The Microsoft Subprocessor Disclosure is the most ignored notice in the Microsoft 365 admin center, and in the Copilot era it has quietly become the most important one. Microsoft just published another update to the Microsoft Online Services Subprocessors List (MC1403210), the legal trail that tells you which non-Microsoft companies are allowed to process your customer or personal data to deliver your tenant.
Most admins archive the Subprocessor Disclosure in three seconds. That has always been a problem. With AI providers, model hosts and specialist data processors being added to the list faster than enterprise privacy teams can run a DPIA, that habit is now an unforced governance error. This post walks through what the Subprocessor Disclosure actually is, why it matters in the Copilot era, how to set up the right reader role, and the Paul-Take on building a real subprocessor triage process.
What Is the Subprocessor Disclosure
The Microsoft Subprocessor Disclosure is a recurring notice that Microsoft posts in the Message Center every time the Microsoft Online Services Subprocessors List changes. The list itself lives in the Microsoft Trust Center, the disclosure exists because GDPR Article 28 requires Microsoft to inform customers in advance of any new or replaced subprocessor.
A subprocessor is any non-Microsoft organization that Microsoft engages to help deliver Online Services and that may, in a limited way, process customer or personal data. They are contractually prohibited from using your data for any other purpose, but they are still touching it. That makes the Subprocessor Disclosure your single source of truth for who actually sits in the data path of your tenant.
What the Subprocessor Disclosure covers
- Additions of new subprocessors to the Microsoft Online Services Subprocessors List
- Replacements of existing subprocessors
- Removals (less common but they do happen)
- The Trust Center link where the full list is published
- The role mapping for privacy stakeholders inside your tenant
What the Subprocessor Disclosure does not do
- It does not list every detail in the Message Center body, the full list is in the Trust Center
- It does not require you to take a specific technical action in most cases
- It does not change your licensing or your end-user experience
- It does not replace your own Data Processing Impact Assessment process
Why the Subprocessor Disclosure Matters More in 2026
Two years ago, a Subprocessor Disclosure update was usually about a new regional data center partner or a new analytics vendor. Boring, but predictable. In 2026 the cadence and the content have shifted.
AI providers, foundation model hosts, fine-tuning specialists, prompt-routing services and observability vendors are now part of the modern Microsoft 365 Copilot supply chain. Each one of them, if engaged, lands in a Subprocessor Disclosure. That changes the risk picture in three ways.
Faster cadence
Subprocessor changes used to land once a quarter. Now they can land monthly, and around major Copilot or Azure AI launches you can see multiple updates within weeks. If your privacy review cycle assumes quarterly cadence, you are already behind.
Wider data path
A Copilot prompt that touches a third-party AI subprocessor may travel further than a SharePoint document or an Exchange mail. Even with Microsoft contractual controls, the surface area auditors care about has expanded. Treat the Subprocessor Disclosure as a leading indicator of where the data path is going next.
Sharper regulator focus
EU regulators, the UK ICO, and several US state privacy authorities are all increasing scrutiny on AI vendor chains. The Subprocessor Disclosure is the document those regulators will ask for first. Pair it with the Teams built-in agents governance work you should already be doing.
How to Use the Subprocessor Disclosure in Your Tenant
The Subprocessor Disclosure is not technically demanding, it is procedurally demanding. The work is in turning each notice into a tracked review with an owner and an outcome.
Roles, processes and ownership
| Role | Owns | Frequency |
|---|---|---|
| Message Center Privacy Reader | Receiving the Subprocessor Disclosure | Per notice (variable) |
| Data Protection Officer | Triage and customer-facing impact analysis | Per notice |
| Security or GRC lead | Update vendor inventory and DPIA register | Per notice |
| Copilot adoption lead | Decide if rollout pace needs to adjust | Quarterly |
Setting up the Privacy Reader role
- Open the Microsoft 365 admin center, go to Roles then Role assignments
- Locate the Message Center Privacy Reader role
- Assign your DPO or a delegated GRC analyst to the role
- Confirm they receive a test notification via the Message Center
- Add the Subprocessor Disclosure cadence to your privacy operations runbook
Standing process for each Subprocessor Disclosure
- Read the Subprocessor Disclosure notice within five business days
- Open the Microsoft Trust Center, download the latest Microsoft Online Services Subprocessors List
- Diff against your previous saved version, flag additions and replacements
- For each change, decide if a customer-facing communication or a DPIA update is required
- Record the decision and the date in your vendor inventory
- Notify the Copilot or AI governance lead if the change touches an AI subprocessor
Common mistakes
- Treating the Subprocessor Disclosure as a generic Message Center notice and archiving without review
- Not assigning the Message Center Privacy Reader role, so the notice lands only in the global admin inbox
- Keeping the Subprocessor Disclosure trail in email instead of the vendor inventory
- Ignoring the cadence shift in 2025 and 2026 around AI subprocessors
- Missing the link between Subprocessor Disclosure and your Copilot Cowork pricing breakdown where the underlying licensing makes the disclosure binding
AI-era checklist for Subprocessor Disclosure
- Privacy Reader Role assigned and tested
- Trust Center list downloaded and version-controlled
- Vendor inventory updated within five business days of each notice
- AI subprocessor changes flagged to the Learning Agent Copilot and broader Copilot adoption owners
- Customer-facing communication template ready for regulated industries
- DPO informed of every change
The Paul-Take on the Subprocessor Disclosure
Blunt opinion. The Subprocessor Disclosure is the most under-read MC notice in your tenant, and that needs to change in 2026. We are at the point where AI model providers, hyperscalers and specialist data processors are being added to the subprocessor list faster than most enterprise privacy teams can run a Data Protection Impact Assessment. If you have not assigned a Privacy Reader Role, and you do not have a process to triage each Subprocessor Disclosure within 30 days, you are not running Copilot governance. You are running Copilot hope.
The good news, this is not a tooling problem. The Subprocessor Disclosure mechanism in the Message Center works fine, the Trust Center publishes the list cleanly, the Privacy Reader Role exists. The problem is that admins inherited a 2019 process where these notices were boring and quarterly. The process needs a 2026 refresh, with AI subprocessor changes treated as a separate signal that feeds into your Copilot adoption pace.
If you do nothing else this quarter, assign the Privacy Reader Role and add the Subprocessor Disclosure to your monthly governance review. That single step is the difference between a defensible audit and a long Friday.
This should be rolling out in mid-June 2026 according to Microsoft.
Related Resources
The Subprocessor Disclosure rarely sits alone. Pair it with the broader Copilot and Microsoft 365 governance work on this blog:
- Copilot Cowork pricing breakdown
- Teams built-in agents governance
- Learning Agent Copilot deployment
- Teams Recap app rollout
Microsoft official references for the Subprocessor Disclosure: