Can you license your company's Microsoft 365 data to AI companies?

Microsoft 365 data rights at a glance

Who owns your Microsoft 365 data under Microsoft's terms?

Your company owns its Microsoft 365 content as against Microsoft. The Microsoft Products and Services Data Protection Addendum says in its section on the nature of data processing and ownership that "Customer retains all right, title and interest in and to Customer Data."

The DPA defines Customer Data as all data, including text, sound, video, image files and software, provided to Microsoft through use of the Online Service. It also commits Microsoft not to use Customer Data for "advertising or similar commercial purposes." We found no clause in the DPA about AI training by customers or their licensees.

Ownership against Microsoft does not settle whether you may license email and chat written by other people. Our guide on whether you can legally sell company data covers that second question.

What can you export from Microsoft 365, and how?

Microsoft Purview eDiscovery is the main admin route for a bulk Microsoft 365 export. Microsoft's eDiscovery overview says it searches and exports Exchange Online, Microsoft Teams, Microsoft 365 Groups, OneDrive, SharePoint and Viva Engage. The export guidance sets these options:

• Mail exports as PST files or individual .msg files, in PST packages of 1 GB to 10 GB
• Teams and Viva Engage conversations can be threaded into HTML transcripts, with messages from a 12-hour window around each responsive item
• SharePoint and OneDrive exports include native documents, with the latest version, recent 10 or 100 versions, or all versions
• Export packages expire 14 days after you create them, and an export running more than seven days cancels automatically

For Teams at scale, the Teams Export APIs in Microsoft Graph export 1:1, group, meeting and channel messages, with links to recordings and transcripts. Microsoft treats these as protected APIs, and only an administrator can approve the application permissions.

Do Microsoft's terms restrict AI training on Microsoft 365 data?

Microsoft's terms say nothing direct about AI training on data you export. We found no such clause in the DPA or the Purview documentation. The open question is the Microsoft APIs Terms of Use (last updated October 2025), which bind anyone building an app on Microsoft APIs, including Microsoft Graph.

Section 3(b)(4) bars you from using the APIs to "Scrape, build databases or otherwise create copies of any data" except as needed for your app's intended use. Section 3(b)(14) bars you to "Redistribute or resell, or sublicense access to" data obtained using the APIs. A license of Teams messages extracted through Graph sits close to that wording, although the terms do not mention AI.

Treat the position as unclear. A Purview export run by your own compliance team is a different route from an app built on Graph, and an enterprise agreement may add terms of its own. Ask counsel to review both before you choose the extraction method.

Which Microsoft 365 plan and admin rights do you need?

Microsoft says the eDiscovery user needs a Microsoft 365 Enterprise E3 or E5 license to export content.

• The eDiscovery Manager or Administrator role group, or a custom role, to run searches and exports
• A SharePoint E3 license on the exporting account, or SharePoint items may not export as expected
• E5 or an E5 add-on for premium features such as review sets, analytics and OCR
• For the Teams Export APIs, an active Teams license on each user whose data you export

Mailboxes and Teams chats are dense with personal data: names, email addresses, signatures, phone numbers, calendar entries and message content about colleagues, customers and suppliers. SharePoint adds HR files, contracts and spreadsheets that often hold personal data in bulk.

The US position

In the US, start with California. The CCPA defines a sale as making personal information available "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)(1)), and a license fee from an AI buyer fits that wording on its face. Employee and business-contact data have been in scope since January 1, 2023, when the temporary exemptions expired.

Data counts as deidentified under § 1798.140(m) only if you take reasonable measures so it "cannot be associated" with a person, publicly commit to keep it that way and contractually bind every recipient. Our de-identification guide explains how to meet that standard, and our guide to the CCPA and state privacy laws covers the other states.

Other comprehensive state privacy laws, including those in Virginia, Colorado and Texas, define sales and exemptions in their own words, and several treat employee data differently from California. Map where the people in your export live before you rely on any one state's rules.

If the export could hold health information from a HIPAA covered entity or business associate, HHS recognizes two de-identification methods under 45 CFR 164.514(b): Expert Determination, and Safe Harbor, which removes 18 types of identifiers. Financial institutions under the Gramm-Leach-Bliley Act must explain customers' right to opt out of certain sharing with nonaffiliated third parties, according to the FTC.

Your own privacy promises still bind you. FTC staff wrote on February 13, 2024 that adopting more permissive data uses, such as AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy could be unfair or deceptive. Check the privacy notice, employee handbook and customer contracts in force when the data was collected.

Workplace messages raise a labor law point too. Daniel Goldberg of Frankfurt Kurnit Klein & Selz wrote in October 2026 that staff messages about pay and working conditions can be "protected concerted activity under Section 7 of the National Labor Relations Act," whether or not staff are unionized.

If you hold UK or EU data

UK GDPR and EU GDPR treat names, email addresses and message content about identifiable people as personal data. Licensing it for AI training is a new purpose, so you need a lawful basis under Article 6 and a compatibility assessment under Article 6(4), which the ICO covers in its guidance on compatibility and the reuse of personal information. This page is general information, so confirm your position with your own counsel.

What third-party content is in a Microsoft 365 export?

Outlook and Teams carry more outside content than most platforms. Every inbound email was written by someone outside your company, Teams shared channels and guest users bring in partners, and attachments often include client documents under NDAs.

Filter out external senders, guest accounts, shared channels and client attachments unless you have written permission. Buyers of workplace communications data will ask for a record of those filters.

How do you prepare a licensable Microsoft 365 export?

Preparing a Microsoft 365 export for a buyer starts with the extraction route and ends with a manifest. Work through these steps in order.

1. 1

   Pick the extraction route

   Decide between a Purview export and a Graph-based app, and get counsel's view on the Microsoft APIs Terms of Use for the Graph route.

2. 2

   Scope the search

   Build Purview searches by custodian, date range and location, and export the item report first to size the archive.

3. 3

   Beat the expiry window

   Download packages within 14 days and move them to storage you control, because Purview export packages expire after that.

4. 4

   Remove third-party content

   Take out external email, guest and shared channel messages and client attachments unless the other party has agreed in writing, and keep privileged legal material out entirely.

5. 5

   De-identify and test

   Replace names, user IDs and email addresses across the Microsoft 365 export, then run a re-identification test on a random sample, as our de-identification guide describes.

6. 6

   Write the manifest

   Record record counts, date ranges, systems, exclusions and the export method in a data manifest that matches what you deliver.

7. 7

   Get counsel's sign-off

   Ask your own counsel to review the Microsoft 365 terms, your order form and your privacy notices together before any buyer sees a sample.

If you want a view on whether your Microsoft 365 data is licensable and what buyers might pay, start with a data valuation. We are a broker, not a law firm, so take independent legal advice before you sign any license.