Can Your School See What You Do in Microsoft Copilot?

One of the most-searched AI questions in UK schools right now. Here is the honest answer on what your school can see, what is protected, and where the real risk actually sits.

This is one of the most-searched questions by school staff in the UK right now, and it deserves a straight answer rather than a shrug. If you sign into Microsoft Copilot with your school account, your school's IT administrators can see that you used it, and in many configurations they can retrieve what you typed. Not in real time, not casually, and not usually by choice — but the capability exists, and staff should know that before they paste anything sensitive.

What your school can actually see

When you use Copilot signed in with a school (Microsoft 365 Education) account, your prompts and responses are treated as your organisation's data — not your personal data. In practical terms that means:

• Usage is visible. Admins can see which accounts are using Copilot and how often, through the Microsoft 365 admin centre reports.
• Content can be retrievable. Copilot interactions are stored in the school's tenant and can be surfaced through eDiscovery and audit tools — the same mechanisms that cover email and Teams messages.
• Retention policies apply. If your school has retention rules configured, Copilot interactions can be kept under those rules like any other record.

What that does not mean is that your headteacher is reading your prompts over coffee. These tools exist for legal, safeguarding and compliance reasons — a subject access request, a safeguarding investigation, a disclosure requirement. Nobody is browsing for entertainment. But "nobody is looking" and "nobody can look" are very different statements, and staff deserve the accurate one.

Is what I type used to train the AI?

This is the reassuring part, and the distinction that matters most. With a properly licensed Microsoft 365 Education account, prompts and responses in commercial-data-protected Copilot are not used to train the underlying models. That protection is the whole point of the education and enterprise licensing: your data stays inside your tenant's boundary.

The risk sits elsewhere — in staff using free, personal AI accounts for school work. A teacher pasting pupil information into a free consumer tool on a personal login has no such protection, and that is where most schools' real exposure lies. It is also, incidentally, what KCSIE 2026 now expects schools to have understood and managed.

What this means for staff

• Assume your school-account AI use is a school record. Write in it as you would in a school email — because in compliance terms, that is roughly what it is.
• Never put identifiable pupil information into a free or personal AI account. Names, SEN details, safeguarding notes, behaviour records. This is the line that turns a productivity habit into a potential UK GDPR breach.
• Don't use AI for anything you wouldn't want quoted back. Venting about a colleague or a parent in a prompt is a bad idea for the same reason it is in email.
• Ask what your school has actually enabled. Most staff have no idea whether their school has Copilot licensed, what version, or with which protections — and it is a fair question to ask.

What this means for school leaders

If staff are asking this question — and the search data says they are, in numbers — the honest read is that your school has AI use happening without a shared understanding of the rules. That is not a discipline problem; it is a communication gap, and it is straightforward to close.

1. Tell staff plainly what is monitored and why. Silence gets filled with rumour, and rumour makes staff either reckless or fearful. Neither helps.
2. Give them a sanctioned tool. Staff who have a safe, approved option stop improvising with free accounts. This single step removes most of your risk.
3. Put it in an acceptable use agreement. One page, signed, covering what may and may not go into AI tools, which accounts to use, and who to ask when unsure.
4. Cover it in safeguarding training. KCSIE 2026 now expects AI to sit inside your safeguarding arrangements, not beside them.

For the wider picture of what the new guidance requires, see our summary of the KCSIE 2026 AI changes, and our guide to writing an AI policy for a UK school. If you're weighing up the platform itself, our Microsoft Copilot for schools review covers what it's actually good at.