Which Microsoft 365 settings decide data protection?

Published 30 October 2026

Summary: For the customer data processed to provide Microsoft 365, Microsoft is a processor acting on your documented instructions; you are the controller and decide how the service is used. For certain limited processing of its own, such as billing, Microsoft is an independent controller. Data protection in Microsoft 365 is largely decided in six areas: sharing and guest access, retention and deletion, sensitivity labels, DLP, the audit log, and where data is stored. None of these is right by default; the settings need to reflect your own decisions on purposes, access and retention periods.

What Microsoft does and what you configure

Microsoft describes itself as a processor that handles customer data on the controller’s documented instructions, set out in the Product Terms and the Microsoft Products and Services Data Protection Addendum (DPA). The DPA also states that Microsoft acts as an independent controller when it processes personal data for certain business operations incident to providing the services, such as billing and account management, internal reporting and financial reporting. Microsoft also states that the controller is responsible for assessing the risks and deciding how data is used. That matches the division of roles in Article 28 of the GDPR: the processor must provide sufficient guarantees, but responsibility for the processing stays with you.

According to Microsoft, nothing in its services in itself requires a data protection impact assessment; it depends on your configuration. The service contains the tools, but your choices decide whether they are used.

Area	Microsoft	You
Platform operation and security	Responsible under the Product Terms and DPA	Monitor the agreement and sub-processors
Sharing and guests	Provides the settings	Decide levels and exceptions
Retention and deletion	Enforces the retention settings	Decide retention periods and configure them
Labels and DLP	Provides the features	Decide the classification and rules
Audit log	Logs and retains according to licence	Decide how long logs are needed and who searches them
Data location	Commits to the EU Data Boundary for services in scope	Check the scope and the exceptions

Sharing and guest access in SharePoint, OneDrive and Teams

Sharing settings decide how easily personal data leaves the organisation. In the SharePoint admin center you choose one level for the whole organisation:

• Anyone: links that work without signing in. This is the most permissive level.
• New and existing guests: external people must sign in or verify themselves with a code.
• Existing guests: sharing only with guests who are already in the directory.
• Only people in your organization: no external sharing.

OneDrive can be set more restrictively than SharePoint but not more permissively, and each site can be set more strictly than the organisation level. Anyone links can be set to expire after a set number of days and limited to view permission. You also choose which link type is offered by default, with Specific people as the most restrictive option, and guest access to a site or OneDrive can be set to expire automatically.

Guest access in Teams is an organisation-wide setting that depends on Microsoft Entra ID, Microsoft 365 Groups and SharePoint. A guest who leaves a team keeps their guest account in the directory until an administrator removes it, so decide how guest accounts are reviewed.

Retention and deletion with retention policies and retention labels

Under Article 5(1)(e) of the GDPR, storage limitation, personal data must not be kept in identifiable form for longer than is necessary for the purposes. In Microsoft 365 you implement your retention decisions in Microsoft Purview. A retention policy applies to a whole site or mailbox, while a retention label is applied to individual items such as a document or an email. Both can retain content, delete it, or retain and then delete it.

Two principles from Microsoft are worth knowing: retention takes precedence over deletion, and the longest retention period wins. A broad policy that retains everything for 10 years can therefore keep material that you have decided to delete after 2 years. Content deleted during a retention period is also kept in hidden locations, such as the Preservation Hold library in SharePoint and OneDrive.

Also think about former employees. When an account is deleted, the user’s OneDrive is kept for 30 days by default, and the period can be set between 30 and 3650 days. By default, the user’s manager is given access to the OneDrive when the account is deleted. That should match what you have decided and told your employees.

Sensitivity labels and DLP

Sensitivity labels in Microsoft Purview Information Protection classify content and can encrypt it, add markings such as headers or watermarks, and control settings for teams, groups and sites, for example external sharing and access from unmanaged devices. The label travels with the file because it is stored in the file’s metadata.

DLP (data loss prevention) monitors sensitive information in places such as Exchange, SharePoint, OneDrive and Teams chats. A DLP policy can show the user a warning, block the sharing, or let the user override the block with a justification. Microsoft has a built-in information type for Swedish personal identity numbers (personnummer) that can be used in DLP rules.

Labels and DLP only work if they rest on a classification you have decided. Start with a few levels that users understand, and run new DLP policies in simulation mode before they start blocking.

The audit log: can you show what happened?

The audit log in Microsoft Purview Audit shows who opened, shared or deleted a file, among other activities. You need it when you investigate a personal data breach, and it can be part of the appropriate technical and organisational measures that Article 32 requires.

• According to Microsoft, audit logging is on by default in Microsoft 365, but not for the Business Basic, Business Standard and Business Premium licences, where it must be turned on manually. So check the status in your own tenant. Once logging is on, Audit (Standard) retains records for 180 days.
• Audit (Premium) retains records from Exchange, SharePoint, OneDrive and Microsoft Entra ID for one year by default and supports custom audit log retention policies.
• Retention for up to 10 years requires a separate add-on licence per user.

According to Microsoft, retention beyond 180 days requires the user who performs the activity to have an E5 licence or an equivalent add-on; for guests and other users, records are retained for 180 days. Decide how long you need the logs. They contain personal data themselves.

Where is data stored? The EU Data Boundary and data location

The EU Data Boundary is Microsoft’s commitment to store and process customer data and personal data for its enterprise services, including Microsoft 365, within the EU and EFTA. For Microsoft 365, customers whose tenant is registered in an EU or EFTA country are in scope. Customers who have purchased Multi-Geo are not, and Microsoft describes limited circumstances in which data is still transferred outside it.

You can see where your tenant stores data in the Microsoft 365 admin center under Settings, Org settings, Organization profile and Data location. Sweden is one of the local regions where the Advanced Data Residency add-on provides extended data location commitments.

The boundary does not automatically cover everything connected to the tenant. Microsoft states, for example, that some third-party AI models, used as sub-processors in Microsoft Copilot (formerly Microsoft 365 Copilot), are currently excluded from the EU Data Boundary. For customers in the EU/EFTA those models are off by default, but an administrator can turn them on. Copilot also surfaces only content the user already has at least view permission to, so overly generous sharing becomes visible quickly. Keep track of sub-processors and third-country transfers in your record of processing activities and in the agreement, even when you use the EU Data Boundary.

Also check the flex routing setting for Copilot. When it is on, the AI processing, the step in which the language model produces the answer, can take place outside the EU Data Boundary during periods of peak demand, according to Microsoft in the United States, Canada or Australia. Data at rest is still stored inside the boundary, except for limited pseudonymised data. For eligible tenants created after 25 March 2026 the setting is on by default, and Microsoft encourages administrators of older tenants to check it. It is in the Microsoft 365 admin center under Copilot and Settings and can be turned off at any time. If you require processing within the EU, check the tenant’s actual setting rather than assuming that Microsoft 365 is covered by the EU Data Boundary.

Checklist: what you have when the basics are in place

1. A decided level for external sharing, with justified exceptions per site.
2. Expiry for Anyone links and guest access, or a decision not to allow them.
3. A routine for reviewing and removing guest accounts.
4. Retention settings that match your retention plan, and a check of where longer retention periods take over.
5. A decision on what happens to former employees’ OneDrive and who gets access.
6. A classification with sensitivity labels and DLP policies that have been run in simulation mode.
7. An audit log checked to be on, and a decision on how long the logs are needed and who may search them.
8. A checked data location and a review of which services and AI features fall outside the EU Data Boundary.
9. A decision on flex routing for Copilot and on third-party AI models, with the settings checked in the tenant.

Want to know how your Microsoft 365 environment measures up? We review sharing, guests, retention, labels and logging against your own decisions on personal data. Read more about our work in data protection and privacy and about a GDPR current-state and gap analysis, or contact us.

Sources: Microsoft Learn, the pages on Microsoft and the GDPR, sharing settings in SharePoint and OneDrive, guest access in Teams, retention policies and labels, OneDrive for deleted users, sensitivity labels, DLP, Sweden national ID, Audit, turning auditing on and audit log retention, the EU Data Boundary, data location, Microsoft Copilot, AI providers as sub-processors and Flex routing (EU and EFTA); the Microsoft Products and Services Data Protection Addendum (DPA), May 2026; Regulation (EU) 2016/679 (GDPR), Articles 5, 28 and 32. Verified 2026-10-03.

This text is general information, not legal advice. Microsoft 365 features, defaults and licence terms change often; check the current details with Microsoft and assess your own situation before changing settings.