M365 E5 Copilot Architecture & Regulatory Obligations
A reference architecture and regulatory-obligations map for Microsoft 365 E5 with the Copilot (Anthropic) overlay, written for a Global Systemically Important Financial Institution audience. The Word document below is the canonical source — version 2.2, baselined 2026-05-05.
Summary
This is a regulatory-obligations reference for a Global Systemically Important Financial Institution rolling out Microsoft 365 Copilot. The Word document above is the canonical source. The summary that follows is for skim readers; the executive summary in the dropdown below is the document's own opening; the full content lives in the doc.
The central claim is straightforward. Microsoft's Data Protection Addendum and Online Services Terms shift legal liability for many privacy and security obligations to Microsoft. They do not, on their own, satisfy regulators. A G-SIFI must demonstrate active operational control: model risk governance, third-party risk monitoring, technical enforcement of data residency, immutable retention pipelines for prompt-and-response transcripts, access governance, and an independent audit trail.
The piece organizes those obligations across the M365 E5 base, the Copilot overlay (with Anthropic as the model provider), and the Copilot CoWork firm-extension layer. The companion architecture tool renders the same model as an animated walkthrough — eleven prompt-lifecycle steps, six trust boundaries, the auth-token chain, and the Purview/regulatory mapping. Open the tool to explore the topology; read the document for the obligations that attach to it.
Show executive summary from the document
This reference document explains, in two parts, the regulatory obligations carried by Microsoft 365 Enterprise E5 as deployed at the firm, and the incremental obligations introduced when Microsoft 365 Copilot (including the Anthropic model integration) and the firm's internal Copilot CoWork extension are layered on top. It is written for a Global Systemically Important Financial Institution (G-SIFI) audience and is intended to brief enterprise architects, identity leads, and compliance and risk officers on the controls already in place, the contractual protections provided by Microsoft, and the residual obligations that the firm itself must operate, evidence, and audit.
Part 1 establishes the base M365 E5 service architecture inside the Microsoft 365 service trust boundary, the identity, data, compliance, and telemetry planes, the data-residency posture, and the regulations that already attach to that base footprint. Part 2 overlays the Copilot architecture, identifies precisely where the Copilot data flow differs from native M365 data flow, describes the role of Anthropic as a Microsoft sub-processor, and explains where the Copilot CoWork orchestration layer participates. Each part concludes with a regulatory mapping table that ties services to specific obligations.
The central message of this document is straightforward. The Microsoft Products and Services Data Protection Addendum and the Microsoft Online Services Terms shift legal liability for many privacy and security obligations to Microsoft, but they do not, on their own, satisfy regulators. A G-SIFI must demonstrate active operational control: model risk governance, third-party risk monitoring, technical enforcement of data residency, immutable retention pipelines for prompt-and-response transcripts, access governance, and an independent audit trail. The compliance gap analysis in Part 3 sets out, in concrete terms, what the firm must continue to do regardless of contract.
Reading guidance
- Part 1 is the platform reference; read it first if you have not deployed M365 E5.
- Part 2 is the Copilot delta; read it first if you understand E5 and need only the incremental change.
- Part 3 is the compliance gap analysis; read it before approving rollout.
- Part 4 is a controls catalog mapped to regulations; use it for audit evidence and runbook construction.
Request the document by email
Want a Word copy of the v2.2 reference? Send a request and we'll reply with the document attached. Until the Lab's submission backend lands, this is a manual handoff with Amit — turnaround is a few business days.
Request by email