Must we allow Move data across regions for Copilot Studio?

You’re right to slow down before ticking a consent box that mentions data movement. That’s Compliance doing its job — not “blocking innovation.”

Here’s what’s going on. Copilot Studio generative AI (and related Power Platform copilots) aren’t equally available in every region. In the Power Platform admin centre, under an environment’s Generative AI features, admins who are Power Platform or Dynamics 365 admins can consent to Move data across regions. When that checkbox is shown and selected, inputs (prompts) and outputs (results) might move to where the generative AI feature is hosted if the required model isn’t deployed locally, capacity overflows, or there’s a reliability issue — Microsoft states it doesn’t log, store, or retain those prompts/results for that transit, and this toggle doesn’t rewrite Product Terms commitments for Customer Data at rest. The checkbox doesn’t appear for US and government cloud regions, or where an environment already has full in-region capacity. For United Kingdom environments, Learn’s region table shows Azure OpenAI processing in region or in the EU Data Boundary, with Bing Search processing listed in the United States when Bing is enabled. Clearing the box later does not reverse data movement that already happened while it was on. Bing search and Microsoft 365 services checkboxes often require Move data across regions first when that control is visible. In the EU Data Boundary, a separate Allow flex routing during periods of peak load option can let LLM inferencing (and limited pseudonymised operational data) leave the EUDB during peaks — data at rest stays in the boundary aside from those limited exceptions; eligible tenants created after 25 March 2026 default flex routing on (older tenants: check Message Center). If makers see GenerativeAINotAvailable, the usual fix is either enable Move data across regions for that environment or redesign the agent to avoid generative AI features. You can also drive the setting at scale with Generative AI settings environment rules — not every Copilot feature is governed by this single checkbox.

Steady before scale puts Pane 04 (Security & Compliance) and Pane 06 (Cost & Value) ahead of “just make generative answers work.” Schofield’s First Law (historically attributed) still fits: don’t put organisational prompts into a path you can’t explain in a DPIA — document where processing may occur before Wave 0 makers industrialise agents.

Options that actually work:

1. Per-environment decision with a written residency note. Enable Move data across regions only on non-prod / Wave 0 maker environments first; leave production locked until Legal signs the story. Best Steady path for UK/EU tenants.
2. Keep the box off and strip generative AI (orchestration, web search, AI general knowledge, AI tools) so agents fail closed instead of erroring mid-chat. Honest if residency must stay strict.
3. Tick Move data, Bing, Microsoft 365 services, and flex routing everywhere “so makers aren’t blocked.” Fast demos; weak audit trail; irreversible transit history once used.
4. Assume one tenant toggle covers Microsoft 365 Copilot Chat web search and Studio the same way. Different admin surfaces — PPAC environment settings vs M365 Copilot controls.

12 Panes action / comms: Tell Compliance: prompts/results may leave region for processing under documented conditions; Customer Data at rest commitments aren’t rewritten by this toggle — still evidence it in the DPIA. Tell makers: GenerativeAINotAvailable is often residency/capacity, not a broken agent. Tell leadership: UK processing may stay UK or EUDB; Bing, if enabled, is a separate US processing story.

Benefits / risks: Clear consent unblocks generative Studio features where capacity needs it; consent isn’t a time machine; flex routing is a peak-load inferencing exception, not “data celebration”; environment sprawl without rules means every sandbox becomes a residency decision.

I’d suggest this week: inventory which environments show the checkbox, decide Wave 0 vs production, record Bing and flex routing separately in the AI risk register, and only then unblock makers. You’ll have Steady residency without pretending the error message was a licensing bug.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer