How Do You Segregate Microsoft 365 Data Before Enabling Frontier Models Like Claude Fable 5?

Last updated November 10, 2026

Data segregation for frontier models means deciding which Microsoft 365 content a model can reach, and under which contract, before any user turns it on. In practice, scope model access to named Entra ID security groups, label sensitive content in Microsoft Purview, close SharePoint oversharing, and confirm whether Anthropic will retain your data. Anthropic models with Data Retention, including Claude Fable 5, keep prompts and outputs for up to 30 days.

Claude Fable 5 and Mythos 5 Data Retention in Microsoft Copilot

Anthropic released Claude Fable 5 and Claude Mythos 5 on June 9, 2026. Both share the same underlying Mythos-class model, and Anthropic now requires 30-day retention for all Mythos-class traffic on its own platforms and on third-party platforms. Fable 5 is the generally available version, while Mythos 5 remains initially deployed to Project Glasswing partners and, soon, select biology researchers.

Microsoft's guidance on Anthropic models in Microsoft Online Services, last revised September 18, 2026, explains what the retention requirement means inside a Copilot tenant. Models labeled "Anthropic models with Data Retention" fall outside the Microsoft Product Terms and Data Protection Addendum. They stay off by default, and no user gains access until an admin accepts Anthropic's Commercial Terms of Service and selects who can use them. Anthropic may hold content flagged by its trust and safety classifiers for up to two years.

Eligibility also varies by organization, since Microsoft states that certain organizations can run Fable 5.1 with Anthropic acting as a Microsoft subprocessor, under the standard DPA and with no customer content retained by Anthropic. Your account team confirms which path applies, and the answer shapes every step in the checklist below.

Frontier Model Preparedness for Private Equity Portfolios

CloudServus recently ran frontier model preparedness assessments for two private equity-backed organizations, and in both cases the request started with the sponsor. Each sponsor wanted evidence that portfolio data would stay inside defined boundaries before operating teams enabled new models. Diligence files, financial models, and board materials often share a tenant with everyday collaboration, so any retention term outside the Microsoft agreement needs review by legal counsel before IT changes a setting.

Sponsors with several holdings otherwise repeat the same decision in every tenant. Portfolio standardization on Microsoft puts each company on one security and identity baseline, so a single frontier model policy applies across holdings. Mythos-class models can also find and exploit software vulnerabilities, so code security belongs on the same agenda. Our guide to AI code security before the next model release covers the pipeline controls to set up first.

Data Segregation Checklist for Frontier Models in Microsoft 365

Complete these six checks before any frontier model reaches a production user.

1. Confirm the contract terms for each model. In the Microsoft 365 admin center, review the AI providers operating as Microsoft subprocessors setting and record which Anthropic models run under Microsoft's DPA and which require Anthropic's own terms. Legal and compliance owners should approve the second group in writing.
2. Scope access with Entra ID security groups. Admins can assign AI provider access to specific users or security groups, and the assignment is enforced across Microsoft Copilot and Copilot Studio. Start with a pilot group whose work stays clear of regulated or deal-sensitive content, then repeat the decision in the Power Platform admin center, which holds separate controls for Copilot Studio and Power Platform.
3. Label sensitive content in Microsoft Purview. Sensitivity labels and DLP policies give you an enforceable way to keep financial, HR, and legal content out of AI prompts and responses. Microsoft's overview of Purview protections for generative AI apps lists which controls apply to Copilot, agents, and Microsoft Foundry; several depend on your licensing tier.
4. Fix SharePoint and OneDrive oversharing. Copilot draws on whatever a user can already open, so ownerless sites, organization-wide sharing links, and stale guest accounts need attention first. Our guide to creating AI guardrails inside Microsoft Copilot sets out the sequence.
5. Check data residency commitments. Microsoft currently excludes Anthropic models from the EU Data Boundary and, where applicable, in-country processing commitments. Organizations bound by either should keep these models disabled until counsel accepts the exception.
6. Enable monitoring before rollout. Audit logging and Data Security Posture Management for AI give your security team a record of frontier model interactions from day one. Our post on how IT and security leaders monitor Microsoft Copilot governance covers the reporting side.

Frontier Model Readiness With a Modern Microsoft Partner

Anthropic has said more capable models will arrive in the coming months, and each release reopens the same decisions about contract terms, user access, and content exposure. Organizations that settle those decisions now can evaluate the next model against an existing policy instead of starting over.

CloudServus is the modern Microsoft partner. Our senior engineers do the work, from the plan through delivery. Our AI Guardrails Assessment maps what Copilot and connected AI tools can reach in your tenant today, then delivers a findings register and a phased remediation plan your team can execute or hand to us.

Frontier Models in Microsoft Copilot FAQ

Is Claude Fable 5 available in Microsoft Copilot?

Yes. Fable-class models can be enabled as Anthropic models with Data Retention, which require explicit admin opt-in. Some organizations qualify to use Fable 5.1 under Microsoft subprocessor terms instead, and Microsoft directs customers to their account team to confirm eligibility.

How long does Anthropic retain data from Mythos-class models?

Anthropic stores inputs and outputs for up to 30 days before deletion. Content flagged by its trust and safety classifiers can be kept for up to two years, and Anthropic does not train on retained data without your express permission.

Do Anthropic models in Microsoft Copilot fall under the EU Data Boundary?

No. Microsoft currently excludes them from the EU Data Boundary, and they are disabled by default for customers in the EU, EFTA, and the UK.

Can admins restrict frontier model access to specific users?

Yes. Admins can assign access by user or Entra ID security group in the Microsoft 365 admin center, and the assignment applies across Microsoft Copilot and Copilot Studio.