Data handling of search queries sent to the Microsoft Learn Docs MCP Server (retention, model training, processing region)

[yoinuma]

Summary

We are evaluating the Microsoft Learn Docs MCP Server for use from Microsoft Copilot Studio, via the published connector: https://learn.microsoft.com/en-us/connectors/microsoftlearndocsmcpserver/(新しいウィンドウで開きます)

Based on the overview documentation (https://learn.microsoft.com/en-us/training/support/mcp(新しいウィンドウで開きます)), we understand that the Microsoft Learn Docs MCP Server is offered as a public, unauthenticated Microsoft endpoint. Our understanding is therefore that when it is called from Copilot Studio, the end user's search queries do not stay within the customer's Power Platform tenant boundary, but are sent to the learn.microsoft.com service.

Because those queries may contain confidential or customer-identifiable information, we need to confirm how the query data is handled before approving production use. We reviewed the public documentation but could not find details on the points below. We also raised a Microsoft support request and support advised us that questions about the MCP server's behavior should be asked here.

Questions

Retention — Are the search queries sent to the MCP server stored or logged? If so, where are they stored (service/region), what is the retention period, and is any customer or tenant identifier stored alongside them?
Model training — Are the submitted queries used for training or fine-tuning any AI/ML models, or for any other secondary purpose? The docs state that the service covers public documentation and does not include training information or user profile information, but we could not find an explicit statement that submitted queries are not used for model training.
Processing region and isolation — In which region(s) is the query data processed? Is there any logical isolation between callers/tenants? Does the service fall under the Microsoft Products and Services Data Protection Addendum (DPA), and is it in scope for the EU Data Boundary?
Additional context

Client: Microsoft Copilot Studio (MCP tool connection)
Endpoint: Microsoft Learn Docs MCP Server (public endpoint, no authentication)
What we are looking for: a public documentation reference we can share with our customer's security/compliance reviewers, or an authoritative statement in this thread.
If any of the above is already documented somewhere we missed, a pointer to that document would be much appreciated. Thank you.

[Alex Wu (alexuvlab)]

Thanks for sharing this. I’m exploring MCP workflows as well, and it’s interesting to see how different servers handle updates and compatibility.

[yoinuma]

Pieter de Bruin (@pdebruin) Tianqi Zhang (@TianqiZhang) — gentle follow-up on this one, as it''s still unanswered after ~3 weeks.

This is blocking a production go/no-go decision for a customer, since their security and compliance reviewers need a citable statement on how queries sent to the public Learn Docs MCP endpoint are handled.

To make it easier to answer, here is the minimum we need — even short yes/no answers with a doc pointer would unblock us:

1. Retention — Are query strings logged/stored? If yes: which service/region, what retention period, and is any caller identifier stored alongside them?
2. Model training — Confirmation (yes/no) that submitted queries are not used to train or fine-tune any model, or for other secondary purposes.
3. Coverage — Is this endpoint covered by the Microsoft Products and Services Data Protection Addendum (DPA), and is it in scope for the EU Data Boundary?

If the right place for this is a different team or channel (e.g. the Learn platform team or an official privacy statement request), could you please point me there? Happy to move the question.

Thanks!

[Pieter de Bruin (pdebruin)]

Hi yoinuma, I was out and missed this. Here is what I can share on each point.

1. Retention: We store a summary of the query for intent analysis, to understand what content users need.
2. Model training: Submitted queries are not used for training or fine-tuning AI/ML models.
3. EU Data Boundary: We do not have a dedicated EU Data Boundary deployment today, but it is on the roadmap.

One nuance on how queries reach the Learn MCP Server in practice: the server is consumed by agents that include a language model. For example, when a user enters a prompt in GitHub Copilot, the agent/LLM interprets that prompt, extracts the relevant question, and sends that derived query to the Learn MCP Server. The server returns up to 10 content chunks, which the agent uses to ground its answer back to the user. So the query that reaches the Learn MCP endpoint is not the user's raw prompt; it is a reformulated search query shaped by the calling agent.

https://devblogs.microsoft.com/engineering-at-microsoft/how-we-built-the-microsoft-learn-mcp-server/
https://devblogs.microsoft.com/engineering-at-microsoft/how-we-built-ask-learn-the-rag-based-knowledge-service/

cc Eric Imasogie (@Eimasogi) Osmond Jiang (@OsmondJiang)