If you access Microsoft products through a work or school account, your employer or school may be able to access your data, including emails and files, and control your account's privacy settings. Microsoft's privacy protections in this context are supplemented by your organization's own policies.
This analysis describes what Microsoft's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Users accessing Microsoft products through organizational accounts should be aware that their employer or institution may have access to their communications and files and may control their privacy settings, which is materially different from the protections available to personal account holders.
The updated policy establishes additional grounds on which Microsoft may retain personal data. While the prior version tied retention to specific user expectations and available deletion controls, the revised language authorizes retention for 'operating our business, meeting our contractual and legal obligations, improving and developing our products and services, protecting the safety and security of our systems and customers, and resolving disputes.' This expands the stated purposes beyond transaction fulfillment and legal compliance. The updated policy directs users to product-specific documentation for retention details rather than providing explicit deletion procedures and timelines in the privacy statement itself.
View change record →The updated policy now grounds data retention in five broad business purposes: operating the business, meeting contractual and legal obligations, improving and developing products and services, protecting system and customer safety, and resolving disputes. Previously, the policy articulated specific criteria for determining retention periods, including customer expectations for retention until manual deletion, availability of automated deletion controls, and data sensitivity. The revised language removes these granular criteria and instead requires users to consult individual product documentation to understand when their specific data will be deleted. This shifts the burden of finding retention timelines from the main policy statement to separate product-specific documents.
View change record →The updated Privacy Statement removes previously stated language about additional rights available to European Economic Area users, narrowing the policy's explicit protections in that region. Simultaneously, the revised terms now explicitly authorize Microsoft to contact users via auto-dialer and prerecorded voice for marketing purposes, provided the user has consented to receive marketing communications to the phone number supplied. This establishes Microsoft's contractual permission to initiate automated marketing calls using artificial intelligence-generated voice technology where user consent to marketing contact has been given.
View change record →This new provision clarifies the rights of organizations/employers to access and control employee/user data, which is critical for enterprise users to understand workplace privacy implications.
View full change record →Employees and students using Microsoft products through work or school accounts should be aware that their organization may access their emails, files, and other data, and may control privacy settings on their behalf. The statement directs such users to their organization's privacy policies for details.
How other platforms handle this
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
For individuals in the United States, please also refer to our Notice For Individuals Residing In Certain US States below and the Consumer Health Data Policy.
Depending on your location, you may have certain rights regarding your personal data, including the right to access, correct, delete, or port your data. EU and UK users may also have the right to object to or restrict certain processing. California residents may have the right to know, delete, corre...
Monitoring
Microsoft has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you use a Microsoft product with an account provided by an organization you are affiliated with, such as your work or school account, that organization can: access and process your data, including the communications data, such as your email messages and files; control and administer your product and product account, including controlling privacy-related settings of the product or product account.— Excerpt from Microsoft's Microsoft Privacy Statement (Legacy)
REGULATORY LANDSCAPE: This provision is relevant to workplace privacy law across jurisdictions, including employee monitoring regulations in various EU member states, the GDPR's application to employee data, and U.S. state electronic communications privacy laws. It also implicates FERPA in educational contexts where student records are involved. Enforcement authorities include national data protection authorities in the EU and relevant U.S. state agencies. GOVERNANCE EXPOSURE: High for organizations deploying Microsoft products in workplace or educational settings. The provision clarifies that data governance in enterprise contexts is substantially determined by the deploying organization's agreements with Microsoft rather than by Microsoft's consumer privacy statement alone. JURISDICTION FLAGS: EU member states have varying employee monitoring laws that may limit organizational access to employee data even in Microsoft-hosted environments. FERPA applies to educational institutions and imposes restrictions on access to student records regardless of the platform used. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Microsoft enterprise products should review their Microsoft Customer Agreement, data processing addenda, and internal IT and HR policies to ensure alignment with the access and control rights described in this provision. Employee and student notice obligations may apply. COMPLIANCE CONSIDERATIONS: Compliance teams at deploying organizations should assess employee and student notice requirements under applicable law; review access logging and data governance policies for Microsoft-hosted environments; and evaluate whether organizational access to employee data is consistent with applicable labor and privacy law.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Users accessing Microsoft products through organizational accounts should be aware that their employer or institution may have access to their communications and files and may control their privacy settings, which is materially different from the protections available to personal account holders.
Employees and students using Microsoft products through work or school accounts should be aware that their organization may access their emails, files, and other data, and may control privacy settings on their behalf. The statement directs such users to their organization's privacy policies for details.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Microsoft.