"Transcription Off" in Teams Copilot Doesn't Mean "Nothing Is Kept": What Microsoft Purview Actually Retains

Published October 18, 2026

October 18, 2026 · 10 min read

Short answer: No, turning off transcription in a Microsoft Teams meeting does not stop Microsoft 365 Copilot from retaining data about that meeting. Microsoft's own documentation — reinforced by a September 2026 Purview roadmap push and an October 2026 analysis of its "Only during the meeting" setting — makes clear that Copilot prompts and responses from a meeting can still land in a user's Exchange mailbox, flow into Purview retention policies, and be surfaced later through eDiscovery. If your mental model was "transcription off = nothing kept," that model is wrong, and this article walks through exactly where the gap is and what an on-device alternative looks like.

What Microsoft Actually Documents About "Transcription Off"

The clearest statement of the problem comes directly from Microsoft's product documentation on using Copilot without transcribing or recording a Teams meeting. The support article is explicit: while a meeting transcript is not created when transcription is turned off, Copilot prompts and responses may still be retained in the Microsoft 365 compliance substrate and are subject to the organization's Microsoft Purview retention policies.

A detailed September 2026 analysis on Windows Forum drove the point home with a concrete slogan administrators should remember: "No saved transcript" does not necessarily mean "no retained AI interaction." The piece walks through each of the four organizer-level modes — Only during the meeting, During and after the meeting, Off, and the admin-forced saved transcript variants — and in every mode except the hard Off, Copilot prompts and responses live under a separate retention surface from the transcript itself.

The "Only during the meeting" trap door

According to the Windows Forum breakdown of the July 2026 "Meeting AI" toggle, when Meeting AI is used with transcription the two remain connected: turning on Meeting AI can turn on transcription and generate a recap, and starting transcription can enable Meeting AI and recap. If a meeting needs to avoid AI entirely, it is not enough to think about Copilot alone — the organizer has to think about transcription, recap, retention, licensing, and sensitivity labels simultaneously, and most meeting organizers do not.

Where the Prompts Actually Live

Copilot interactions are not stored in some ephemeral AI buffer. A mid-2026 technical write-up from LoopLabs on Copilot prompt retention confirms that Microsoft 365 Copilot interactions are retained in user mailboxes and searchable via eDiscovery when configured — specifically, user prompts and AI responses are stored as items in the user's Exchange mailbox as part of the Copilot interaction history.

Microsoft's own security blog on collecting Microsoft 365 Copilot data with Microsoft Purview eDiscovery publishes a retention reference table that enumerates exactly what gets captured where: Copilot prompts and responses fall under "Microsoft Copilot experiences," Copilot Pages live on SharePoint, and Facilitator meeting notes land in OneDrive. Deleting a prompt does not delete any downstream Copilot memory derived from it — memories must be removed separately.

How long can Purview retain this?

Indefinitely, if configured that way. A Microsoft Q&A thread on Purview retention for Copilot states that Purview retention policies can retain content for any chosen duration, including indefinitely, and that this same framework applies to Teams chats and Copilot interactions alike. There is no shorter maximum enforced by Copilot — it inherits the whole lifecycle-management stack.

What eDiscovery Can Actually Pull

Litigation hold is the second half of the story. A 2026 guide to Copilot audit logs and eDiscovery from Tygart Media explains that when a custodian is placed under hold, all of their Copilot interactions — prompts, responses, and referenced documents — are preserved regardless of retention policy settings. Audit records themselves default to 180 days, including on E5, with longer retention requiring an eligible custom policy.

A separate operational guide on auditing Microsoft 365 Copilot adds a nuance that matters for anyone imagining this is a theoretical concern: audit metadata and the actual prompt/response content are kept and deleted on different schedules. The audit event defaults to 180 days; the mailbox-backed prompt and response content follows separate retention and holds. Being someone's manager grants no access, but a properly scoped eDiscovery operator can retrieve the full text.

Where This Gets Worse: The September 2026 Purview Push

Microsoft is not treating this as a bug to hide. In fact, it is treating prompt retention as a feature to lean into. A Windows Forum summary of Microsoft 365 Roadmap ID 561209 reports that Purview began analyzing how employees use Copilot and recommending retention policies for the resulting prompts and responses, with preview in August 2026 and general availability in September 2026. The forward direction is more capture, not less.

That matters because a single Copilot prompt can contain customer details, source code, contract language, incident-response information, or a summary copied from a confidential meeting — and the generated response can introduce another record containing links, references, and synthesized business information. Each one is a new, discoverable business record that didn't exist before Copilot entered the room.

Comparison: What Each Teams Meeting Mode Actually Retains

The following table consolidates what Microsoft documents for each of the four Copilot meeting modes, and contrasts them with a fully on-device alternative.

Two caveats on the table. First, the "Off" admin tenant policy is not an absolute prohibition — the Windows Forum analysis notes that it is an organizer-changeable default, so individual meeting organizers can still re-enable Copilot. Second, Microsoft limits the "prompts retained even without a saved transcript" behavior to the Commercial cloud, excluding GCC and DoD environments, and meeting Copilot is unavailable in end-to-end encrypted Teams meetings.

Why the Mailbox-as-Storage Design Is a Legal-Exposure Multiplier

Treating Copilot interactions as mailbox items is elegant for compliance teams and dangerous for custodians. It means every prompt a user types into a meeting Copilot — including loose, under-caffeinated drafts that nobody would commit to writing in an email — becomes an email-class business record. A late-2026 practitioner guide on AI notetaker legal risk and discovery headaches (originally published in Corporate Compliance Insights) argues that the harder question for any organization that deploys an AI meeting assistant isn't the vendor's wiretap exposure, but the discovery exposure of the transcript on the organization's own side.

Add to that the August 13, 2026 ruling in In re Otter.AI Privacy Litigation, in which Judge Eumi K. Lee of the Northern District of California held that plaintiffs plausibly alleged Otter acts as a third-party eavesdropper and let the federal Wiretap Act, California Invasion of Privacy Act, and Illinois BIPA voiceprint claims proceed to discovery — and the practical calculus for cloud-based meeting AI shifts hard. Both the vendor and the deploying organization now have exposure, and the deploying organization also has to produce whatever Purview kept.

GDPR, Purpose Limitation, and the "Secondary Record" Problem

From a European-law angle, the fact that Copilot prompts outlive the transcript creates a classic purpose-limitation problem. Article 5 of the GDPR requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes, and that data be limited to what is necessary. If a meeting organizer tells participants "this meeting is not being transcribed" and the AI quietly retains prompts that reference participants by name, the processing purpose, retention, and lawful basis need to be re-justified for that secondary record — not inherited from the original meeting.

For comparison, review how the industry's largest cloud meeting-AI vendors describe their own data flows: Otter.ai's privacy policy and Zoom's privacy statement describe broad processing rights over audio and derived content. The Teams Copilot situation differs mainly in that the retention is yours to configure — but it is still a retention surface the user cannot see.

How Basil AI Solves This

The only architecture that reliably produces "zero vendor-cloud retention" is one where the audio never leaves the device. Basil AI is built on Apple's on-device speech frameworks, which means there is no equivalent of a Purview-retained prompt because there is no vendor server in the loop.

• No network call in the transcription path. As a technical walkthrough of Apple's SpeechAnalyzer API explains, SpeechAnalyzer and its SpeechTranscriber module run entirely on the device using a new Apple speech model that the system downloads and manages — there is no network call anywhere in the transcription path. The framework ships across iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26 and Mac Catalyst 26.
• Long-form, meeting-grade transcription. SpeechAnalyzer is explicitly designed for long-form audio — lectures, meetings, and multi-speaker conversations — with a new proprietary Apple model that one developer analysis of SpeechAnalyzer vs SFSpeechRecognizer reports is roughly 2× faster than Whisper Large V3 Turbo on equivalent transcription tasks, running fully on device.
• Explicit on-device flag on the older framework too. For devices still on the legacy stack, Apple's requiresOnDeviceRecognition property on SFSpeechRecognitionRequest prevents a recognition request from sending audio over the network. Basil AI uses the on-device path by default.

The result: no Purview mailbox entry, no eDiscovery pull, no vendor-held audio, no secondary "AI prompt" record outliving the meeting. For related architectural context, see our deep dive on Microsoft Copilot meeting recorder enterprise privacy concerns, our breakdown of what data Microsoft Teams AI Recap collects, and our explainer on what a bot-free meeting recorder actually is in 2026. If you are a buyer of regulated-industry AI tools, our checklist on what "compliant AI meeting notes" actually means covers the vendor questions to ask before you deploy.

What Admins Should Actually Check This Quarter

Four concrete audits that follow directly from the above:

1. Pull your current Purview retention policies and confirm whether they cover the Microsoft Copilot experiences scope — not just Teams chats.
2. Check which Copilot audit retention tier you actually have. The default is 180 days even on E5; longer retention requires an eligible custom audit policy.
3. Confirm which cloud you're in. The "prompts retained without saved transcript" documentation is scoped to Commercial cloud only — GCC and DoD behave differently and meeting Copilot is unavailable in end-to-end encrypted Teams meetings.
4. Decide, as a policy matter, whether "transcription off" meetings should still permit Copilot at all. Microsoft's admin "Off" setting is an organizer-changeable default, so if you want a hard prohibition you need meeting-template-level enforcement, not just a tenant toggle.

Bottom Line

If your compliance narrative is "we told them to turn off transcription, so nothing was kept," that narrative is incomplete and — in the Commercial cloud — likely wrong. Microsoft itself documents that Copilot prompts and responses from a meeting may be retained in the user's Exchange mailbox under Purview policies, surfaced through eDiscovery, and preserved under legal hold, independent of whether a transcript was ever saved. The architectural fix is to move private meetings off the vendor-cloud substrate entirely — which is the design choice Basil AI makes by running transcription on Apple's on-device speech stack with no network call in the path.

Get Basil AI — on-device meeting notes with zero vendor cloud

8-hour continuous recording, real-time on-device transcription on Apple's Speech frameworks, Apple Notes integration, and voice command activation. No cloud. No prompts retained in anyone else's mailbox.