Microsoft agreement stack

Latest changes

Last check 2026-10-11 — 15 instruments verified live across both stacks, 3 changed. Each change below carries an impact score; the schema is at the foot of this section.

• 2026-10-11
  Product Terms — Summary of Changes — Live change log confirms a monthly cadence; newest published update is 1 Oct 2026, and the past 12 months record AI/privacy-relevant edits (1 Aug 2026 Privacy & Security Terms added Web IQ to the DPA-exceptions table; 15 Jun 2026 added link to Data Residency for M365 Copilot and Copilot Chat; 15 Sep 2026 Glossary added definition of 'Microsoft AI Customer Solution'). source

  Major · 13/15privacy 3 · user-adjacent data 3 · stack 3 · reach 2 · notice 2

  Privacy / user data: Web IQ moves into the DPA-exceptions table, so a live AI/browsing service sits outside the DPA baseline; the same window adds a Copilot data-residency commitment (a protection, not a risk) and a new shared definition.

  Effect on the stack: Changes both precedence (a named service leaves the DPA baseline) and meaning (a new Glossary definition is read across the whole stack).

• 2026-10-11
  Products & Services Data Protection Addendum (DPA) — DPA version advanced from v.1 Sep 2025 (as previously recorded) to the current 22 May 2026 English release (aka.ms/DPA redirects to the licensing-docs page listing 22 May 2026 as the newest version). source

  Major · 9/15privacy 2 · user-adjacent data 1 · stack 2 · reach 3 · notice 2

  Privacy / user data: The DPA is the instrument that defines the enterprise data-protection baseline, so a version advance matters — but the text diff between versions has not been read, so this magnitude is provisional.

  Effect on the stack: An incorporated addendum: a new version is read into every master agreement at once, for every enterprise customer.

Coverage: 23 of 23 instruments have a monitored public source.

At a glance

Vendor

Microsoft

Layer model

Master → Product Terms (+ change log) → Addenda (DPA, Privacy & Security Terms) → Service-specific (SLA, AI Code of Conduct, embedded AUP) → Incorporated-by-reference (Glossary, Privacy Statement, Universal License Terms, data-residency, subprocessors)

Instruments tracked

23 registry rows (MS-01–MS-22 plus MS-BING)

Primary change signal

Product Terms — Summary of Changes

Status

In-force (form); underlying documents not opened here

How the stack is built

Each layer is incorporated by reference into the one above it; service-specific and data-protection terms take precedence for their own subject matter.

Instruments

Each instrument links to its live document where one exists.

Incorporation and precedence

• The MCA "Modifications" clause allows change by notice.
• The Product Terms material-adverse-change protection does not extend to "New Features, Supplements, or Related Software" — a principal drift mechanism.
• The Glossary is a lever that can change meaning across the stack without amending the master agreement.
• Subprocessor additions change processing locations.
• Change can enter through any layer, on its own schedule, often by online update plus continued use, without renegotiation.

What the monthly check diffs

• Version / effective date (DPA versions; master-agreement dates; Product Terms update dates).
• Content hash / change-log entry (Microsoft "Summary of Changes").
• New-feature carve-out text — does newly released AI functionality sit inside or outside protections?
• Data-use / retention statements.
• Subprocessor lists (additions and removals; processing locations).
• Glossary / definitions — meaning-level change across the stack.
• Precedence / order-of-precedence clauses — any reordering changes how documents are read.
• New instruments appearing in the stack, or instruments renamed or withdrawn.
• Data-residency commitments (for example, Copilot).

Watch list: Microsoft Product Terms Summary of Changes (/licensing/terms/product/changes/all) — monthly or more often. Microsoft DPA version and "New Features" clause; subprocessor lists (Service Trust Portal). Microsoft data-residency line for Copilot; Glossary revisions.

Changelog

The full running log for this stack, newest first.

• 2026-10-11
  Product Terms — Summary of Changes — Live change log confirms a monthly cadence; newest published update is 1 Oct 2026, and the past 12 months record AI/privacy-relevant edits (1 Aug 2026 Privacy & Security Terms added Web IQ to the DPA-exceptions table; 15 Jun 2026 added link to Data Residency for M365 Copilot and Copilot Chat; 15 Sep 2026 Glossary added definition of 'Microsoft AI Customer Solution'). sourceMajor · 13/15
• 2026-10-11
  Products & Services Data Protection Addendum (DPA) — DPA version advanced from v.1 Sep 2025 (as previously recorded) to the current 22 May 2026 English release (aka.ms/DPA redirects to the licensing-docs page listing 22 May 2026 as the newest version). sourceMajor · 9/15

Sources and further reading

Change-impact schema

Every change found by the check is scored on five dimensions (0-3 each, total 0-15) and placed in one of three bands. The point is to separate housekeeping from changes that belong in a review.

1. Privacy / data-protection effect — Does it change what personal data is processed, why, where, or for how long?
2. User-adjacent data — Does it touch data generated by or about end users — prompts, content, telemetry, feedback, identifiers?
3. Stack effect — Does it change how the stack is read — incorporation, precedence, scope, or a shared definition?
4. Reach — How many services, surfaces or customers are affected?
5. Notice and reversibility — Was there notice? Can a customer object, exit, or negotiate — or is it unilateral?

• 0-3Incidental — Housekeeping. Nothing substantive changes; safe to skip in a review.
• 4-8Minor — Real but bounded. A defined subset, a clarification, or a date/label change without a change to the underlying obligation.
• 9-15Major — Substantive. Changes obligations, data flows, or how the stack reads — belongs in a review or a client briefing.