Can you sell your Microsoft 365 data for AI training?
Microsoft 365's terms let the account holder export its own data, and its API terms bar copying or reselling data pulled through the API, so a sale should start from the holder's own export. The content itself carries medium rights risk. This is research from public sources, not legal advice.
- The holder's own export
- The holder can export it
- Data pulled through its API
- Bars copying or reselling it
- Rights risk of the content
- Medium
What a holder should know
The customer's ownership and extraction right are strong, so the blocker is not Microsoft's contract but what is inside the mailboxes and chats (third-party and employee personal data, counterparties' confidential material). The API terms restrict a third-party app (for example a broker connector) from building a copy of the data beyond its intended scenario and from reselling data obtained through the API. The May 2026 Product Terms clause targets bot or RPA outputs of the Office apps used for AI training; it does not on its face bar a customer from licensing its own documents. Prefer customer-run eDiscovery or admin export over a third-party Graph app.
Getting your own data out
Customer can extract Customer Data during the subscription and for 90 days after it ends (DPA). Bulk mailbox and Teams chat export for an organisation is usually done through Microsoft Purview eDiscovery; Microsoft Learn says premium eDiscovery features require Office 365 E5 or Microsoft 365 E5 (or E5 add-ons); a vendor guide says standard eDiscovery content search and export is in E3 and above (not verified against Microsoft licensing docs). Teams export APIs were protected and metered; Microsoft says they are no longer metered as of 25 August 2025.
Microsoft Products and Services DPA (May 2026): "As between the parties, Customer retains all right, title and interest in and to Customer Data and Professional Services Data." "At all times during the term of Customer's subscription ... Customer will have the ability to access, extract and delete Customer Data stored in each Online Service". Data is retained "in a limited function account for 90 days after expiration or termination of Customer's subscription so that Customer may extract the data."
Apps that use its API
Microsoft APIs Terms of Use (Last Updated October 2025, covers Microsoft Graph, Teams, Exchange, SharePoint, OneDrive APIs): you may NOT "Scrape, build databases or otherwise create copies of any data accessed or obtained using the Microsoft APIs, except as necessary to enable an intended usage scenario for your Application" and may not "Redistribute or resell, or sublicense access to, the Microsoft APIs, any data obtained using the Microsoft APIs". Email protocols and APIs may only be used for "syncing" or "backing up" mail, calendar and contacts unless customers expressly grant other permissions. Product Terms change (1 May 2026, Office and Microsoft 365 Applications): "outputs generated through Robotic Process Automation, bots, or other similar technologies may not be used to develop, train, evaluate, improve AI or machine learning models, or to replicate product functionality."
The sources, word for word
- Microsoft Products and Services Data Protection Addendum (Word document, last updated May 22, 2026)(2026-05-22)
“As between the parties, Customer retains all right, title and interest in and to Customer Data and Professional Services Data.”
- Terms of Use: Microsoft APIs(Last Updated October 2025)
“Redistribute or resell, or sublicense access to, the Microsoft APIs, any data obtained using the Microsoft APIs, or any other Microsoft Offering accessed through the Microsoft APIs”
- Microsoft Product Terms: changes (Office and Microsoft 365 Applications)(2026-05-01)
“outputs generated through Robotic Process Automation, bots, or other similar technologies may not be used to develop, train, evaluate, improve AI or machine learning models, or to replicate product functionality.”
- Microsoft Learn: Metered APIs and services in Microsoft Graph(read 2026-10-16 (change dated 2025-08-25))
“Starting August 25, 2025, the Teams APIs are no longer metered, and no billing configuration is required to use these APIs.”
Research from public sources, read on the day shown. It is not legal advice: a sale needs a lawyer who has read the records and the contracts.
What Microsoft 365 holds that buyers ask for
Procedures and playbooks
SOPs, runbooks, work instructions, checklists, internal training material
Technical documentation
Design documents, specifications, wikis, knowledge bases, architecture notes
Internal communications
Email, Slack or Teams history
Who buys it
- Mode (BizBuyData)
"The operating history of companies and nonprofits could be worth $100K-$5M."
- Handshake AI
"Payouts range from $100K to $4M." Its estimator shows $383,083 to $896,969 for 100 employees and 10 years.
- Polyshares
Typical licences of $100K to $2M, sometimes more. Its track record page lists four anonymous licences from $110,000 to $450,000.
- micro1
$100k+ for a qualified partnership, $500k+ for large or multi-team datasets, $1M+ for highly unique data.
- Scale AI
"$10K–$1M+ illustrative value per data partnership", scaling with how often data is delivered.
- SuperAnnotate
"Indicative $100K – $1M+", priced on rarity, depth and exclusivity.
What your Microsoft 365 records are worth, and what to settle before anyone sees them.
In this topic
Rights and law
- Start hereCan this data legally be sold or licensed for AI training?Privacy law, copyright and fair use, software vendors' terms, de-identification, bankruptcy sales and what a licence agreement holds.
- GuideIs It Legal to Sell Customer Data? A US Guide for AI TrainingOften yes, but through layers: your privacy policy, the FTC Act, state and sector laws, and customer contracts. De-identified records are the main lawful path.
- GuideFair Use and AI Training: What US Courts Have RuledUS courts are split: training was fair use in Bartz v. Anthropic and Kadrey v. Meta, not in Thomson Reuters v. Ross, and pirated copies lost. Where each stands.
- GuideIs It Legal to Scrape Data for AI Training? (US Law, 2026)Scraping public pages is rarely a federal crime after Van Buren and hiQ, but contract, copyright, anti-circumvention and privacy law apply. Resale is hard.
- GuideCan a Company License Employee Emails and Slack for AI Training?Usually yes for business records the company controls, but only after it handles monitoring notices, third parties in the messages, privilege and vendor terms.
- GuideSelling Customer Data in Bankruptcy: Section 363 ExplainedA bankrupt company can sell customer data only if the sale fits its privacy policy, or a court-appointed privacy ombudsman reports and the judge approves it.
- GuideWhat Is a Data Licensing Agreement? The Terms for AI TrainingA data licensing agreement lets a buyer use data for set purposes while the holder keeps ownership. Each clause AI buyers ask for, and where holders stand.
- GuideHIPAA De-Identification for AI Training: Safe Harbor vs Expert DeterminationHealth data leaves HIPAA only through Safe Harbor (remove 18 identifiers) or an expert's determination of very small risk. How each works for AI training.
- GuideLicensing Company Data for AI Training Under the GDPR (2026)Yes, an EU, UK or Swiss company can license its records for AI training, if it has a lawful basis, tells people, drops sensitive data and uses a transfer tool.
- GuideSelling Data for AI Training: Privacy Law by CountryOutside the EU and UK, licensing records for AI training mostly needs consent or anonymisation, and a contract or consent to send them to a US buyer.
- RegisterLawsuits and rulingsEvery case, ruling and settlement over training data.
- RegisterLicence termsWhat buyers ask for in a licence, and where holders stand.
- PageDe-identification standardOur rules for removing people from records, each with its source.
- RegisterAI crawler censusA daily census of robots.txt across the most visited sites.