OneDrive

Microsoft says organization data in OneDrive is not used to train AI models.

Microsoft also says organization data is not transferred to train large language models.

Tenant permissions and Microsoft 365 controls limit who can reach OneDrive content before AI features are allowed to use it.

OneDrive business data stays inside Microsoft 365 compliance boundaries rather than being treated as open consumer prompt data.

Consumer OneDrive and broader Microsoft account data still follow Microsoft's wider privacy and product policies.

Sharing links and external collaborators can still expose content beyond the intended audience.

Graph access and tenant integrations can widen disclosure when organizations connect more services.

OneDrive data stays inside the organization's Microsoft 365 tenant by default.

Role-based access and Microsoft 365 sharing controls help organizations limit who can reach files.

Compliance controls can narrow how content moves across collaboration and governance workflows.

Tenant-level settings let organizations decide how broadly external sharing is allowed.

Microsoft still collects usage, device, diagnostic, and account data under broader service policies.

Broader Microsoft account and service data can still be tied to how OneDrive is accessed and used.

Microsoft 365 security and compliance controls apply to OneDrive rather than leaving it as a pure consumer ad surface.

Role-based and tenant-based policy controls let organizations reduce some unnecessary data exposure.

OneDrive business file content should be considered separately from Microsoft's broader consumer personalization surfaces.

Actual retention still depends on tenant configuration and recycle-bin behavior.

Legal holds and compliance policies can preserve content after a user expects deletion.

OneDrive supports Microsoft 365 retention, eDiscovery, and compliance tooling.

Data residency and compliance features give organizations more predictable control over stored content.

Tenant admins can manage recovery and lifecycle settings instead of depending only on user deletion.

Retention labels and compliance policy give organizations more than one way to govern stored data.

Admins can manage sharing and access settings for the tenant.

Compliance and retention settings let organizations actively govern storage behavior.

Recovery and lifecycle tooling give organizations a structured way to manage stored content.

Role-based administration limits who inside the organization can manage sensitive settings.

End users often depend on organization administrators for the strongest privacy controls.

Many important privacy outcomes are driven by tenant setup rather than individual user preference.