Quick answer. As of September 2026, OpenAI-operated models have been enabled by default in Microsoft Copilot for eligible commercial customers since July 24, 2026, and Microsoft’s own documentation states that these models aren’t FedRAMP High authorized and that a PCI DSS Attestation of Compliance, a HITRUST CSF Certification Letter and a SOC 1 Type 2 report aren’t available for them. The default and the exclusions reach commercial tenants only: according to Microsoft’s OpenAI as a subprocessor in Microsoft Online Services page, “Access to OpenAI operated models isn’t currently available for use in government clouds (GCC, GCC High, DoD) or sovereign clouds.” An AI Administrator or Global Administrator can turn the setting off for all users, or limit it to specific users or Microsoft Entra ID security groups, in the Microsoft 365 admin center, and can turn it back on later if the decision changes.
The question often arrives sideways. A customer’s security questionnaire asks which subprocessors handle the organization’s Microsoft 365 data and which attestations cover them, or an administrator reviewing Copilot settings finds a page called AI providers operating as Microsoft subprocessors with OpenAI already on for all users. Nobody in IT chose that; Microsoft made it the default for eligible commercial customers, and the tenant kept it unless an administrator turned it off. The IT Director then has two questions to answer: what Microsoft actually says about these models’ attestations, and whether leaving them on is consistent with commitments the organization has already made to auditors, customers or its own security office. This guide answers the first in Microsoft’s own words and gives criteria for the second. It does not decide whether any particular contract requires FedRAMP High, PCI DSS, HITRUST or SOC 1 Type 2 coverage; that determination belongs to the organization’s contract owners and counsel.
What changed on July 24, 2026, and for whom
If the three dates in Microsoft’s documentation get merged into one, the audit trail is wrong from its first line, so keep them apart. According to Microsoft’s OpenAI as a subprocessor in Microsoft Online Services page (last updated August 18, 2026), “OpenAI was added to the Microsoft Online Services Subprocessors List on June 23, 2026.” The same page says “OpenAI as a subprocessor is available for use as of July 9, 2026.” The third date is the one that changed tenants: “As of July 24, 2026, OpenAI operated models are enabled for all users for eligible commercial customers, unless you specifically disable the use of OpenAI operated models by selecting No users for the setting in the Microsoft 365 admin center.”
Those are three separate events: OpenAI added to the subprocessor list, the option made available, and the models switched on by default. A commercial tenant where no administrator selected No users has had OpenAI-operated models enabled for all users since July 24, 2026. The same page also notes that “Microsoft 365 Copilot is now named Microsoft Copilot”, so the same setting can come up under either name inside one organization.
The decision does not reach every tenant. Microsoft states that the models aren’t currently available in GCC, GCC High, DoD or sovereign clouds, so a government-cloud tenant has no OpenAI-operated models to decide about. And if the tenant is not yet live on Copilot at all, the model-provider setting is a later question: turning Copilot on is a readiness decision with its own gates, covered in Is Your Microsoft Environment Ready for Copilot? What Must Be True First.
OpenAI as a subprocessor is not Azure OpenAI
If someone in the review points to Azure OpenAI’s government authorizations to close the question, stop there, because Microsoft draws the line itself. Its page opens with this note: “The information in this article only applies to OpenAI models operated by OpenAI (provided by OpenAI as a subprocessor). The information doesn’t apply to OpenAI models operated by Microsoft (Azure OpenAI).” It describes the new option as an addition, not a replacement: “In addition to OpenAI models that Microsoft operates (Azure OpenAI), Microsoft now provides OpenAI operated models through OpenAI as a subprocessor.”
Microsoft’s Understanding AI functionality and models in Microsoft Online Services page (last updated September 10, 2026) separates the two categories. For models hosted and operated by Microsoft, it says “Data does not leave Microsoft.” For the other category it says “An AI Subprocessor is a third-party AI provider that handles data on Microsoft’s behalf and under Microsoft’s Data Protection Addendum (DPA), Product Terms, and enterprise safeguards.”
Azure OpenAI’s own compliance status is documented on a different Microsoft page. Microsoft’s Azure, Dynamics 365, Microsoft 365, and Power Platform services compliance scope page (last updated September 21, 2026) lists Azure OpenAI with FedRAMP High checked in both its Azure public and Azure Government tables. That listing is about Microsoft-operated Azure OpenAI. For OpenAI-operated models, Microsoft’s statement is the Exclusions section covered next, and one product’s authorization never answers the question for the other.
Users will not see the difference on their own. Microsoft says “OpenAI operated models serve the same GPT-based Copilot experiences your users already have.” That is why the question tends to surface in a questionnaire or an admin review rather than from a user report.
The four exclusions, in Microsoft’s own words
When the compliance office asks for the exact language, give it the four statements as Microsoft wrote them, not a summary. Under the heading Exclusions, Microsoft’s OpenAI as a subprocessor in Microsoft Online Services page lists:
- FedRAMP High: “OpenAI operated models available through Microsoft aren’t FedRAMP High authorized. If your organization requires FedRAMP High prior to use, consult with your authorization official to determine whether use of OpenAI operated models is permitted within your environment.”
- PCI DSS: “A Payment Card Industry (PCI) Data Security Standard (DSS) Attestation of Compliance (AOC) isn’t available for OpenAI operated models.”
- HITRUST CSF: “A Health Information Trust Alliance (HITRUST) Common Security Framework (CSF) Certification Letter isn’t available for OpenAI operated models.”
- SOC 1 Type 2: “A System and Organization Controls (SOC) 1 Type 2 report isn’t available for OpenAI operated models.”
Each is a separate statement about a separate authorization or report. Microsoft’s wording is specific: one named authorization is not in place, and three named documents aren’t available. Which of the four matters to a given organization depends on which of those documents it has promised to someone else.
The same page is just as specific about what does still apply. It says “The Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to use of OpenAI models through Microsoft’s enterprise Online Services, except as otherwise disclosed in the Exclusions section at the end of this article. Such use is also covered under our Enterprise Data Protection.” It says “As a subprocessor, OpenAI operates with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures.” It states that Microsoft’s Customer Copyright Commitment “applies to OpenAI models used within products covered by that commitment, including Microsoft Copilot and Copilot Studio.” And on retention it says “Microsoft incorporates OpenAI’s Responses API into certain Copilot experiences. OpenAI offers Zero Data Retention for the Responses API used by Microsoft, subject to the limitations and feature-specific data handling practices for Responses API described in OpenAI’s Data controls in the OpenAI platform documentation.”
What else does not travel: in-country processing and the EU Data Boundary
If the organization has made data-residency promises, two more sentences on Microsoft’s page belong in the review. The first: “OpenAI models delivered through OpenAI as a subprocessor in Copilot experiences are currently excluded from in-country processing commitments when applicable.” The second: “OpenAI operated models are included in the EU Data Boundary, except as otherwise noted in the EU Data Boundary documentation.”
Read together: where an in-country processing commitment applies, these models are outside it, while the EU Data Boundary does include them, subject to the exceptions Microsoft documents separately. A residency promise written into a customer contract is checked against the first sentence, not the second.
The decision: leave it on, or turn it off
When the review reaches the setting itself, the decision is a comparison of two exposures: a default that may contradict a commitment the business relies on, and a shutdown that removes Copilot capability users already have. Work through these criteria before anyone changes the setting:
- List every contract, customer commitment and internal policy that names FedRAMP High, PCI DSS, HITRUST CSF or a SOC 1 Type 2 report, and note which systems and data each one covers.
- Check the data map or records inventory for whether the data Copilot users work with falls inside any of those commitments.
- Check the contract text for any promise of in-country processing, since Microsoft says these models are currently excluded from in-country processing commitments when applicable.
- List the Copilot features and agents users depend on, because Microsoft warns: “Some features or models are only available when OpenAI operated models are enabled. If you disable OpenAI as a subprocessor, certain features or models may no longer be accessible.”
- Decide by group where the answer differs, because Microsoft’s setting accepts specific users and security groups as well as all users or no users.
- Take the contract reading to counsel and the contract owners. For FedRAMP High, Microsoft’s own instruction is to “consult with your authorization official”.
If a commitment covers data that Copilot users handle, the exclusions are a live issue for those users, and the decision belongs with whoever owns that commitment. If none does, the exclusions describe an authorization and reports nobody has asked the organization for.
How the setting works, described
Once the decision is made, the change itself is small; what matters is who can make it and at what scope. For both enabling and disabling, Microsoft’s page says “You must be a member of the AI Administrator or Global Administrator role to perform this task.” The setting sits in the Microsoft 365 admin center under Copilot settings, on the page AI providers operating as Microsoft subprocessors, where OpenAI appears as an available subprocessor and access is set to all users, to specific users and groups, or to No users.
Scoping is at the provider level. Microsoft says “You can restrict user access to AI provider subprocessors by assigning permissions to specific users or Microsoft Entra ID security groups in the Microsoft 365 admin center.” and “These assignments are applied at the provider level and enforced across Microsoft Copilot and Copilot Studio experiences.” When access is turned off, “After you disable OpenAI as a subprocessor, users won’t have the option to use OpenAI operated AI models. You can choose to enable OpenAI operated models at a later date if desired.” Microsoft’s page also notes that, once the models are enabled in the Microsoft 365 admin center, additional controls in the Power Platform admin center decide whether they can be used in Copilot Studio and Power Platform.
This setting is one input into a wider policy on which AI is approved for which work across Copilot, Copilot Studio and Azure OpenAI, covered in Enterprise AI Governance for Microsoft Environments. Record the decision there, with the commitments it was checked against, so the next questionnaire gets the same answer.
When leaving OpenAI-operated models on is a reasonable choice
If the review finds no contract, customer commitment or internal policy that requires FedRAMP High, PCI DSS, HITRUST CSF or SOC 1 Type 2 coverage for the data Copilot users handle, and no in-country processing promise, the four exclusions may change nothing material for that tenant. Turning the setting off in that case gives up the features and models Microsoft says depend on it, with no commitment protected in return. Leaving it on is then a defensible, documented choice, provided the review that reached it is written down and repeated when a new contract or questionnaire adds a requirement. This guide states no universal answer; the answer follows from the organization’s own commitments.
What to ask of whoever helps
If an outside team is brought in to make this call defensible, hold it to these criteria:
- Ask for a written mapping of which of the four exclusions, and the in-country processing note, touch a live contractual or customer commitment, before any setting is changed.
- Ask for a plain statement of what changes for users either way, using Microsoft’s own description of what is lost when the setting is off.
- Expect Microsoft’s documentation to be quoted and dated, not paraphrased, and expect Azure OpenAI and OpenAI-operated models to be kept apart in every sentence.
- Expect no AI vendor or tool recommendation as part of the answer.
- Expect the contract reading to go to your counsel, not to be decided by the team doing the mapping.
- Expect senior people, based in the US, doing the work.
- Expect a plain statement that the team does not take over the tenant’s AI-provider decisions as an ongoing managed service after the engagement.
How i3solutions answers
When a regulated organization needs this decision made and defended, it needs a project with an end date: a Copilot AI-provider assessment that maps the organization’s own attestation and residency commitments against Microsoft’s stated exclusions, sets the admin center scope by user group where the answer differs, and writes the decision down for the next audit, with embedded specialists where the internal team needs more hands for a period. i3solutions has been a Microsoft Partner with 30 years of enterprise technology delivery experience and has delivered 1,500+ Microsoft engagements across aerospace and defense, financial services, and health sciences. The people who do the work are senior and based in the US. An i3solutions engagement does not produce managed-service ownership, a replacement for the internal team, open-ended scope expansion, or vendor lock-in. This work sits within i3solutions’ Custom AI Consulting Services for Governed Microsoft Enterprise AI.
Key Takeaways
- Microsoft added OpenAI to its subprocessor list on June 23, 2026, made the option available on July 9, 2026, and enabled OpenAI-operated models by default for eligible commercial customers on July 24, 2026.
- Microsoft’s Exclusions section names four gaps: no FedRAMP High authorization, and no PCI DSS Attestation of Compliance, HITRUST CSF Certification Letter or SOC 1 Type 2 report available.
- OpenAI-operated models are not Azure OpenAI; Microsoft’s page says its information “doesn’t apply to OpenAI models operated by Microsoft (Azure OpenAI).”
- GCC, GCC High, DoD and sovereign-cloud tenants cannot currently use OpenAI-operated models, so the decision belongs to commercial tenants.
- An AI Administrator or Global Administrator can scope the setting to all users, specific users and groups, or no users, and can reverse it later.
Frequently Asked Questions
Is OpenAI-operated Copilot on by default?
Yes, for eligible commercial customers. According to Microsoft, “As of July 24, 2026, OpenAI operated models are enabled for all users for eligible commercial customers, unless you specifically disable the use of OpenAI operated models by selecting No users for the setting in the Microsoft 365 admin center.”
Is OpenAI-operated Copilot FedRAMP High authorized?
No. Microsoft’s Exclusions section states “OpenAI operated models available through Microsoft aren’t FedRAMP High authorized.” and tells organizations that require FedRAMP High to consult their authorization official. The Exclusions section describes OpenAI-operated models only; Microsoft says the page’s information doesn’t apply to Azure OpenAI.
Does OpenAI-operated Copilot have a PCI DSS attestation?
No. Microsoft states “A Payment Card Industry (PCI) Data Security Standard (DSS) Attestation of Compliance (AOC) isn’t available for OpenAI operated models.” The same section says a HITRUST CSF Certification Letter and a SOC 1 Type 2 report aren’t available either.
Can GCC High tenants use OpenAI-operated models?
No. Microsoft states “Access to OpenAI operated models isn’t currently available for use in government clouds (GCC, GCC High, DoD) or sovereign clouds.” The default and the exclusions apply to commercial tenants.
How do I turn off OpenAI-operated models in Copilot?
An AI Administrator or Global Administrator sets access for OpenAI to No users on the AI providers operating as Microsoft subprocessors page under Copilot settings in the Microsoft 365 admin center, or limits it to specific users or security groups. Microsoft says “You can choose to enable OpenAI operated models at a later date if desired.”
Is OpenAI-operated Copilot the same as Azure OpenAI?
No. Microsoft’s page states “The information doesn’t apply to OpenAI models operated by Microsoft (Azure OpenAI).” Azure OpenAI is operated by Microsoft; OpenAI-operated models are provided by OpenAI as a Microsoft subprocessor, and each has its own compliance status.
Planning the Decision
If your organization needs its attestation and residency commitments mapped against Microsoft’s exclusions, and the OpenAI subprocessor setting scoped and documented before the next questionnaire or audit, talk it through with a senior architect.
