Did you know Microsoft Copilot can remember how users prefer to communicate, retain context of work they regularly perform, their goals, custom instructions, and more? By absorbing these details, the tool makes future responses more relevant and more tailored.
That perspective can be tremendously valuable to your employees. By allowing Copilot to produce more customized responses, employees will spend less time rebuilding context and everyday interactions become faster and more consistent.
Copilot personalization combines three related but distinct elements:
Copilot uses these signals to make future conversations more relevant to your employees’ work, communication preferences, goals, and recurring tasks. Each element behaves differently when personalization is disabled or information is deleted.
For example, Copilot memories preserve an employee’s preference for concise executive summaries, or when Excel reports better support a particular business function, or recommendations should always be presented as prioritized action items. Instead of restating those preferences in every conversation, the user can allow Copilot to apply them from memory as ongoing context for future prompts.
When Copilot Memory is enabled, users can explicitly tell Copilot what to remember in Copilot Chat. For example: “Remember that I prefer executive summaries with key risks, decisions, and next steps.” Users can then review, manage, or delete saved memories in Copilot’s personalization settings.
Copilot Memory may be useful for:
Microsoft currently categorizes Copilot personalization and memory as a public preview capability but enabled by default. Memories include saved memories, details inferred from chat history, and custom instructions. Microsoft stores this information in a hidden folder in the user’s Exchange mailbox, where it follows mailbox security and compliance protections such as Customer Lockbox and encryption at rest.
The critical distinction: Copilot Memory is not the same as Copilot conversation history.
Microsoft Purview retention policies can govern supported Copilot prompts and responses. However, those policies do not currently apply to Copilot Memory, and administrators cannot enforce memory-specific retention periods. Saved memories ordinarily remain until the user deletes them, and deleting the original conversation does not delete a saved memory created from it.
Administrators are not completely without options. Microsoft Purview eDiscovery or Content Search can discover the saved and inferred memories and deleted by using Microsoft Graph with Purview. These are administrator-led discovery and deletion processes rather than an automated memory-retention policy. Custom instructions are not currently discoverable through those solutions.
Enhanced personalization, which allows end users to use Copilot Memory, is turned on by default.
However, administrators can turn it off for end users or the tenant. Microsoft does not currently provide a control that restricts specific categories of information from being added to memory.
Microsoft also states that memory and personalization actions do not currently generate Purview audit-log entries. This is an additional consideration for organizations that require evidentiary records of user activity or configuration changes.
The issue is not that Copilot Memory is inherently unsafe. The issue is that many organizations have not yet decided what Copilot should remember, how that information should be governed, or whether Microsoft’s current combination of user-managed controls and administrator-led discovery and deletion processes satisfies their legal, privacy, and compliance requirements.
This is especially important for organizations that handle:
Turning off enhanced personalization stops Copilot from applying saved memories, custom instructions, and chat history personalization. It does not automatically remove saved memories or custom instructions. Microsoft states that inferred chat-history details are deleted after 30 days when enhanced personalization or chat-history personalization is turned off.
1. Check your current setting
Determine whether enhanced personalization is available and enabled. Do not assume existing Copilot or Purview policies have already addressed memory.
2. Make an explicit governance decision
Bring together IT, security, legal, privacy, compliance, records management, and business leadership to decide whether Copilot Memory is appropriate for the organization and its different user populations.
3. Separate memory from interaction retention
Document how the organization will govern prompts and responses, conversation history, saved memories, custom instructions, inferences from prior conversations, and temporary chats. Purview supports retention for Copilot interactions, but not memory-specific retention enforcement. It’s also important to define how administrators will use eDiscovery and Microsoft Graph when memory data must be found or deleted.
4. Start with a controlled rollout
If requirements are unresolved, limit the Copilot enhanced personalization while evaluating the capability. Use a defined pilot to validate business value, user behavior, privacy concerns, and policy requirements before broader enablement.
5. Teach employees what Copilot should remember
Provide practical guidance and training. Preferences such as writing style, reporting format, or general responsibilities are certainly be useful. Passwords, confidential employee matters, privileged legal information, and unnecessary regulated data should not be intentionally stored as memories. Users must be informed that deleting a chat does not delete saved memories.
Copilot Memory should not be evaluated as an isolated setting. It belongs within a broader governance model covering data access, AI interactions, retention, privacy, security, and employee enablement.
Note: Microsoft Purview provides extensive governance capabilities for Copilot interactions, including auditing, DLP, eDiscovery, Communication Compliance, Insider Risk Management, and Data Lifecycle Management. The key is understanding which controls apply to each information type and where gaps remain.
Copilot Memory can make AI more useful, relevant, and personal. However, a default-enabled feature should not automatically become an approved enterprise policy without review.
If your organization cannot clearly answer what Copilot may remember, who can use it, how saved memories are managed, and where existing retention policies do not apply, it is time to review your Copilot governance posture.
As a Microsoft Managed Partner, ivision can help you evaluate the settings, close the governance gaps, and enable personalized AI with the controls your organization requires. Connect with our team to discuss your Microsoft needs, guidance on AI and data security, and more.