Anthropic in Excel and PowerPoint is a separate setting, on by default for EU tenants created after 25 March 2026

Copilot in Excel and PowerPoint has its own Anthropic setting, a different object from the global Anthropic subprocessor control. It defaults to on for EU, EFTA and UK tenants created after 25 March 2026, and while on it puts that processing outside the Microsoft EU Data Boundary. The same page carries an Important callout the compliance documentation never repeats: "The Anthropic independent processor (IP) setting was decommissioned on May 1, 2026. If Anthropic is not enabled as a Microsoft subprocessor, access to Anthropic models and related features is no longer available." So the app level default does not on its own send content outside the boundary while the global control sits at No users, and an administrator has to read both objects, in that order, to know which state a tenant is actually in.

Last verified: 2026-08-20.

What changed

Microsoft's page on Copilot in Microsoft 365 apps with Anthropic models, read 2026-08-20, gives the default in one sentence: "This setting is on by default for tenants in the EU, EFTA, and UK that were created after March 25, 2026." It holds them apart in two more: "It is separate from the global Anthropic subprocessor setting in Microsoft 365", and "Changes to this setting do not modify global subprocessor configurations."

The transfer statement is on the same page: "data processing for these models occurs outside of the Microsoft EU Data Boundary (EUDB)". Word carries a qualifier instead of a date, "support for Anthropic models will be added in summer, 2026", so the shipped surface on the read date is Excel and PowerPoint.

One date arms two of them, though not for the same set of tenants. Flex routing shares the 25 March 2026 cutoff for eligible EU and EFTA tenants, and names destinations the Anthropic pages never do: "LLM inferencing may occur in the United States, Canada, or Australia during times of peak demand".

Who is affected

Any EU, EFTA or UK tenant created after 25 March 2026 with Copilot in the Microsoft 365 apps, the newest cohort and the least likely to have had a governance review.

Two vendor pages disagree, and the disagreement decides what a data protection impact assessment says. Anthropic models in Microsoft Online Services says "Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default." That is accurate about the global control, and read alone it hides a second control with the opposite default, so nothing where it is read tells a reader which of the two objects the sentence describes. Plan against the app level page: it governs the app surface and is the more restrictive reading.

The two dates are not the same kind of date. The subprocessor page dates the setting's introduction, "On April 3, 2026", while the app level page gives 25 March 2026 only as the tenant creation cutoff that decides the default. Neither page explains how a setting introduced on 3 April carries a default keyed to tenants created from 26 March, and neither reconciles the gap. Record both. The subprocessor page dates its introduction "On April 3, 2026", nine days after the date from which the other page applies the on default. Record both; neither page reconciles them.

The cost lands on a document. An operator answering a transfer question in a customer schedule or a NIS2 or DORA supplier questionnaire can state that Copilot processing stays inside the EU Data Boundary, cite the subprocessor page, and be disproved from another page in the same set.

flowchart TD
  accTitle: Three separate controls decide whether Copilot content leaves the EU Data Boundary
  accDescr: Three inputs, tenant region, creation date against 25 March 2026, and the global subprocessor scope, lead to four terminal states, with the app level control and the global control drawn as separate boxes.
  R{"Input 1, region from countryLetterCode"} -->|"EU, EFTA or UK"| C{"Input 2, createdDateTime vs 25 March 2026"}
  C -->|"on or before"| M["Message Center only"]
  C -->|"after"| A["App control, Anthropic in Office, on"]
  C -->|"after"| F["Flex routing, on by default, EU and EFTA"]
  S{"Input 3, global subprocessor scope"}
  N["A separate object, no inheritance"]
  S -.- N
  A -.- N
  A -->|"turned off"| T1["Not sent outside the EUDB by this path"]
  A --> T2
  S -->|"No users"| T2["Anthropic unavailable, 1 May 2026 note"]
  A --> T3
  S -->|"All users, or specific"| T3["Outside the EUDB, control unavailable"]
  F --> T4["May infer in US, Canada, AU at peak"]
  W["Word unresolved, summer 2026"]
  A -.- W

Tenant check

Only one half of the check is automatable. This Graph call reports the region and creation date that decide whether either default applied.

GET https://graph.microsoft.com/v1.0/organization?$select=id,displayName,countryLetterCode,createdDateTime
Authorization: Bearer {token}

# countryLetterCode in the EU, EFTA or UK set, the app level default applies.
# countryLetterCode in the EU or EFTA set only, flex routing is also in scope.
# createdDateTime later than 2026-03-25T23:59:59Z, those defaults were on.

A 200 OK returns one element carrying countryLetterCode and createdDateTime. A creation date after 25 March 2026 on an EU, EFTA or UK country code means the app level default landed on. The flex routing default landed on only for eligible EU and EFTA tenants, because that page limits eligibility to customers in scope for the EU Data Boundary for Microsoft 365, and the UK is not. A null createdDateTime means an under-permissioned read rather than a young tenant: the List organizations reference says "To read all properties, use at least Organization.Read.All." Nothing in the call can write.

The second half has no API. None of the four controls in the table has a documented Graph, PowerShell or CLI read, so a person has to look. Describe the destination by what it does, not by its label, because Microsoft's own pages reach the same admin centre page by more than one route and give it more than one name: the page listing AI providers, each with a scope of No users, All users, or specific users and groups, plus a separate control for Anthropic model use inside the Office apps, itself named two ways across the set.

Viewing needs less privilege than the primary page asks. Managing Copilot scenarios says to "sign in with the Global Reader role", and adds "Use roles with the fewest permissions."

Limitations

The Graph call proves region and creation date. It reads none of the four controls and cannot establish any current value, since a setting may have been changed after provisioning. It narrows who has to look; it does not replace looking. For tenants created on or before 25 March 2026 it says nothing about the default, because both pages redirect to the Message Center, which is per tenant and has no public URL.

Word is not confirmed in scope and no day is published for it. Multi-Geo tenants are a separate case: the flex routing page puts such customers "not in scope for the EU Data Boundary for Microsoft 365" whatever their registered country, which changes the answer for a Maltese tenant that has it. Government and sovereign clouds fall outside this note.

One gap belongs on record. The ongoing partial transfers page carries entries for flex routing and for OpenAI operated models, and none for Anthropic; the excluded services page, also read in full on 2026-08-20, lists no Anthropic entry either. That is what those pages do not contain, not a vendor denial. Neither is the last word: the excluded list calls the Product Terms "the definitive source" for whether a service is in the boundary.

Act now

Decision: Act now. The trigger is a live default rather than a future deadline, which is what separates Act now from Schedule: every qualifying tenant provisioned since 25 March 2026 carries an app level default no administrator was asked about, and whether it is currently doing anything turns on a second control the same administrator may never have opened. Run the Graph call across the tenants under management, filter to EU, EFTA and UK country codes created after that day, have someone with Global Reader read all four controls in the table, and correct any transfer statement already sent.

Recording what a tenant's defaults were on the day a customer question was answered is ordinary work under the Microsoft 365 management service.