Microsoft recently enabled a default feature in M365 Copilot called flex routing.
At Infologo, an IT service provider based in Geneva and Lausanne, we manage the Microsoft 365 tenants of more than uhundred or so SMEs in French-speaking Switzerland. As soon as this development was documented, we decided: flex routing is deactivated by default for all our managed service customers.
What flex routing means in practice
Flex routing is a dynamic routing mechanism for Copilot prompts. When inference capacities are saturated in Europe, Microsoft can temporarily reroute the processing of these requests to datacenters outside the EU. The data itself is not moved or stored permanently outside the EU, but the processing may be.
This is the distinction that Microsoft puts forward to justify default activation. It is technically correct. But it’s not enough to settle the question of governance.
A Geneva law firm we’ve been working with for the past two years asked us at our last quarterly review: “My data stays in Europe, is that guaranteed?”
Our honest response, in the absence of action on our part, would have been:
“The data yes, the treatments, it depends.”
This is not an acceptable response for a customer who trusts his outsourcer.
Why should doing nothing be tantamount to accepting?
Microsoft has made a design choice: the option is active by default. In practical terms, any M365 Copilot tenant who has not explicitly disabled flex routing is subject to this potential non-EU routing.
It’s a governance choice disguised as a technical parameter. And in our context, to let this pass without communicating would be to leave our customers in a position they haven’t chosen, and which they probably wouldn’t have validated if they’d understood the implication.
On the tenants we audit regularly, almost all customers assumed that their AI processing remained in Europe. This assumption was correct yesterday. With flex routing enabled, it is no longer automatically correct.
Our decision for managed customers
Following internal discussion and alignment with our partners, the position is as follows: flex routing is disabled by default for all customers whose M365 tenant we manage .
This choice prioritizes the localization of processes over a possible gain in reactivity during periods of saturation. In practice, the difference in performance is imperceptible in the vast majority of cases. The compromise is therefore easy to accept.
Customers who prefer to activate flex routing, because they prefer Copilot availability at peak times and accept this routing compromise, can request it. The decision remains theirs. But it must be explicit and documented, not the result of inaction.
This protective posture by default, flexible on demand, is precisely what we expect from a responsible MSP. No lock-in, but no abdication either.
What this means for your organization
If you are using M365 Copilot outside a managed service, there is one action you need to take. Disabling flex routing is done at the tenant level, in the Microsoft 365 privacy settings. The option is called ” Allow data to be processed outside your region when there’s high utilization ” and is enabled by default.
Checking it takes less than ten minutes. Not to check it is to make a choice without having made it.
For SMEs subject to regulatory compliance requirements (financial, medical, legal sectors), or those with customers with contractual clauses on data localization, this parameter is not insignificant. An M365 configuration audit carried out by Infologo earlier this year revealed that several customers had retention policies that were inconsistent with their contractual commitments to their own customers. Flex routing is the same type of blind spot.
Our recommendations at Infologo
Disable flex routing now if you’re managing your tenant yourself. If you are accompanied by an MSP, ask him explicitly where he stands on this parameter and whether he has already configured it for you.
Our formal recommendation Any M365 Copilot tenant used by a French-speaking SME should haveflex routing deactivated by default, unless the customer decides to document otherwise.
It’s not a technical constraint, it’s a governance posture. And a posture is something you choose before you need it.
You’re using M365 Copilot and want to check your tenant’s configuration? Contact us for a no-obligation audit.
