Copilot Studio vs a Custom Azure OpenAI Build When Customer Data Must Stay in the UK

Where does a Copilot Studio agent process customer data?

Where your Power Platform environment says it should, adjusted by the generative AI settings on that environment. An agent lives in an environment created in a geography, such as the United Kingdom, and data the agent stores, such as conversation transcripts in Dataverse, sits in that geography. Generative features, meaning generative answers and AI orchestration, call Azure OpenAI, and Microsoft publishes a table of where that happens for each environment geography in Move data across regions for Copilots, AI agents, and generative AI features. Where Copilot Studio stores each kind of data is covered in Data locations in Copilot Studio.

At the time of writing, that table maps UK environments to Azure OpenAI "in region or in EU Data Boundary", and maps Bing search for every geography to the United States. Read it yourself before relying on this summary, because Microsoft updates it as capacity changes.

• The Move data across regions setting is per environment, in the Generative AI features card in the Power Platform admin center. Microsoft states that when it is not selected, no data is sent outside the region, and that some generative features may not work until in-region capacity exists.
• When it is selected, prompts and outputs may be processed where the feature is hosted. Microsoft notes that data movement that happened while the setting was on cannot be reversed by turning it off later.
• Bing search, and features powered by Microsoft 365 services, are separate checkboxes. If web search over public sites is not acceptable for your data, leave Bing search off and keep public websites out of the agent's knowledge sources.
• Microsoft also notes that cross-geo behaviour in Copilot Studio can vary by model, and that some models may process data outside the environment's region even when movement is restricted. Check the model availability guidance before choosing a model for the agent.
• The setting can be enforced across many environments with an environment group rule, which is how you stop a new environment quietly drifting from the policy.

Where does a custom Azure OpenAI build process customer data?

Where you deploy it, provided you choose the deployment type that matches the requirement. In a custom build you create the Azure OpenAI resource in your own Azure subscription, pick its region, and pick a deployment type for each model. Microsoft's Data, privacy, and security page and its deployment types guidance set out the rules.

• Data at rest for stateful features, such as uploaded files, stored conversation threads and fine-tuning data, is stored in the geography of the resource, and Microsoft states that prompts and completions are not used to train foundation models.
• Abuse monitoring may store flagged prompts and completions for human review in the resource's geography. Organisations that need to avoid that can apply for modified abuse monitoring; Microsoft decides eligibility.
• Newer models often arrive on Global deployments first, so a strict UK-only rule can mean using an older model in a UK region, or waiting.
• The model is only one component. The retrieval index, the application, its logs and any analytics also hold customer data, and each needs its own region decision in your subscription.

How do Copilot Studio and a custom Azure OpenAI build compare for UK residency?

Side by side, the difference is less about where data can go and more about who sets each control and who has to keep checking it.

What controls will legal ask for before approving either option?

Legal and data protection teams approve concrete evidence, not a product name. Prepare the same pack for either option, so the decision is made on the same facts. Solzet provides the technical facts and builds the controls; the legal interpretation stays with your data protection lead and advisers.

• A data flow map: every component that receives customer data (channel, agent or application, model, retrieval index, logs, analytics), the region of each, and whether anything leaves the UK.
• The recorded settings: for Copilot Studio, the environment geography and the Move data across regions, Bing search and Microsoft 365 services choices; for Azure OpenAI, the resource region and the deployment type per model.
• Policy enforcement: an environment group rule or Azure Policy that blocks non-compliant settings and regions, plus a periodic check that nothing has drifted.
• Retention: how long transcripts, prompts, logs and indexes are kept, and how deletion and data subject requests reach each of them.
• Access: who can read conversations and logs, including administrators and support, and how that access is logged.
• The contractual layer: Microsoft's data protection terms for the services used, and the abuse monitoring position for Azure OpenAI.
• A data protection impact assessment scoped to the agent's actual use and data, not to AI in general.

What is the operational overhead of each option?

Copilot Studio moves most of the running to Microsoft. You still own the environments and their settings, data loss prevention, authentication, capacity, the knowledge content and the testing, and you accept that a strict in-region setting may delay some generative features. Which Dynamics 365 records an agent may read, and how to pilot it safely, is covered in our guide to governing Copilot and AI agents over Dynamics 365 data.

A custom Azure OpenAI build gives you full control of region, model and network, and gives you everything else to run as well: the application and its user interface or channels, authentication, the retrieval pipeline and index, evaluation and regression tests, monitoring and alerting, quota management, and upgrading when a model version is retired. That is a standing engineering commitment, not a one-off project.

• Choose Copilot Studio when the agent mainly answers from your knowledge and Dataverse, Microsoft's documented mapping for your UK environment satisfies your policy with cross-region movement and Bing search turned off, and you want the smallest team to run it.
• Choose a custom Azure OpenAI build when the policy requires processing pinned to a UK region with no exceptions, when you need network isolation or a model the platform does not offer in region, or when the AI is part of a larger application you are building anyway.
• Consider a hybrid when most of the agent fits Copilot Studio but one step needs tighter control: the agent calls your own UK-region Azure OpenAI deployment through a governed flow or connector for that step.

How does Solzet help, and what does it not claim?

We recommend the right solution - whether that's Microsoft Dynamics 365, Power Platform, or a custom-built CRM. Some businesses need the Microsoft ecosystem. Others need full control without licensing. We deliver both.

For an AI assistant that means we compare both options against your written residency policy before anyone builds. Our senior consultants and full-stack developers, with 8+ years of Dynamics 365, Power Platform and custom development, configure and document the settings, build Copilot Studio agents in your environments, and build custom applications in your own Azure subscription when the platform does not fit, the same way we deliver custom CRM development. Solzet does not host your data or your models: residency is set in your tenant, under your control, and we hand over the settings and evidence so your team can prove it.