Vendor profile
Microsoft 365: where is customer data stored and processed?
Microsoft 365 is a business product from Microsoft Corporation, headquartered in the USA. Customer data and pseudonymised personal data are stored and processed in EU/EEA datacentres for tenants covered by the EU Data Boundary, though the specific countries are not stated. Multi-Geo tenants are not covered by the EU Data Boundary. Identity data is handled in Europe for most data, but Microsoft Entra MFA logs (UPN, phone numbers, SMS challenges) may be stored in North America or in the geo area, which is not confirmed. Agent 365 observability data may be stored in the USA for tenants outside the EU, and the transfer basis is not stated.
See the map and sourcesWhere data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|---|---|
| Storage | Europe (country not stated) | – |
| Processing | Europe (country not stated) | – |
| Login and user account | Europe (country not stated) | USA |
| Logs and telemetry | Europe (country not stated) | – |
| AI features | Europe (country not stated) | USA |
Ownership and agreements
| Owner | Microsoft Corporation (USA) |
|---|---|
| Headquarters | USA |
| Data processing agreement | Found and read |
| Certifications | ISO/IEC 27001, SOC 2 |