A number of Microsoft Teams users have reacted with fury to the news that a key enterprise feature is being discontinued with just a few weeks notice.

Office 365 connectors within Teams is being retired for good in October 2025, the company confirmed in a blog post – although there did not appear to be much clarity as to why.

But the news has been met with bafflement from admins across the world, with businesses of all sizes apparently pretty reliant on the tool for effective messaging across the video conferencing platform at their company.

A lengthy investigation into the European Union’s use of Microsoft 365 has found the Commission breached the bloc’s data protection rules through its use of the cloud-based productivity software.

Announcing its decision in a press release yesterday, the European Data Protection Supervisor (EDPS) said the Commission infringed “several key data protection rules when using Microsoft 365”.

“The Commission did not sufficiently specify what types of personal data are to be collected and for which explicit and specified purposes when using Microsoft 365,” the data supervisor, Wojciech Wiewiórowski, wrote, adding: “The Commission’s infringements as data controller also relate to data processing, including transfers of personal data, carried out on its behalf.”

The EDPS has imposed corrective measures requiring the Commission to address the compliance problems it has identified by December 9 2024, assuming it continues to use Microsoft’s cloud suite.

Microsoft and the Commission were contacted for a response to the EDPS’ findings. But at the time of writing neither had responded.

The regulator, which oversees’ EU institutions’ compliance with data protection rules, opened a probe of the Commission’s use of Microsoft 365 and other U.S. cloud services back in May 2021.

At issue is how Microsoft processes the data of users of its cloud service. EU regulators have been flagging concerns about this for years, including in relation to the legal basis Microsoft claims for processing data; a lack of clarity and precision in the wording of its contracts for the product; and no technical safeguards being applied to ensure data is only being used for providing and maintaining the service.

When the EDPS opened the investigation there was also no data transfer agreement in place between the bloc and the U.S., following the striking down of the EU-U.S. Privacy Shield in July 2020.

A new transatlantic data transfer agreement was subsequently agreed and adopted, thee years later (July 2023). But for much of the period the EDPS was investigating the Commission’s use of Microsoft 365 there was no deal in place covering data transfers from the EU to the U.S. Yet use of Microsoft 365 routinely results in data flowing back to Microsoft’s servers in the U.S.

On data transfers, the EDPS found the Commission failed to ensure adequate safeguards were applied to these data exports to ensure essentially equivalent protections for data were in place once it left the bloc.

The data supervisor has ordered the Commission to suspend all data flows resulting from its use of Microsoft 365 to Microsoft and its affiliates and sub-processors located in countries outside the EU/EEA not covered by an EU adequacy decision on data transfers — again, with a deadline of December 9 for this.

It has also been ordered to carry out a data transfer-mapping exercise — identifying “what personal data are transferred to which recipients in which third countries, for which purposes and subject to which safeguards, including an onward transfers”. It must also ensure all transfers to non-EU countries without an adequacy decision take place “solely to allow tasks within the competence of the controller to be carried out”.

More broadly, the EDPS’ corrective measures require the Commission to fix its contracts with Microsoft — to ensure they contain the necessary contractual provisions, organizational measures and/or technical measures to ensure personal data is only collected for explicit and specified purposes; and “sufficiently determined” in relation to the purposes for which they are processed.

Data must also only be processed by Microsoft or its affiliates or sub-processors “on the Commission’s documented instructions”, per the order — unless it takes place within the region and processing is for a purpose that complies with EU or Member State law; or, if outside the region to be processed for another purpose under third-country law there must be essentially equivalent protection applied.

The contracts must also ensure there is no further processing of data — i.e. uses beyond the original purpose for which data is collected.

The EDPS found the Commission infringed the “purpose limitation” principle of applicable data protection rules by failing to sufficiently determine the types of personal data collected under the licensing agreement it concluded with Microsoft Ireland, meaning it was unable to ensure these were specific and explicit.

The EU also failed to provide sufficiently clear documented instructions to Microsoft regarding the processing; failed to ensure its processing was limited by instruction; and failed to assess the compliance of Microsoft’s further processing with the purpose initially stated for the collection, among other violations of the rules the EDPS identified.

Commenting in a statement, Wiewiórowski wrote:

Copilot for Microsoft 365 still demands a steep entry price for now, but it feels like the type of launch we were originally expecting. The November launch was more like a preorder event, as most businesses couldn’t get it right way and only the biggest enterprise users could get Copilot access.

Microsoft is promising that Copilot inside Office apps will change the way documents are created and edited. The Copilot, powered by GPT-4 from OpenAI, will sit alongside Microsoft 365 apps much like an assistant, appearing in a sidebar as a chatbot. It will also be available to summon inline, allowing users to generate text in documents, create PowerPoint presentations based on Word documents, or even help use features like PivotTables in Excel.