MIIP Copilot applications - FAQ

New products and/or services launched by Microsoft after the conclusion of the 2022-2026 consortium agreement do not have fixed discounts and/or prices. As soon as we jointly wish to purchase a volume of interest to Microsoft, we will enter into discussions with Microsoft about this and assess what we can do for participants in the SURF consortium agreement.

SURF procurement and contracting has intensive contact with Microsoft Netherlands, EMEA and Microsoft Corporate Headquarters. SURF is the interlocutor for Microsoft and represents the interests of all participants in the Microsoft SURF consortium agreement. Microsoft Corporate marketing strategy may follow the path of adding the new products and services directly to the monthly Microsoft price list available to Microsoft partners.

Are new products and/or services coming to market? If so, we have the following options:

short notice

• take notice and take action as soon as relevant
• discuss directly with Microsoft to explore whether adjustments to the product, price and/or licence conditions are possible
• inform institutions about this as fully as possible

longer term

• determine whether the current contract terms are still adequate and applicable
• investigate possible privacy risks when taking software into use
• keep providing institutions with up-to-date information

SURF has organised several webinars and presentations over the past year on the introduction of Microsoft AI services, which can enrich practically all products in Microsoft's offering. From our joint innovation and inspiration programme MIIP, enthusiasm about the possibilities has been shared with those interested.

• Webinar M365 Roadmap (Copilot introduction) - April 2023
• Webinar Fabric - September 2023
• MIIP Day - M365 Copilot/Fabric/AzureOpenAI/ - September 2023
• M365 Copilot demos at SURF Education Days - November 2023
• Webinar Fabric, part 2 - January 2024

Watch recordings of MIIP events? Check out theMy SURFmarket > Customer Service > Services > MIIP page (behind login).

Are these Microsoft's own AI services available for purchase within the SURF consortium agreement? If so, they also fall under the privacy terms of the SURF consortium agreement. SURF has been assisted by external lawyers, who have confirmed this conclusion.

The following AI services are not covered by the privacy terms associated with the SURF consortium agreement:

• Third-party AI services available through Microsoft Azure, via the Azure marketplace
• Free/paid/beta AI services from Microsoft that are not available through the SURF consortium agreement, for example:
  • Microsoft Copilot (formerly Bing Chat)
  • Microsoft Copilot with commercial data protection (formerly Bing Chat Enterprise)
  • future AI additions in Office 365 A1

For now, we have only done an analysis on the contractual and legal terms. No check on privacy risks has yet taken place. An inventory is being made within the SURF Vendor Compliance service as to which processes we will pick up next year at the request of the institutions. Microsoft 365 Copilot is on the wish list of the SURF Vendor Compliance service. Whether and when we pick it up depends on the other requests submitted. Decision-making of the final 2024 list will follow.

For more information on the above three questions, read our message of Thursday 23 November 2023 Microsoft AI services, privacy terms SURF consortium agreement.pdf.

For more information from Microsoft on Microsoft 365 Copilot, read the following web pages:

• Expanding Microsoft Copilot access in education | Microsoft EDU
• Frequently asked questions about Copilot | Microsoft Learn
• Microsoft Graph Data Connect FAQ - Microsoft Graph | Microsoft Learn
• Copilot Privacy and Protections | Microsoft Learn
• Manage Copilot | Microsoft Learn

SURF has made separate agreements with Microsoft that go beyond Microsoft's standard privacy terms. Microsoft's privacy terms are called DPA (Data Protection Addendum). Are there agreements better regulated in the DPA than in the agreements made with SURF? Then those agreements automatically apply to the members of SURF.

No:

• Data Protection Addendum (DPA): contains agreements on where data is stored.
• Data Protection Impact Assessment (DPIA): zooms in on the processing of personal data, is a tool to understand this and determine what measures need to be taken.

Before use, consider the following questions:

• Does your institution have the right insights and information to be able to deploy it according to your institution's guidelines?
• Are ICT administrators and online managers able to oversee the appropriate impact and take appropriate action?

For example: do you turn off Microsoft Search in Bing? Then this does not automatically turn off Copilot or commercial data protection as well. Do you want to turn off Copilot or commercial data protection? Follow the steps as described in the webpage Manage Copilot | Microsoft Learn.

No, SURF privacy agreements require company data to remain at tenant level within the geographical region and/or stated boundaries. Copilot uses data centres worldwide, including in the US. In addition, SURF has not yet conducted a technical investigation (Data Protection Impact Assessment | DPIA) on Copilot solutions. As a result, we cannot determine with certainty how data is handled by Microsoft and whether additional agreements are necessary.

Copilot uses data from the internet to provide answers, Copilot for Microsoft 365 uses data from your own tenant. Note that there are two variants of Copilot, for the differences see the table under the question "Is there a list of available AI services?".

Not yet. Initially, only the English language will be supported. Meanwhile, support in the Dutch language has been announced. No date has however been announced yet.

Follow these two steps:

1. Make sure you understand all licence groups where 'Microsoft 365 A3/A5 for faculty and students subscriptions' have been assigned.
   
   Note that it happens that users appear in different licence groups.
2. In the relevant licence groups, set Commercial data protection for Microsoft Copilot to 'Off'.

AI in Education | SURF Communities 
Various activities and articles on this topic can be followed publicly.

Services | My SURFmarket (after login) 
Your institution can use the My SURFmarket portal to view all the products and services on offer. Here you can also indicate your wishes regarding new supply to be added in due course.

Turning off Copilot Bing | (slmmicrosoftrijk.nl)

Memo advising on using the (free) Microsoft Copilot service.