Copilot Compliance Nightmare? Microsoft Suddenly Rolls Out Flex Routing

Flex Routing Handles Situations When Excessive Demands for Copilot Processing Exists

If you manage a Microsoft 365 tenant in the European Union or European Free Trade Association (EU/EFTA), you need to pay attention to message center post MC1269223. On April 17, 2026, Microsoft is enabling a new feature called “flex routing” for Microsoft 365 Copilot. Depending on your organization’s data residency requirements, you may need to take action quickly.

European Data Privacy Is Different

In general, European law (including sector-specific regulations like NIS2 and DORA, not to mention GDPR) restricts how data belonging to European organizations may move or be processed outside of the EU. To comply with these laws, Microsoft provides what they call the EU Data Boundary, which guarantees organizations that their data will stay within the EU.

Compliance with these laws and rules isn’t optional, so customers, quite rightly, demand it from their cloud providers. Microsoft has a generally good track record in this regard, with clear statements of where they process data versus where they store it at rest like this page.

What Is Flex Routing?

Flex routing is a new capability that allows Microsoft to process Copilot LLM inferencing workloads outside the EU Data Boundary during periods of peak demand. The idea is straightforward: when too many people are hammering Copilot at once and EU-based GPU capacity runs short, Microsoft can route requests from EU-based tenants to data centers in the United States, Canada, or Australia to maintain a consistent user experience.

“Inferencing” here means the step where the large language model actually processes your prompt and generates a response. By the time inferencing happens, the prompt has already been through preprocessing, safety checks, and retrieval-augmented generation (RAG). That means your organizational data — emails, files, metadata, and system prompts — is bundled together and sent to the model. When flex routing kicks in, that entire package can be processed outside the EU.

Microsoft emphasizes that data remains encrypted in transit and at rest, and that data at rest continues to be stored inside the EU Data Boundary. However, “limited pseudonymized data” may be stored outside the boundary for security and operational purposes.

Flex Routing Is a Potential Problem

For organizations subject to GDPR, sector-specific regulations, or internal data governance policies that require EU-only processing, flex routing represents a meaningful change. Microsoft is being transparent about it — but “transparent” and “compliant with your organization’s policies” are two different things.

The real issue for many administrators is the default state. Flex routing is enabled by default for new tenants created after 25 March 2026, and for everyone else, it will default to “on” starting on 17 April 2026. Microsoft expects administrators to check the setting and decide whether it’s appropriate for their organization.

Then Again, Maybe Not?

The first question, of course, is whether or not flex routing is even necessary given the extremely low adoption of Microsoft 365 Copilot. Are Copilot loads routinely exceeding capacity? Let’s not get into that question just now.

Instead, keep in mind that flex routing only applies to tenants with a sign-up location in the EU or EFTA. If you’re outside those regions, you won’t see the setting. If you’ve purchased Multi-Geo capabilities, the flex routing setting won’t appear even if your tenant is in the EU or EFTA.

What Should Administrators Do?

First, check your current flex routing setting. Here’s how:

1. Sign in to the Microsoft 365 admin center with an account that has the AI Administrator role.
2. Navigate to Copilot > Settings > Flexible inferencing during peak load periods. (Figure 2)
3. You’ll see two options: Allow flex routing during periods of peak load or Do not allow flex routing.

If you select “Do not allow flex routing,” all LLM inferencing will stay inside the EU Data Boundary even during peak demand periods. Microsoft’s standard data processing and data residency commitments continue to apply regardless of which option you choose — the difference is where the GPU crunching happens during busy periods.

Note that Microsoft 365 admin center setting covers Microsoft 365 Copilot and Copilot Chat. There’s a separate setting in the Power Platform admin center for Copilot experiences in Dynamics 365, Power Platform, and Copilot Studio, but it honors the M365 admin center setting unless the Power Platform setting is more restrictive.

The Bigger Picture

This isn’t the only recent change that EU administrators should be watching. Microsoft also enabled Anthropic models by default for most commercial tenants starting in January 2026 — though EU, EFTA, and UK tenants have Anthropic disabled by default because Anthropic-processed data falls outside Microsoft’s EU Data Boundary commitments.

Taken together, these changes represent something more than a pair of new toggles in the admin center. They represent further evidence that Microsoft is continuing its trajectory of pushing updates that have a significant compliance or privacy impact without consulting its enterprise customers. In this case, those customers didn’t even get much notice. For years, EU organizations could reasonably assume that Microsoft’s defaults were conservative — that if a feature had data residency implications, it would ship as opt-in, not opt-out. That assumption no longer holds.

When your cloud provider starts enabling features by default that move data outside regulatory boundaries, the compliance burden shifts from “trust your vendor’s defaults” to “audit every change your vendor makes.” In practice, that means every Message Center post represents a potential compliance problem. Organizations that treat the Message Center as an IT operations feed need to start treating it as a compliance feed, too — and that’s a big change in how much work it takes to stay on the right side of the regulations.

Log into the admin center, check your flex routing and Anthropic model settings, and make a deliberate decision about each one. If your organization has a data protection officer or legal team that cares about data residency, loop them in. The settings are easy to change — but only if you know they exist. The bigger challenge is building a process that catches the next one before it’s too late.

---

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Only humans contribute to our work!