Microsoft 365: Choose Your Data Location Before 14 December

On 14 September Microsoft put a setting into the Admin Center that most admins have overlooked so far. It is called Store Microsoft 365 customer data in-country, it ships in the disabled state, and it governs where customer data is stored for Exchange Online, SharePoint, OneDrive, Teams and Copilot. Every affected tenant has until 14 December 2026 to change it. Leave the switch alone and Microsoft may move that data out of the country from mid-December, into regional storage inside the EU data boundaries.

The change hides in message center entry MC1470878, which is not publicly readable. Without tenant access there is no way to pull the entry, so it is documented through the Admin Center notice, through heise and through BornCity. (Quelle: File via Wikimedia Commons)

What changes exactly

heise describes the change on the basis of message center entry MC1470878 from 11 September 2026. The setting covers eligible commercial tenants in Germany, France, Norway, Sweden and Switzerland. Switch it on and customer data stays inside national borders. Leave it as shipped and the data may sit anywhere inside the EU data boundaries. The services involved are Copilot and Copilot Chat, Exchange Online, OneDrive, Teams and SharePoint.

The route to the setting: Admin Center, Settings, Organization settings, Organization profile, Data location, Commitments. It is the same window in which the Data Location Map shows the stored region for each service.

The purpose Microsoft gives is load balancing rather than compliance. Privacy, security, encryption and the EU data boundaries themselves stay as they are, and the data does not leave the EU. The data protection authority of North Rhine-Westphalia, which heise refers to, places third countries under Article 44 GDPR outside the EU. As long as the data stays in the EU, that authority sees the question as answered.

Why you still have to decide

Data protection is half the arithmetic. Many companies have promised customers, auditors or their own internal policies that certain data stays in a particular country. Such a promise names a storage location. It says nothing about the legal framework around it. If Exchange mailboxes or SharePoint sites physically sit in the neighboring country from December onwards, that can stay unnoticed for a long time. It still breaks every commitment that contains the word border. Before an audit request in spring 2027, the answer should read: decided in September. Not: never looked at it.

The three traps in this story

First, the mechanism is an opt-out. Doing nothing is a decision as well, and it goes against keeping the data in the country. Microsoft presents the choice as a comfort feature. The preset works for Microsoft.

Second, the information is not public. Entry MC1470878 runs through the Message Center and cannot be viewed without tenant access. BornCity reported on 24 September that the notice never reached its own inbox and that readers do see the option in the Admin Center but find it greyed out. A switch that exists but cannot be reached is no consent. Whoever is affected should ask tenant support in writing and keep the reply.

Third, the way back is slow. According to the extract one reader quoted to BornCity, anyone who misses the deadline and switches it on later has to expect up to six months of migration back. That rules out an indefinite wait.

The third step is the actual work. Everything else is paperwork. (Quelle: MC1470878 per heise online and BornCity, as of 24 September 2026)

Austria is missing from the list

Austrian tenants fall outside the Microsoft notice. The country is not on the list. Two reasons why the notice was still on the table for us here. Austrian companies have been running their tenants for years with Germany as the declared location, either through a German provider or because a German subsidiary set them up. In that case you are a German tenant and you are affected. And the Data Location Map shows an Austrian tenant which storage location is actually committed for each service, including the note that some data has always been allowed to spread across the EU. Anyone who cannot check that for their own tenant in two minutes does not know where their own data is kept. That would be the real problem, independent of the Microsoft date.

The to-do is the same for every tenant: read the tenant country and the commitments off the Data Location Map, decide whether the national border is a question of commitments or of price, set the switch or leave it deliberately, and file the decision with a screenshot in the compliance folder. For affected admins this is a twenty-minute appointment before Christmas. Anyone who misses it spends February negotiating a return migration of up to six months, the figure a reader quoted to BornCity on 24 September.