Microsoft agreement stack

Latest changes

Last check 2026-10-11 — 15 instruments verified live across both stacks, 3 changed. Each change below carries an impact score; the schema is at the foot of this section.

• 2026-10-11
  Product Terms — Summary of Changes — The Product Terms change log’s AI/privacy-relevant entries include a Web IQ DPA exception, a Copilot residency cross-reference, and new/updated Microsoft AI Customer Solution terms. The dated explanations below distinguish operative changes from a link and limit each conclusion to the affected service; none is a blanket change to all Microsoft AI processing. Primary source

  • 1 Oct 2026 — Microsoft IQ patent clauseMicrosoft updated the Microsoft AI Customer Solution patent clause. The 15 September wording said Microsoft was not liable for patent claims arising from the solution; the 1 October wording expressly disclaims both defense obligations and liability for patent-infringement claims alleging that Standards implementation in a Customer Solution infringes. This is a licensing/IP-risk allocation change, not a data-processing change; the summary alone does not establish whether overall exposure broadened or narrowed.Official change entry15 Sep Microsoft IQ terms1 Oct Microsoft IQ terms
  • 15 Sep 2026 — Microsoft AI Customer Solution definitionMicrosoft added a Microsoft IQ section and glossary definition. The definition requires the customer app to add primary and significant functionality; prompt-interface or infrastructure-only apps do not qualify on their own. The Microsoft IQ terms put licensing/compliance responsibility for the resulting solution on the customer. This changes licensing scope, not data use.Official change entryMicrosoft IQ termsProduct Terms Glossary
  • 1 Aug 2026 — Web IQ DPA exceptionWeb IQ was added to the DPA-exceptions table and designated a Limited Access Service. The current terms say the DPA does not apply to Web IQ; the Microsoft Privacy Statement applies, and Customer Data used with Web IQ flows outside the customer’s compliance and geographic boundary. This is specific to Web IQ use, not all Microsoft AI or Copilot.Official change entryPrivacy & Security TermsWeb IQ Terms
  • 15 Jun 2026 — Copilot residency cross-referenceThe change was adding a link to Copilot/Copilot Chat residency material, not by itself a new residency commitment. The linked page says “no modifications” for Microsoft 365 Copilot and Copilot Chat, and separately describes a geography-limited at-rest commitment for Copilot Cowork. It does not establish that all Copilot data or processing stays in-region.Official change entryResidency details

  Major · 13/15privacy 3 · user-adjacent data 3 · stack 3 · reach 2 · notice 2

  Privacy / user data: Web IQ moves into the DPA-exceptions table, so a live AI/browsing service sits outside the DPA baseline; the same window adds a Copilot data-residency commitment (a protection, not a risk) and a new shared definition.

  Effect on the stack: Changes both precedence (a named service leaves the DPA baseline) and meaning (a new Glossary definition is read across the whole stack).

• 2026-10-11
  Products & Services Data Protection Addendum (DPA) — The DPA advanced from the 1 September 2025 edition to 22 May 2026. Microsoft’s change note identifies a specific new AI-subprocessor notice track: 30 days before Customer Data access, with a disable-use right for at least six months after notice. The current clause was checked; the prior edition was not independently line-diffed, so this is the vendor-described delta rather than a complete redline. Primary source

  • 22 May 2026 DPA changeMicrosoft’s change note says it added a clarification for subprocessors supporting AI functionality. The current clause gives those subprocessors at least 30 days’ notice before access to Customer Data, instead of the general six-month advance-notice track, while allowing the customer to disable use of that subprocessor until at least six months after notice. This changes notice and customer response time; it does not make the entire DPA inapplicable to AI services. The prior full DPA text was not independently line-diffed, so this is the vendor-described change, verified against the current clause—not a complete redline.DPA editions and archiveMay 2026 DPA and change notePrior-edition archiveMicrosoft supplier guidance

  Major · 10/15privacy 2 · user-adjacent data 1 · stack 2 · reach 3 · notice 2

  Privacy / user data: The identified DPA update shortens advance notice for AI-functionality subprocessors that access Customer Data to 30 days, while preserving a customer disable-use period of at least six months. This affects notice and response time; it does not remove the DPA baseline for AI processing.

  Effect on the stack: The DPA is incorporated into the enterprise agreement stack; the identified change creates a special notice/control rule for AI-functionality subprocessors within that baseline.

Coverage: 22 of 23 instruments have a monitored public source.

At a glance

Vendor

Microsoft

Layer model

Master → Product Terms (+ change log) → Addenda (DPA, Privacy & Security Terms) → Service-specific (SLA, AI Code of Conduct, embedded AUP) → Incorporated-by-reference (Glossary, Privacy Statement, Universal License Terms, data-residency, subprocessors)

Instruments tracked

23 registry rows (MS-01–MS-22 plus MS-BING)

Primary change signal

Product Terms — Summary of Changes

Status

In-force (form); underlying documents not opened here

How the stack is built

Each layer is incorporated by reference into the one above it; service-specific and data-protection terms take precedence for their own subject matter.

Instruments

Each instrument links to its live document where one exists.

Incorporation and precedence

• The MCA "Modifications" clause allows change by notice.
• The Product Terms material-adverse-change protection does not extend to "New Features, Supplements, or Related Software" — a principal drift mechanism.
• The Glossary is a lever that can change meaning across the stack without amending the master agreement.
• Subprocessor additions change processing locations.
• Change can enter through any layer, on its own schedule, often by online update plus continued use, without renegotiation.

What the monthly check diffs

• Version / effective date (DPA versions; master-agreement dates; Product Terms update dates).
• Content hash / change-log entry (Microsoft "Summary of Changes").
• New-feature carve-out text — does newly released AI functionality sit inside or outside protections?
• Data-use / retention statements.
• Subprocessor lists (additions and removals; processing locations).
• Glossary / definitions — meaning-level change across the stack.
• Precedence / order-of-precedence clauses — any reordering changes how documents are read.
• New instruments appearing in the stack, or instruments renamed or withdrawn.
• Data-residency commitments (for example, Copilot).

Watch list: Microsoft Product Terms Summary of Changes (/licensing/terms/product/changes/all) — monthly or more often. Microsoft DPA version and "New Features" clause; subprocessor lists (Service Trust Portal). Microsoft data-residency line for Copilot; Glossary revisions.

Changelog

The full running log for this stack, newest first.

• 2026-10-11
  Products & Services Data Protection Addendum (DPA) — The DPA advanced from the 1 September 2025 edition to 22 May 2026. Microsoft’s change note identifies a specific new AI-subprocessor notice track: 30 days before Customer Data access, with a disable-use right for at least six months after notice. The current clause was checked; the prior edition was not independently line-diffed, so this is the vendor-described delta rather than a complete redline. Primary source

  • 22 May 2026 DPA changeMicrosoft’s change note says it added a clarification for subprocessors supporting AI functionality. The current clause gives those subprocessors at least 30 days’ notice before access to Customer Data, instead of the general six-month advance-notice track, while allowing the customer to disable use of that subprocessor until at least six months after notice. This changes notice and customer response time; it does not make the entire DPA inapplicable to AI services. The prior full DPA text was not independently line-diffed, so this is the vendor-described change, verified against the current clause—not a complete redline.DPA editions and archiveMay 2026 DPA and change notePrior-edition archiveMicrosoft supplier guidance

  Major · 10/15
• 2026-10-11
  Product Terms — Summary of Changes — The Product Terms change log’s AI/privacy-relevant entries include a Web IQ DPA exception, a Copilot residency cross-reference, and new/updated Microsoft AI Customer Solution terms. The dated explanations below distinguish operative changes from a link and limit each conclusion to the affected service; none is a blanket change to all Microsoft AI processing. Primary source

  • 1 Oct 2026 — Microsoft IQ patent clauseMicrosoft updated the Microsoft AI Customer Solution patent clause. The 15 September wording said Microsoft was not liable for patent claims arising from the solution; the 1 October wording expressly disclaims both defense obligations and liability for patent-infringement claims alleging that Standards implementation in a Customer Solution infringes. This is a licensing/IP-risk allocation change, not a data-processing change; the summary alone does not establish whether overall exposure broadened or narrowed.Official change entry15 Sep Microsoft IQ terms1 Oct Microsoft IQ terms
  • 15 Sep 2026 — Microsoft AI Customer Solution definitionMicrosoft added a Microsoft IQ section and glossary definition. The definition requires the customer app to add primary and significant functionality; prompt-interface or infrastructure-only apps do not qualify on their own. The Microsoft IQ terms put licensing/compliance responsibility for the resulting solution on the customer. This changes licensing scope, not data use.Official change entryMicrosoft IQ termsProduct Terms Glossary
  • 1 Aug 2026 — Web IQ DPA exceptionWeb IQ was added to the DPA-exceptions table and designated a Limited Access Service. The current terms say the DPA does not apply to Web IQ; the Microsoft Privacy Statement applies, and Customer Data used with Web IQ flows outside the customer’s compliance and geographic boundary. This is specific to Web IQ use, not all Microsoft AI or Copilot.Official change entryPrivacy & Security TermsWeb IQ Terms
  • 15 Jun 2026 — Copilot residency cross-referenceThe change was adding a link to Copilot/Copilot Chat residency material, not by itself a new residency commitment. The linked page says “no modifications” for Microsoft 365 Copilot and Copilot Chat, and separately describes a geography-limited at-rest commitment for Copilot Cowork. It does not establish that all Copilot data or processing stays in-region.Official change entryResidency details

  Major · 13/15

Sources and further reading

Change-impact schema

Every change found by the check is scored on five dimensions (0-3 each, total 0-15) and placed in one of three bands. The point is to separate housekeeping from changes that belong in a review.

1. Privacy / data-protection effect — Does it change what personal data is processed, why, where, or for how long?
2. User-adjacent data — Does it touch data generated by or about end users — prompts, content, telemetry, feedback, identifiers?
3. Stack effect — Does it change how the stack is read — incorporation, precedence, scope, or a shared definition?
4. Reach — How many services, surfaces or customers are affected?
5. Notice and reversibility — Was there notice? Can a customer object, exit, or negotiate — or is it unilateral?

• 0-3Incidental — Housekeeping. Nothing substantive changes; safe to skip in a review.
• 4-8Minor — Real but bounded. A defined subset, a clarification, or a date/label change without a change to the underlying obligation.
• 9-15Major — Substantive. Changes obligations, data flows, or how the stack reads — belongs in a review or a client briefing.