Microsoft Copilot and the EU data boundary: what Flex Routing means for your data residency

Microsoft Copilot has reached many businesses, along with a justified question: where are my data actually processed? The short answer is usually in the EU, but not always. A little-known mechanism called Flex Routing can process requests outside the EU data boundary during high demand. Whether it's active depends on a setting that matters for Microsoft Copilot data residency—one many businesses have never seen.

The short answer: where Microsoft Copilot processes your data

For customers based in the EU, Microsoft 365 Copilot is a service within the EU Data Boundary. Requests to the language model are routed per Microsoft to the nearest regional datacenters, with EU traffic staying within the EU data boundary (Microsoft Learn, as of July 2026). Stored content from your Copilot interactions also lives within this boundary. One exception exists for peak load, and that's where Flex Routing comes in.

What the EU data boundary covers for Copilot

The EU data boundary is a geographically defined space where Microsoft commits to store and process customer data for its major enterprise services, including Microsoft 365, Azure, Dynamics 365, and the Power Platform. For Copilot, this normally means: processing your prompts and storing the responses stay in datacenters within the EU or EFTA. The commitment holds with clearly named exceptions, and one affects language model compute load.

Flex Routing: the mechanism many miss

Flex Routing lets processing in the language model (so-called inferencing) run outside the EU data boundary during high demand, to maintain steady Copilot experience. If Flex Routing is active, per Microsoft this processing can happen in the USA, Canada, or Australia. The important distinction: it affects processing, not storage. Your data stays within the EU data boundary, except limited pseudonymized data like internal user IDs, which may be stored outside for security and operations reasons. Data is encrypted throughout, in transit and at rest.

What applies by default and where to set it

Here's the point requiring active choice. Per Microsoft, Flex Routing is enabled by default for eligible tenants created after March 25, 2026. For older tenants, Microsoft points to the Message Center, where the applicable default is documented. Microsoft explicitly recommends all administrators check and align the setting with their business requirements.

You'll find the setting in the Microsoft 365 Admin Center under Copilot, then Settings, then Flex Routing during peak load. This requires the AI Administrator role. If you choose not to permit Flex Routing, processing stays within the EU data boundary even during peak times. For Copilot features in Dynamics 365, the Power Platform, and Copilot Studio, there's a separate setting in the Power Platform Admin Center.

The information here comes from Microsoft's Flex Routing documentation (Microsoft Learn, as of July 2026).

Advanced Data Residency: data in Germany, but not automatic

A common misunderstanding: the EU data boundary doesn't automatically mean Germany. If you want to pin storage to a single country specifically, you need the Advanced Data Residency add-on, which places stored Copilot-interaction content in the local country region. This affects storage, not processing, and is independent of the Flex Routing setting. We've covered in our article GDPR-compliant AI how such building blocks fit into a clean data-protection architecture.

What businesses should verify

You don't need to operate a datacenter to stay in control here. It's enough to set a few settings deliberately rather than leave them to chance.

• Check the Flex Routing setting in the Microsoft 365 Admin Center and document whether processing outside the EU data boundary is permitted
• For strict data residency needs, evaluate the Advanced Data Residency add-on or Multi-Geo capabilities
• For Dynamics 365, Power Platform, and Copilot Studio, align the separate setting in the Power Platform Admin Center
• Align the decision with your data protection officer and document it in your processing inventory

This is a factual summary of Microsoft documentation and not legal advice. If you're rolling out Copilot and want to set up data processing properly from the start, we support you on our page for Microsoft Copilot consulting. The goal is always for you to understand where your data lives and is processed.

Control, for us, also means you remain at the wheel after setup and can independently own these settings. Why this principle matters to us, read in the article Continuing independently, staying in control.

Common questions

Does Microsoft Copilot always process my data in the EU?

Not necessarily. For EU customers, Microsoft 365 Copilot is an EU-data-boundary service, and storage stays there. If Flex Routing is active, however, language-model processing can during peak load happen in the USA, Canada, or Australia. If Flex Routing is off, processing also stays within the EU data boundary.

What is Flex Routing with Microsoft Copilot?

Flex Routing is a setting for EU and EFTA customers that permits language-model processing to run outside the EU data boundary during high load. It affects only processing, not storage. In the Microsoft 365 Admin Center, you can change it anytime.

Is Flex Routing on by default?

Per Microsoft, Flex Routing is enabled by default for eligible tenants created after March 25, 2026. For older tenants, the applicable default is documented in Message Center. Microsoft recommends all admins actively check the setting instead of assuming it.

How do I ensure Copilot processes only in the EU?

Set the Flex Routing setting in the Microsoft 365 Admin Center to not permit Flex Routing. Then processing stays within the EU data boundary even during peak load. For Copilot in Dynamics 365 and the Power Platform, also check the setting in the Power Platform Admin Center.

Does that mean my Copilot data lives in Germany?

Not automatically. The EU data boundary spans the EU and EFTA, not a single country. If you want to pin storage specifically to Germany, you need the Advanced Data Residency add-on or Microsoft 365 Multi-Geo capabilities.