Microsoft 365 Copilot began tapping OpenAI’s new GPT-5.6 model on July 9, the same day it broke cover from the lab. The language model is now the “preferred” brain for Copilot in Word, Excel, PowerPoint, Copilot Chat, and Copilot Cowork—and it arrives with an administrative catch. While everyday users will likely see smarter responses across documents, spreadsheets, and presentations, IT administrators have until July 24 to decide whether they’re comfortable letting data flow through an OpenAI-operated subprocessor instead of Microsoft’s own Azure infrastructure. If they do nothing, Microsoft will flip the switch for eligible commercial tenants.
A New Engine for the Productivity Suite
GPT-5.6 isn’t a subtle tuning tweak. OpenAI and Microsoft designed it for knowledge work that stretches across multiple steps: think drafting a lengthy report, editing it against brand guidelines, then pulling in live data from a spreadsheet to build a financial summary. In Word, that means more coherent long-form writing and sharper revision suggestions. In Excel, it unlocks deeper data analysis—pattern detection, natural-language queries that generate complex formulas, and richer chart narratives. PowerPoint slides benefit from AI-generated drafts that are leaner, with images and speaker notes tailored to the deck’s topic. And in Copilot Cowork—Microsoft’s catch-all for agentic workflows—the model can chain together tasks like reading incoming email, creating a meeting agenda, and scheduling a follow-up without a human clicking through each step.
Microsoft says Copilot itself will often decide when to use GPT-5.6, routing tasks to the model only when it’s the best fit. There’s nuance here: “preferred” is not “exclusive.” Copilot’s orchestration layer can still dip into Azure-hosted OpenAI models, third-party AI providers, or Microsoft’s own MAI family if the workload or cost calculus suggests a different path. Where the model picker is visible within an app, users may also manually switch to GPT-5.6.
What It Means for You
If you’re an everyday Microsoft 365 user —someone who writes memos, builds quarterly reports, or polishes slide decks—the upgrade will likely feel invisible but welcome. Copilot’s suggestions should be more on-point, especially when you ask it to do multi-layered tasks in one go. An instruction like “Draft a project summary from these three emails and format it as a Word document” is exactly the kind of job GPT-5.6 was tuned for. You won’t need to flip any toggles; the model should simply show up as Copilot gets smarter.
Power users who lean heavily on Excel’s analysis features or regularly compose long documents may notice Copilot offering deeper insights or maintaining context over longer conversations. In some apps, you might see a model selector icon that lets you explicitly choose GPT-5.6. That’s useful if you’re trying to force the best possible result for a complex task, rather than letting Copilot’s automated optimizer decide.
For IT administrators and compliance officers, however, GPT-5.6 introduces a structural change that goes beyond better AI. Microsoft is accessing this model not only through its own servers but also directly via OpenAI’s API. That means prompt data, files, and responses may flow to OpenAI-operated infrastructure—not just the usual Azure regions Microsoft controls. This two-path arrangement is new. Previously, OpenAI models inside Microsoft 365 were almost always served from Azure, which allowed admins to rely on Microsoft’s data residency commitments and its specific compliance certifications. Now, an OpenAI subprocessor sits alongside those services, and it breaks some longstanding assurances.
How We Got to a Multi-Model Crossroads
The July 9 GPT-5.6 launch didn’t happen in a vacuum. Microsoft’s AI roadmap has been quietly splintering. On July 7, Bloomberg reported that the company had started routing tens of thousands of weekly prompts in Excel and Outlook to its own internally developed MAI models, moving workloads that previously leaned on OpenAI and Anthropic technology. That shift—confirmed by an unnamed source—signals Microsoft’s determination to reduce cost and dependence on external AI providers for routine tasks.
GPUs don’t come cheap, and even a mature partnership with OpenAI doesn’t shelter Microsoft from the financial realities of serving billions of Copilot requests. MAI models, built and hosted entirely in-house, give the company a lever to pull when it wants to keep per-prompt costs down while still satisfying the user. That’s likely why GPT-5.6 is being positioned as a “frontier” option for complex workloads, while more mundane requests—like quick grammar checks or repetitive data lookups—might silently run on a smaller, cheaper model.
This balancing act mirrors what every large cloud provider is doing with AI: swapping between engines based on the job. For customers, the upshot is that the Copilot you use today might not be running on the same model as the Copilot you use tomorrow, nor on the same one that a colleague in another region uses. The model choice is becoming a function of task complexity, tenant settings, and even real-time availability.
Yet the specific contractual shift around GPT-5.6 is especially meaningful because of what Microsoft disclosed on its subprocessor page. OpenAI was added to the list on June 23, and the “OpenAI-operated provider” status became available on July 9—but disabled by default. That gave admins a brief window to review the implications before Microsoft’s planned automatic enablement on July 24.
The Subprocessor Reality: What Breaks and What Doesn’t
For organizations that operate inside government clouds (GCC, GCC High, DoD) or sovereign cloud environments, GPT-5.6 via OpenAI’s direct API simply won’t be available. Microsoft’s documentation is explicit: the OpenAI-operated path is excluded from these environments and from in-country processing commitments that some enterprise agreements mandate.
More critically, the new subprocessor does not carry several attestations that heavily regulated companies rely on: FedRAMP High, PCI DSS, HITRUST, and SOC 1 Type 2 are all absent when data touches OpenAI’s pipes instead of Azure’s. That doesn’t mean the model itself is insecure—but it does mean the contractual and audit-level guarantees many compliance teams have built their programs around no longer apply uniformly.
If your organization processes credit card data, patient health information, or government-controlled data, routing any of that through the OpenAI-operated version of GPT-5.6 could violate existing compliance positions. Even for commercial enterprises without those specific requirements, the loss of in-country processing guarantees may conflict with data sovereignty policies. Microsoft suggests admins engage their legal and compliance teams to assess the risk.
What to Do Now: Admin Actions Before July 24
The deadline is real but manageable. Here’s exactly where to go:
- Sign in to the Microsoft 365 admin center with Global Administrator or AI Administrator credentials.
- Navigate to Copilot > Settings > View all.
- Locate the section labeled “AI providers operating as Microsoft subprocessors.”
- See if “OpenAI” is listed and whether it is enabled (it should be disabled by default until July 24).
- Decide: enable it for all users, enable it only for specific groups, or leave it disabled entirely.
Leaving it disabled after July 24 means your tenant will continue using only Microsoft-operated infrastructure for Copilot AI. You’ll still get GPT-5.6 through Azure-hosted endpoints where available, but you’ll miss the direct OpenAI API path—which, for many organizations, may be entirely acceptable. There’s no indication from Microsoft that features will degrade significantly without the direct OpenAI link, since Copilot already has multiple ways to reach the model.
If you do opt in, consider segmenting your user base. Creative teams experimenting with cutting-edge AI might benefit from direct access, while groups handling sensitive financial or legal documents might stay on the Azure-only path. The group-based control supports exactly that.
One more thing: review your data residency commitments. If your tenant benefits from EU Data Boundary or similar guarantees, check with your Microsoft account team to understand whether using the OpenAI subprocessor voids those protections. Microsoft’s FAQ is direct: “OpenAI-operated models are excluded from in-country processing commitments where those apply.” Don’t assume—verify.
Outlook: More Models, More Choices
GPT-5.6 won’t be the last frontier model to land in Copilot, and the dual-path delivery—Microsoft-operated plus provider-operated—may become the default pattern as other AI vendors add their models to the mix. The integration of Anthropic’s Claude, already documented in some Microsoft 365 scenarios according to ITPro, hints at a future where admins manage a menu of AI providers, each with its own compliance footprint.
Microsoft’s own MAI models are also likely to surface more visibly. The Bloomberg report shows that internal models are already handling real production loads, not just test traffic. If they can match GPT-5.6 quality on a narrow set of tasks at a lower cost, expect Microsoft to route more workload there, quietly improving its economics while keeping the user experience seamless.
The immediate takeaway is clear: for the next two weeks, the ball is in the compliance team’s court. GPT-5.6 brings meaningful upgrades to document editing, data analysis, and presentation creation, but it also forces a conversation about where data goes and what legal frameworks wrap around it. The July 24 deadline isn’t a crisis—it’s a prompt to revisit assumptions about how Copilot operates inside your organization.