Microsoft has told UK customers that Anthropic’s Claude models will be switched on in Microsoft 365 Copilot from 9 December unless administrators actively choose otherwise. EU tenants are getting EU Data Boundary processing for Claude at the same time, while UK tenants are not, which hands UK data protection and security teams a four-week compliance deadline.
What happened
On 10 November 2026 Microsoft published Message Center notice MC1546435 to UK tenants. It says that from 9 December 2026, any UK tenant that has not yet chosen an Anthropic setting in the Microsoft 365 admin centre will have Claude turned on by default. Up to now, the UK has been one of the regions where Claude was off by default, alongside the EU and the European Free Trade Association (EFTA) countries.
The same notice retires an intermediate option that let organisations restrict Claude to Copilot inside the Microsoft 365 apps. Tenants that picked that narrower setting will be moved to “All users” on the change date. Tenants that have already enabled Claude, disabled it, or scoped it to named users and groups keep their existing choice. Once enabled, Claude becomes available across Copilot experiences and in Copilot Studio.
A sister notice, MC1546438, went to EU and EFTA tenants on the same day. It makes the same default switch on 9 December, but adds that in early December the processing for Claude in Copilot will move inside the EU Data Boundary for eligible European organisations. The UK notice contains no equivalent promise. It states plainly that the EU Data Boundary does not cover UK tenants.
The detail
Microsoft treats Anthropic as one of its subprocessors. According to the Microsoft Learn page on Claude in Microsoft Online Services, last updated on 4 November, the standard Claude models are governed by Microsoft’s Product Terms and its Data Protection Addendum (DPA). The same page records that Claude, across Copilot, Researcher, Copilot Studio, Power Platform and the Office apps, sits outside both the EU Data Boundary and any in-country processing commitments for now.
Where exactly is UK data processed? Microsoft’s UK notice does not name a country. It points administrators to the Microsoft Online Services Subprocessors List for processing locations. The Register, reporting the change on 10 November, said Microsoft’s documentation indicates that Anthropic handles this data in the US. Organisations should confirm that against the subprocessor list themselves rather than rely on press summaries.
There is a separate category to be aware of. Microsoft lists “Anthropic models with Data Retention” as a distinct setting that is off by default and is not part of this change. For those models, the Learn page says Anthropic acts as an independent processor under its own terms and retains most prompts and responses for as long as 30 days, with flagged content held for longer. That is a materially different arrangement from the subprocessor model and should stay switched off unless someone has made a deliberate, documented decision.
The control itself sits in the Microsoft 365 admin centre under Copilot settings, in a section for AI providers operating as Microsoft subprocessors. Changing it requires the AI Administrator or Global Administrator role.
Why it matters for UK organisations
Under UK GDPR, a new subprocessor and a new processing location are not just configuration details. If Claude is processing prompts that contain personal data, and those prompts leave the UK, the controller needs to be satisfied that a valid transfer mechanism is in place and that its records of processing, privacy notices and data protection impact assessments (DPIAs) reflect reality. Microsoft’s DPA may well cover the contractual side, but the accountability duty sits with the customer, not the supplier.
The asymmetry is the awkward part. A multinational with EU and UK tenants could end up with Claude data handled inside the EU Data Boundary on one side of the Channel and outside it on the other, under the same product and the same switch date. A default that changes the residency picture for one model family deserves a fresh look from the data protection officer.
Regulated sectors have extra reasons to care. Financial services firms need to think about outsourcing and third-party risk obligations, public bodies may have contractual or policy commitments on offshoring, and anyone handling special category data should be asking whether staff could paste it into a prompt that reaches a model they never formally approved.
Expert view
In my experience, the riskiest cloud changes are the quiet defaults, not the dramatic breaches. A setting that nobody touched for months suddenly carries meaning, and the organisations most exposed are the ones that never got round to deciding. Opt-out defaults reward the vendor for the customer’s inattention.
To be clear, this is not a vulnerability, and nothing here suggests Claude handles data less carefully than other models in Copilot. The issue is governance. When we assess Microsoft 365 estates, the gap is rarely technical capability; it is the absence of an owner for AI configuration, change notices that land in an unread Message Center feed, and DPIAs written for a product as it existed at purchase rather than as it is today.
I would also question the retirement of the apps-only option. Organisations that chose it made a deliberate, limited decision. Moving them to “All users” quietly widens that scope, including into Copilot Studio, where agents can be built and connected to business data. That deserves more than a line in a notice.
What to do now
- Make a decision before 9 December. Check the Anthropic setting in the admin centre. If nobody has chosen, the choice will be made for you. Set it to “No users” until the review below is finished if in doubt.
- Confirm processing locations yourself. Read the current Microsoft Online Services Subprocessors List and the Claude page on Microsoft Learn, and record what they say about where Claude processes UK tenant data.
- Update your DPIA and records of processing. Add Anthropic as a subprocessor where Claude is permitted, document the transfer mechanism, and amend privacy notices if needed.
- Scope access deliberately. If you want Claude, use “Specific users and groups” rather than “All users”, and review Copilot Studio and Power Platform settings separately.
- Keep the Data Retention variant off. Do not enable “Anthropic models with Data Retention” without legal review of Anthropic’s own terms.
- Fix the process, not just the setting. Route Message Center notices tagged as needing action to a named owner. This maps to the Cyber Essentials secure configuration control: know what your cloud services are set to do, and why.
Bottom line
Microsoft is entitled to expand model choice, and many organisations will happily adopt Claude. But a default switch that leaves UK data outside the residency commitments now offered to EU customers is a compliance event, not a feature update. UK organisations have until 9 December to make a recorded, deliberate choice. Doing nothing is also a choice, just not one you will be able to defend easily.
Sources
- The Register: Microsoft is giving Claude the keys to UK Copilot tenants by default
- MWPro: MC1546435 Microsoft Copilot enables Claude models by default in the UK
- Microsoft Learn: Claude models from Anthropic in Microsoft Online Services
- Microsoft 365 Message Center: MC1546438 Claude models in Copilot coming into the EU Data Boundary
- SharePoint Stuff: How to opt out of Claude models in Microsoft 365 Copilot
