Is M365 Copilot sending some prompts to Anthropic?

I'll pull the source article so the paragraphs stick to real details from that URL and the HN item, not invented numbers or claims.Microsoft 365 Copilot can route some tasks to Anthropic Claude while the tenant UI stays the same. Microsoft’s Foundry documentation states that Anthropic, not Microsoft, is the processor of that data, and that prompts and outputs may be processed outside the customer’s region. Claude inside M365 Copilot is explicitly out of scope for the EU Data Boundary, and Microsoft’s Australian in-country Copilot processing commitment, available since late 2025, does not automatically cover the Anthropic path. Anthropic became a Microsoft sub-processor in January 2026, and Claude Opus 4.6 sits in the Foundry catalogue next to Microsoft first-party models.

On the standard Microsoft-managed Copilot path, the processor of record is Microsoft, Australian in-country processing is available, the EU Data Boundary applies, region selection is meaningful for in-scope interactions, and Australian data centres can hold default storage for that path. On the Anthropic-routed path, Anthropic is processor under Microsoft sub-processor terms, Australian in-country processing is not currently committed, EU Data Boundary coverage is out of scope, inference may run in the US, Europe, Asia, or Australia, and default storage is described as the United States. Anthropic’s regional compliance materials list Microsoft Foundry in Europe as coming in 2026 and do not yet list Australia. A Microsoft Foundry Q&A from April 2026 states that even when a customer picks an EU region, inference does not fully execute inside Azure-operated data centres.

For engineers and builders, the practical issue is a silent change of data plane under a familiar brand surface. Feature flags and policies that send work to Claude change processor, residency, and storage assumptions without a clear tenant-admin map of which requests leave the Microsoft-managed path or what share of traffic that is. Teams that designed tenancy, logging, DLP, and client contracts around Microsoft-only residency need separate controls for the Anthropic route, including disable, default-deny, or classification-based routing where Foundry and Copilot configuration allows it. That configuration exists; it is not the default story most deployments ship with.

The gap sits in a multi-model market where Microsoft sells one Copilot surface and several model backends. Microsoft’s sovereignty and EU Data Boundary messaging is real for its managed path; Anthropic’s Sydney office opened on 10 March 2026 and residency is a common enterprise ask, but product residency for Claude under Foundry and Copilot has not closed to match that office story. Australian regulated buyers face pressure from APRA’s 30 April 2026 industry letter on AI supplier and fourth-party mapping, and from Department of Industry, Science and Resources expectations published 23 March 2026 on sovereign hosting and IRAP-aligned procurement. Professional services firms that named Copilot in engagement letters under an Australia-stays assumption face a contractual exposure when Claude is enabled under the same M365 banner.

Audit which Copilot features and policies route to Anthropic and measure that traffic before treating the tenant as single-processor. Treat residency questions for the Anthropic path as distinct from the Microsoft-managed path, and write them into vendor and board materials. Restrict Anthropic routing for sensitive classifications by configuration, not slideware policy, and log the answers on disable options, storage regions, and any contractual commitment for Australian-region processing. Watch Anthropic’s regional compliance page and Foundry timelines for Europe and Australia, and treat “coming 2026” as product marketing until it appears as a written, auditable commitment for your workloads.