Why this article, why now
It was one of those Monday afternoon situations. I opened the Message Center to collect material for the next M365 News episode — and then I stumbled across MC1269223. Looks harmless in the subject line. But for every EU admin who has Copilot running, this one has real impact.
From April 17, 2026, Microsoft enables Flex Routing for all EU and EFTA tenants by default. The name sounds like a minor technical thing. It is not. It is a fundamental decision about data sovereignty — and most admins have not looked at it yet.
The tricky part: Microsoft expects you to check the setting yourself and decide if it fits your organisation. If you don’t look, it is on. And then Copilot might be processing your prompts in the US, Canada, or Australia — without anyone actively agreeing to that.
What is Flex Routing anyway?
Flex Routing allows EU and EFTA customers to let LLM inferencing happen outside the EU Data Boundary when demand is too high during peak times — to keep the Copilot experience running smoothly.
Inferencing is the step where the large language model actually processes your prompt and generates a response. Before that happens, your prompt has already gone through preprocessing, safety checks, and RAG — meaning your company data, emails, files, metadata, and system prompts are already bundled together. When Flex Routing kicks in, this complete package gets processed outside the EU.
That is the point that matters from a compliance perspective. Not the data transport itself — but that in the moment of AI processing, the full context bundle can leave the EU. When Flex Routing is on, that can happen in the US, Canada, or Australia.
Microsoft’s commitment — what holds, what doesn’t
To be fair: Microsoft is transparent about this. There are real protections in place. Data is encrypted in transit and at rest, no matter where LLM inferencing happens. Data at rest stays inside the EU Data Boundary — except for limited pseudonymised data used for security and operational purposes.
So: your data is not moving permanently. It gets processed outside, the result comes back, the storage stays in the EU.
That no personal data is processed outside the EU in that moment. The regulatory question is not “is the data encrypted?” The question is: “Can you prove that no processing happened outside the EU during a specific period?” If Flex Routing is on and you have not checked it, the honest answer is: not easily.
The EU Data Boundary — the foundation
The EU Data Boundary makes sure that customer data is stored and processed within EU/EFTA regions. Flex Routing is a deliberate exception to that — built for capacity bottlenecks, switched on by default. For Germany, in-country processing for Copilot is announced for 2026. Until then, Flex Routing is the reality.
The hope: Bergheim, Bedburg, Elsdorf
On March 12, 2026, the groundbreaking ceremony for the Microsoft data centre cluster in the Rhenish mining region took place — under the motto “AI for Germany”. Where brown coal excavators shaped the region for decades, digital infrastructure is now being built.
The connection to Flex Routing is direct: Flex Routing is a pressure valve for capacity shortages. More EU capacity means fewer situations where Microsoft needs to fall back on it at all.
Microsoft has not communicated an official completion date. Hyperscale projects of this size typically take 2–4 years from groundbreaking to full operation — realistically that means earliest 2028. Until then, Flex Routing stays in the toolbox, and the admin toggle is the only control you have today.
What is actually happening in the background?
The data flow of a Copilot prompt
The Anthropic factor
At the same time there is MC1269241: Microsoft is enabling Anthropic models (Claude) for Copilot in Word, Excel, and PowerPoint. EU, EFTA, and UK tenants have this disabled by default — because Anthropic processing happens outside the EU Data Boundary.
Two default-on changes, both with compliance relevance, both landing in the same week. MC1269223 (Flex Routing) and MC1269241 (Anthropic models) need to be evaluated separately — don’t treat them as one thing.
How you step in as an admin
The two options, compared
| Setting | What happens | Who should use it |
|---|---|---|
| ON · Default Allow flex routing |
Inferencing can happen in US, Canada, or Australia during peak load. Better availability, but processing may leave the EU. | Only if GDPR/NIS2/DORA are not a factor — and you have documented that decision consciously. |
| OFF · Recommended Do not allow flex routing |
LLM inferencing always stays inside the EU Data Boundary. Possible trade-off: slightly higher latency in real peak situations. | Recommended for all regulated industries and anywhere GDPR compliance needs to be clean. |
Step by step: how to disable Flex Routing
admin.cloud.microsoft — you need the role AI Administrator or Global Administrator.admin.powerplatform.microsoft.com — the M365 setting is inherited unless a more restrictive one is already set there. To be safe: check both.Microsoft explicitly states that changes take up to one week to fully take effect. Don’t wait until April 16 — set it now.
Watch out for…
For financial services (DORA), critical infrastructure (NIS2), healthcare, and public sector, Flex Routing is not acceptable in most scenarios. Not because encryption is missing — but because you cannot prove that no processing happened outside the EU.
The Flex Routing setting is not available for customers who have Multi-Geo capabilities — even if the tenant is in an EU/EFTA country. Multi-Geo customers have different mechanisms for location control.
Whatever you choose — write it down. Date, who decided, legal basis. This is DPIA-relevant and exactly what auditors will ask for.
Practical check
How you know it is working
- Setting shows “Do not allow flex routing” with saved status
- Power Platform Admin Center is configured consistently
- Anthropic subprocessor setting has been consciously reviewed
- Decision is documented internally with date and reasoning
If it doesn’t work — check these 3 things
What sticks
Flex Routing is not a hidden attack on GDPR. It is a pragmatic capacity solution from Microsoft — communicated transparently, with real encryption, with a clear admin toggle. But: the toggle is on by default.
For many companies outside regulated industries that might be fine. For finance, healthcare, public sector, and critical infrastructure — this is not something you just let run without a decision.
The real problem is not the feature itself. It is the speed at which Microsoft rolls out these defaults — combined with the Message Center noise that most admins simply cannot go through every single day. The NRW data centres are the structural answer to that problem. But they come earliest in 2028.
Microsoft gives you the switch — but you have to go and flip it yourself. If you don’t, you haven’t made a conscious decision. You just said yes by doing nothing.
Checklist: Flex Routing & EU Compliance
- MC1269223 read and understood in the Message Center
- Flex Routing setting checked in the M365 Admin Center
- Decision (on/off) documented internally with reasoning
- Power Platform Admin Center checked for consistent setting
- Anthropic subprocessor setting (MC1269241) evaluated separately
- Legal and compliance team informed (GDPR, DORA, NIS2)
- Change applied at least 7 days before the deadline — so now
Have you already checked the setting? Drop me a message on LinkedIn — I am curious how many EU tenants still have this open.
