If you access Microsoft products through a work or school account, your employer or school may be able to access your data, including emails and files, and control your account's privacy settings. Microsoft's privacy protections in this context are supplemented by your organization's own policies.
This analysis describes what Microsoft's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause defines the administrative authority structure for organizational accounts, clarifying that data access and control rights extend to the organization providing the account rather than residing solely with the individual user. This establishes a multi-party governance model where organizational administrators have defined operational and administrative capabilities.
The updated policy establishes additional grounds on which Microsoft may retain personal data. While the prior version tied retention to specific user expectations and available deletion controls, the revised language authorizes retention for 'operating our business, meeting our contractual and legal obligations, improving and developing our products and services, protecting the safety and security of our systems and customers, and resolving disputes.' This expands the stated purposes beyond transaction fulfillment and legal compliance. The updated policy directs users to product-specific documentation for retention details rather than providing explicit deletion procedures and timelines in the privacy statement itself.
View change record →The updated policy now grounds data retention in five broad business purposes: operating the business, meeting contractual and legal obligations, improving and developing products and services, protecting system and customer safety, and resolving disputes. Previously, the policy articulated specific criteria for determining retention periods, including customer expectations for retention until manual deletion, availability of automated deletion controls, and data sensitivity. The revised language removes these granular criteria and instead requires users to consult individual product documentation to understand when their specific data will be deleted. This shifts the burden of finding retention timelines from the main policy statement to separate product-specific documents.
View change record →The updated Privacy Statement removes previously stated language about additional rights available to European Economic Area users, narrowing the policy's explicit protections in that region. Simultaneously, the revised terms now explicitly authorize Microsoft to contact users via auto-dialer and prerecorded voice for marketing purposes, provided the user has consented to receive marketing communications to the phone number supplied. This establishes Microsoft's contractual permission to initiate automated marketing calls using artificial intelligence-generated voice technology where user consent to marketing contact has been given.
View change record →Employees and students using Microsoft products through work or school accounts should be aware that their organization may access their emails, files, and other data, and may control privacy settings on their behalf. The statement directs such users to their organization's privacy policies for details.
Cross-platform context
See how other platforms handle Enterprise and Organizational User Notice and similar clauses.
Compare across platforms →Monitoring
Microsoft has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If you use a Microsoft product with an account provided by an organization you are affiliated with, such as your work or school account, that organization can: access and process your data, including the communications data, such as your email messages and files; control and administer your product and product account, including controlling privacy-related settings of the product or product account.— Excerpt from Microsoft's Microsoft Privacy Statement (Legacy)
REGULATORY LANDSCAPE: This provision is relevant to workplace privacy law across jurisdictions, including employee monitoring regulations in various EU member states, the GDPR's application to employee data, and U.S. state electronic communications privacy laws. It also implicates FERPA in educational contexts where student records are involved. Enforcement authorities include national data protection authorities in the EU and relevant U.S. state agencies. GOVERNANCE EXPOSURE: High for organizations deploying Microsoft products in workplace or educational settings. The provision clarifies that data governance in enterprise contexts is substantially determined by the deploying organization's agreements with Microsoft rather than by Microsoft's consumer privacy statement alone. JURISDICTION FLAGS: EU member states have varying employee monitoring laws that may limit organizational access to employee data even in Microsoft-hosted environments. FERPA applies to educational institutions and imposes restrictions on access to student records regardless of the platform used. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Microsoft enterprise products should review their Microsoft Customer Agreement, data processing addenda, and internal IT and HR policies to ensure alignment with the access and control rights described in this provision. Employee and student notice obligations may apply. COMPLIANCE CONSIDERATIONS: Compliance teams at deploying organizations should assess employee and student notice requirements under applicable law; review access logging and data governance policies for Microsoft-hosted environments; and evaluate whether organizational access to employee data is consistent with applicable labor and privacy law.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This clause defines the administrative authority structure for organizational accounts, clarifying that data access and control rights extend to the organization providing the account rather than residing solely with the individual user. This establishes a multi-party governance model where organizational administrators have defined operational and administrative capabilities.
Employees and students using Microsoft products through work or school accounts should be aware that their organization may access their emails, files, and other data, and may control privacy settings on their behalf. The statement directs such users to their organization's privacy policies for details.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Microsoft.