Vendors · Questionnaire · Microsoft

Read Microsoft’s own answers to nine buyer questions

Azure OpenAI and other models sold by Azure in Microsoft Foundry. Each answer quotes Microsoft’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.

Microsoft in the vendor record microsoft-questionnaire.csv

Does the vendor train its models on business and API customers’ data?

NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”

NIST AI RMF 1.0, MEASURE 2.10

Not without permission

Your prompts (inputs) and completions (outputs), your embeddings, and your training data: are NOT available to other customers. are NOT available to OpenAI or other providers of Models sold by Azure. are NOT used by providers of Models sold by Azure to improve their models or services. are NOT used to train any generative AI foundation models without your permission or instruction.

Data, privacy, and security for Foundry Models sold by Azure, kept 24 Oct 2026 · sha256 cb7f0b5243c1

Does the vendor train its models on free and consumer use of its products?

NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”

NIST AI RMF 1.0, MEASURE 2.10

Not read

The vendor record does not read this point for Microsoft.

How long does the vendor keep the data that customers send?

NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”

NIST AI RMF 1.0, MEASURE 2.10

Not published in the pages kept

Searched: Data, privacy, and security for Foundry Models sold by Azure; Abuse monitoring; Azure OpenAI in Microsoft Foundry Models quotas and limits; Microsoft Products and Services Data Protection Addendum.

Can a customer have the vendor keep none of its data?

NIST AI RMF 1.0, MEASURE 2.10

Modified abuse monitoring, by application

Microsoft allows customers who meet additional Limited Access eligibility criteria to apply to modify abuse monitoring by completing this form.

Abuse monitoring, kept 24 Oct 2026 · sha256 8ccd372f07b1

Where does the vendor process and store customer data?

NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”

NIST AI RMF 1.0, GOVERN 6.1

In the customer’s chosen geography, except Global and DataZone deployments

Prompts and responses are processed within the customer-specified geography (unless you are using a Global or DataZone deployment type), but may be processed between regions within the geography for operational purposes (including performance and capacity management).

Data, privacy, and security for Foundry Models sold by Azure, kept 24 Oct 2026 · sha256 cb7f0b5243c1

Which other companies process customer data for the vendor?

NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”

NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1

Not published in the pages kept

Which independent audits or certifications does the vendor name?

NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”

NIST AI RMF 1.0, GOVERN 6.1

Not published in the pages kept

Does the vendor publish a history of its service incidents?

NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”

NIST AI RMF 1.0, GOVERN 6.2

No answer kept

The linked feed holds open events only. Past incidents are reviews on an HTML page, not a feed. The page.

Does the vendor publish the dates on which it retires its models?

NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”

NIST AI RMF 1.0, GOVERN 6.2

Yes: Azure AI Foundry (“Model retirement schedule”), with 166 dated retirements kept

Azure AI Foundry, “Model retirement schedule”, kept 26 Oct 2026 · sha256 ab49910725d1. The record.

Sources

microsoft-questionnaire.csv Every dataset → Status → Glossary →

Microsoft, Data, privacy, and security for Foundry Models sold by Azure, kept 24 Oct 2026.
Microsoft, Abuse monitoring, kept 24 Oct 2026.
Microsoft, Model retirement schedule, kept 26 Oct 2026.
NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.