Data Report Card · Microsoft
Microsoft Data Report Card
Microsoft account · Outlook.com
Data
Practices
Practices
2Access1Portability1Friction2Deletion1Sells1Trains AI
=
C
8/12
Agent
Readiness
Readiness
2Access
1Portability
2API access
=
B
5/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
Reviewed Jun 2026 · policies are checked weekly for changes · stated — every cell is read from Microsoft's published policy; none has been tested (run by us) yet.
2Accessstated
Privacy dashboard gives a comprehensive self-serve view; "Download your data" archive is available within 30 days, no fee.
Microsoft account — privacy dashboard · accessed Jun 2026 ↗1Portabilitystated
The dashboard export excludes email content — "emails, contacts, and chats are accessible through in-product experiences"; mail must be exported separately via Outlook.com settings.
Microsoft — download your data · accessed Jun 2026 ↗1Frictionstated
Self-serve, but the dashboard archive is delivered "within 30 days" and the mail export is a separate flow — within the statutory window but slow and split across surfaces.
Microsoft — download your data · accessed Jun 2026 ↗2Deletionstated
Self-serve account closure with a user-selectable 30- or 60-day grace period, then permanent deletion.
Microsoft — close your account · accessed Jun 2026 ↗1Sells / sharesstated
Runs interest-based advertising including Xandr; opt-out via Microsoft's ad opt-out page, stored in a cookie with a 5-year expiry.
Microsoft Privacy Statement · accessed Jun 2026 ↗1Trains AIstated
Copilot trains on consumer (signed-in Microsoft account) conversations by default; opt-out via Account > Privacy > "Training on conversation activity," though that does not stop use for advertising, safety or compliance. Org Entra ID and M365 Personal/Family are excluded, and training is off by default in the EEA, UK and Switzerland.
Microsoft — Copilot Privacy FAQ · accessed Jun 2026 ↗2API access — feeds Agent Readiness, not the /12stated
Microsoft Graph lets you authorize an app via consumer OAuth (e.g.
Microsoft Graph — auth & permissions · accessed Jun 2026 ↗Mail.Read + offline_access for refresh tokens), with delta queries and change webhooks for scheduled, incremental access — a genuine grant / revoke API, with no CASA-equivalent gate.Source-verified Jun 2026 from Microsoft's own pages. All cells are "stated" (read from published policy and support docs); we have not yet run a live export or account closure to mark any cell "tested."
How to request your data from Microsoft
- Go to https://account.microsoft.com/privacy/download-data — Microsoft's data-request entry point.
- account.microsoft.com → Download your data.
- Expected wait: within 30 days — Microsoft's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Microsoft — Privacy Response: https://microsoft.com/en-us/privacy/privacy-support-requests.
These steps reflect Microsoft's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.