our products and services, protecting the safety and security of our systems and customers, and resolving disputes.' This expands the stated purposes beyond transaction fulfillment and legal compliance. The updated policy directs users to product-specific documentation for retention details rather than providing explicit deletion procedures and timelines in the privacy statement itself.
View change record →The updated policy now grounds data retention in five broad business purposes: operating the business, meeting contractual and legal obligations, improving and developing products and services, protecting system and customer safety, and resolving disputes. Previously, the policy articulated specific criteria for determining retention periods, including customer expectations for retention until manual deletion, availability of automated deletion controls, and data sensitivity. The revised language removes these granular criteria and instead requires users to consult individual product documentation to understand when their specific data will be deleted. This shifts the burden of finding retention timelines from the main policy statement to separate product-specific documents.
View change record →Under this provision, users accessing Microsoft products through work or school accounts operate under their employer's or school's data governance framework, and their organization may access the contents of their communications, files, and diagnostic data. Privacy questions for work or school account users should be directed to the organization's administrator.
Cross-platform context
See how other platforms handle Enterprise and Developer Product Data Governance and similar clauses.
Compare across platforms →Monitoring
Microsoft has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"In the event of a conflict between this Microsoft privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control. When a customer like your employer or school uses, purchases, or subscribes to Enterprise and Developer Products, or obtains support for our professional services with such products, Microsoft collects and generates data to provide the service, conduct our business operations, and communicate with the customer. If you use a Microsoft product with a work or school account, that organization can: Control and administer your Microsoft product and product account, including controlling your access to, and the privacy-related settings of, the product or your account. Access and process your data, including the interaction data, diagnostic data, and the contents of your communications and files associated with your Microsoft product and accounts.Excerpt from Microsoft's Privacy Statement (Legacy)
(1) REGULATORY LANDSCAPE: This provision engages GDPR controller-processor and joint controller frameworks (Articles 26 and 28), as the allocation of data controller responsibility between Microsoft and organizational customers determines which entity bears primary GDPR compliance obligations for employee or student data. The statement positions the organization as controller for enterprise product data and Microsoft as processor, consistent with the Product Terms and Data Protection Addendum structure. FERPA applies to student data processed through Microsoft 365 Education. The FTC Act and applicable state laws govern consumer-facing data practices, while enterprise data practices are governed primarily by the applicable commercial agreements. (2) GOVERNANCE EXPOSURE: Medium. The provision that organizational agreements supersede this privacy statement creates compliance complexity for organizations that have not reviewed and negotiated applicable Microsoft enterprise agreements. Organizations may be unaware of data access rights they have granted Microsoft or that Microsoft has granted the organization over end user data under the enterprise agreement terms. (3) JURISDICTION FLAGS: EU/EEA organizations must ensure that Microsoft enterprise agreements include appropriate Data Processing Agreements compliant with GDPR Article 28. Educational institutions in the U.S. must verify FERPA compliance in Microsoft 365 Education agreements. Healthcare organizations must confirm HIPAA Business Associate Agreement status for applicable Microsoft services. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should review enterprise agreements to confirm the scope of Microsoft's data access rights, the organization's administrative access obligations, and the allocation of controller and processor responsibilities. The statement's reference to the Products and Services DPA as the governing document for enterprise data processing should be reviewed against organizational data governance requirements. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that organizational IT policies address the administrative access rights the organization holds over employee Microsoft account data, and that employees are informed of this access through internal privacy notices. GDPR Article 13/14 notices for employees should reflect the organization's role as data controller for enterprise Microsoft product data.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that employees and students using Microsoft products through organizational accounts are subject to their organization's data governance policies and that the organization, not Microsoft, is the primary data controller for those interactions. The provision directs end users to their organization's administrator for privacy inquiries rather than to Microsoft.
Under this provision, users accessing Microsoft products through work or school accounts operate under their employer's or school's data governance framework, and their organization may access the contents of their communications, files, and diagnostic data. Privacy questions for work or school account users should be directed to the organization's administrator.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Microsoft.