Microsoft Copilot Cowork

Cowork documents no export of the agent and no import or restore on any runtime Microsoft does not operate. Only individual output files can be downloaded (singly or as a zip of up to 50 files / 500 MB).

• Use Cowork (pinned)
• Cowork common questions (pinned)

Only created files and custom SKILL.md files (both in OneDrive) can be taken out by the owner. Task conversations, scheduled prompts, 'don't ask again' permissions, built-in skills and the base configuration stay with Microsoft, and there is no owner-facing agent export.

• Use Cowork (pinned)
• Cowork overview (pinned)

Cowork runs only as a Microsoft-hosted service. It needs an active Microsoft 365 Copilot licence, Frontier enrolment and Microsoft accounts. Microsoft may change or discontinue previews at any time without notice.

• Get started with Cowork (pinned)
• Cowork preview include (pinned)
• Microsoft Product Terms – Online Services

Microsoft selects the model ('Cowork picks the model best suited for the job'), and Cowork requires Anthropic to be enabled as a Microsoft subprocessor. There is no option to choose another model or a local one.

• Copilot Cowork product page
• Get started with Cowork (pinned)

The Product Terms give 90 days to extract customer data (including OneDrive files and skills) from a disabled account after expiry. Public evidence does not settle whether for-cause termination is covered, and previews can be discontinued without notice and with no published shutdown or export plan.

• Microsoft Product Terms – Online Services
• Data retention, deletion, and destruction in Microsoft 365

Task state, schedules, permissions, built-in skills and the base logic live in Microsoft's service and can be read only through Microsoft's interfaces (the Cowork UI, Purview, eDiscovery). Microsoft holds the default encryption keys. Only custom skills are plain Markdown.

• Use Cowork (pinned)
• Data, privacy and security for Microsoft 365 Copilot (pinned)

The base prompt and assembled context are not shown to the owner, and some background operations such as script execution run without showing their steps. The model in use cannot be determined: the Purview audit docs state 'Currently, Cowork doesn't show provider details'.

• Use Cowork (pinned)
• Audit logs for Copilot and AI applications

Microsoft publishes bounded maximum retention for Microsoft 365 data classes (30 days after active deletion, 180 days after the subscription ends) and admins can search Copilot interactions. Microsoft-held service data (identifiers, audit records, execution-environment data) is not visible item by item, and Cowork-specific retention is not documented separately.

• Data retention, deletion, and destruction in Microsoft 365
• Data, privacy and security for Microsoft 365 Copilot (pinned)

No paid placement is documented, and Cowork openly works through Microsoft 365 apps and Microsoft-chosen models. However, these first-party defaults cannot be switched off or replaced, and no binding commitment against self-preferencing was found.

• Copilot Cowork product page
• Cowork overview (pinned)

Purview CopilotInteraction records list accessed resources with read/create/modify actions, but not action arguments such as the email content sent. Audit Standard keeps them for 180 days. Coverage of scheduled runs is not documented, and there is no documented notice to the owner when recording fails.

• Audit logs for Copilot and AI applications
• Manage Cowork for your organization (pinned)

Microsoft holds the Purview audit log, and no hash chain, signature or independent verifier is documented that would let the owner detect edits or deletions.

• Audit logs for Copilot and AI applications

Microsoft's service writes the audit records and Cowork's documented skills have no audit-log access. However, no protection against the agent altering or suppressing records is documented, and Cowork acts with the user's (here, admin's) permissions and runs scripts in its sandbox.

• Audit logs for Copilot and AI applications
• Cowork common questions (pinned)

Cowork and its required Microsoft 365 services are closed source.

• Copilot Cowork product page

Cowork acts as the user's Microsoft Entra / Microsoft 365 account ('Every action Cowork takes is authorized through your Microsoft 365 account'). That identity is issued by Microsoft and Microsoft can revoke it.

• Cowork common questions (pinned)

Custom skills sit in OneDrive, whose version history shows and restores edits, and admin setting changes are audited in Purview. Changes to the model, base instructions, built-in skills and approval permissions have no attributable history or restore.

• Use Cowork (pinned)
• Audit logs for Copilot and AI applications

The owner can add up to 50 custom SKILL.md skills, but the base prompt and the 13 built-in skills cannot be replaced or edited.

• Use Cowork (pinned)

Custom skills can be listed, edited and deleted item by item, and task conversations can be resumed and deleted through the activity history. The Cowork docs do not say whether Cowork uses Copilot memory, whose chat-history-derived details are not listed item by item or editable.

• Copilot personalization and memory (pinned)
• Use Cowork (pinned)

Custom skills are instructions, not new tools. The product page mentions plugins for partner tools, but Cowork's docs describe no owner-built tool interface, and built-in skills cannot be removed.

• Copilot Cowork product page
• Cowork common questions (pinned)

The owner-admin can configure DLP and auditing. Microsoft's harmful-content filtering, the isolated execution sandbox and the by-design limits (no deletion of OneDrive or SharePoint files, no local files) cannot be changed.

• Cowork common questions (pinned)
• Data, privacy and security for Microsoft 365 Copilot (pinned)

Microsoft picks and regularly updates the models, and previews 'may change over time' or be changed or discontinued without notice. There is no version pinning or opt-in for updates.

• Data, privacy and security for Microsoft 365 Copilot (pinned)
• Cowork preview include (pinned)
• Microsoft Product Terms – Online Services

There is no owner setting to limit which senders or content Cowork takes instructions from, and no per-recipient or per-channel contact list for the agent. Data scope is the user's full permissions, narrowed only by DLP and labels. Cowork has no payment capability, so the spend dimension was treated as met under G11.

• Cowork common questions (pinned)
• Manage Cowork for your organization (pinned)

Cowork asks before 'sensitive' actions and shows previews and parameters, but Cowork, not the owner, decides which actions are gated. 'Don't ask again' and 'Approve All' can skip later prompts.

• Use Cowork (pinned)

Each task has a hard pause and a cancel, but scheduled prompts must be paused separately. No single control is documented that stops all tasks and schedules at once.

• Use Cowork (pinned)

Prompts and responses are not used to train foundation models, and feedback is optional. Sending content to Anthropic as a subprocessor is on by default outside the EU/UK (opt-out, not owner-selected), and web search to Bing is controlled by an admin setting. Data terms change on notice, not with specific consent.

• Anthropic as a subprocessor for Microsoft Online Services (pinned)
• Data, privacy and security for Microsoft 365 Copilot (pinned)

Cowork acts through delegated Microsoft 365 access, and admin deployment 'accepts users' permissions on their behalf'. Access can be removed by blocking Cowork or the user, which is all-or-nothing. No per-credential list or revoke control is documented for Cowork.

• Manage Cowork for your organization (pinned)
• Cowork common questions (pinned)

There is no single action that deletes the whole agent. Activity history, skills and schedules are deleted separately, and Purview audit records and Copilot memory survive deletion of chat history. Full erasure happens only when the tenant subscription ends (within 180 days, with no documented confirmation).

• Copilot personalization and memory (pinned)
• Data retention, deletion, and destruction in Microsoft 365