Copilot Studio Data Residency: Regions, EU Boundary, and Connectors

Copilot Studio stores core customer data according to the Power Platform environment's Azure geography, but “stored in a region” does not mean every related service or data flow stays there. Replication, support operations, global Microsoft services, connectors, channels, generative AI features, and external systems can create documented exceptions.

How the storage location is chosen

The location of the Power Platform environment determines the primary geography for Copilot Studio data. Organizations should select an approved region when provisioning environments and keep development, test, and production placement consistent with their residency requirements.

Microsoft can replicate customer data between regions in the same geography for durability. If a tenant location is not listed in Microsoft's data-location table, the service documentation states that data is stored in the United States. Users may also access the data from other locations; residency does not impose a network-access boundary.

Important residency exceptions

Review the current service terms and data-location documentation for the exact workload. Microsoft identifies exceptions that can include:

• Disaster recovery: data in Brazil South may be replicated to South Central US because Brazil has a single region.
• Support, troubleshooting, or legal requirements: limited transfers may occur when necessary for these purposes.
• Global services: Microsoft Entra ID, the Microsoft 365 admin center, and other globally operated services can store or process some data outside the primary geography.
• Agent metadata: an application's name, description, and logo may be stored globally.
• External services and channels: handoff providers, social channels, connectors, and third-party APIs can transfer data to their own locations.
• Microsoft 365-powered features: some data is stored under Microsoft 365 residency commitments rather than the Azure boundary. Historical agent activity can follow the end user's Exchange mailbox geography.

EU Data Boundary conditions

Copilot Studio is included in Microsoft's EU Data Boundary commitments under documented conditions. Microsoft states that a customer tenant with an EU or EFTA billing address is in scope when all of its environments are also created in a geography inside the EU Data Boundary.

This does not eliminate every permitted transfer or global-service exception. Confirm tenant billing location, every environment's region, enabled features, support provisions, and connector destinations against the current Microsoft Privacy and Security Terms.

Generative AI can involve cross-region processing

Some generative AI capabilities can be configured to move data outside the environment's geography, including when local capacity is constrained. Administrators should check the Power Platform setting that governs cross-geography data movement and decide whether the feature is compatible with organizational requirements.

Do not assume that the location of Dataverse alone determines where prompts, retrieved content, responses, moderation data, or telemetry are processed. Map each enabled Copilot Studio feature and verify its documented boundary.

How connector data flows

1. A user action, agent turn, or automated trigger starts the operation.
2. Copilot Studio or a Power Automate flow invokes the configured connector.
3. The connector transfers the requested data between the source and destination.
4. The destination processes and stores the data under its own configuration and terms.
5. Administrators monitor the flow through supported audit and governance tools.

For a Microsoft cloud service such as SharePoint, Dataverse, or Microsoft Graph, Microsoft documents the relevant service responsibilities. When a connector sends data to a non-Microsoft system, the agent maker and organization must assess that provider's location, security, retention, sub-processors, and deletion behavior.

Residency review checklist

• Record the tenant and environment geographies.
• List every knowledge source, connector, tool, channel, handoff, and telemetry destination.
• Check disaster-recovery, support, and global-service exceptions.
• Review whether generative AI cross-geography processing is enabled.
• Verify EU Data Boundary eligibility rather than inferring it from a company address.
• Test data policies and restrict destinations the agent does not need.
• Recheck documentation after adding a feature or changing an environment.

Residency is only one part of governance. Pair this review with Copilot Studio compliance checks and the broader Copilot Studio security controls. Microsoft's current data-location page lists supported geographies and exceptions, while its geographic data-residency guide explains the EU Data Boundary and connector responsibilities.