Microsoft Enterprise AI Services Code of Conduct 2026-05-01

Citation

Microsoft. “Microsoft Enterprise AI Services Code of Conduct.” Microsoft Learn legal page, version 4.0, 2026-05-01. https://learn.microsoft.com/en-us/legal/ai-code-of-conduct. Read 2026-10-15.

The Code of Conduct sets the prohibited uses for all Microsoft AI Services, including Azure OpenAI. It replaces the earlier Microsoft Generative AI Services Code of Conduct.
It has 21 usage restrictions. Many follow the EU AI Act: social scoring, emotion inference, biometric categorization and facial recognition for United States police.
It has a “Limited exception” for safety testing and red teaming. “High-Risk Content” (malicious cyber activity and CBRN weapons) needs “prior approval by Microsoft”.

For Azure, Microsoft states its AI hard limits in this Code of Conduct.

The Document history says version 4.0, of 5/1/2026, “Added new section on High-Risk Content and revised limited exception section”.

“Usage restrictions”. Customers “must NOT use the services”:

“To make decisions or take actions without appropriate human oversight as part of an application that may have a consequential impact on any individual’s legal position, financial position, life opportunities, employment opportunities, or human rights”. (Item 5)
“For social scoring or predictive profiling that would lead to discriminatory, unfair, biased, detrimental, unfavorable, or harmful treatment of certain persons or groups of persons.” (Item 8)
“For ongoing surveillance or real-time or near real-time identification or persistent tracking of the individual using any of their personal data, including biometric data, without the individual’s valid consent.” (Item 17)
“For facial recognition purposes (including identification or verification of individual identities) by or for a state or local police department in the United States.” (Item 18)
“To impersonate any person without explicit and valid consent, including to gain information or privileges, or to simulate the voice or image of politicians or government officials, even with their consent.” (Item 21)

“Responsible AI requirements”:

Applications must be “subject to appropriate human oversight so customers can find and mitigate undesirable behaviors.” (Item 5)
Customers must “Disclose when the output, decisions, or actions are generated by AI”. (Item 3)

“Content requirements”:

“Child sexual exploitation and abuse”: “Microsoft prohibits content that describes, features, or promotes child sexual exploitation or abuse, whether or not prohibited by law.”
“Terrorism and violent extremism”: “Microsoft prohibits content that depicts an act of terrorism; praises, or supports a terrorist organization”.
“Hate speech, harassment and discrimination”: the Code prohibits content that “attacks, denigrates, threatens, intimidates, degrades, insults, targets, or excludes individuals or groups”.
“Deception, disinformation, and inauthentic activity”: “Microsoft prohibits content that is intentionally deceptive and likely to adversely affect the public interest, including deceptive or untrue content relating to health, safety, election integrity, or civic participation.”
“High-Risk Content”: “Safeguards for these content categories are mandatory for all customers”.
“Malicious cyber activity”: “Microsoft prohibits content that supports the creation or deployment of malicious cyber activity.”
“Chemical, biological, radiological, and nuclear (“CBRN”) weapons”: “Microsoft prohibits content that supports the use, creation, release or deployment of CBRN weapons”.

“Limited exception”:

Customers may generate otherwise prohibited content “solely (1) to evaluate, train, fine-tune, and improve safety systems”. This includes “AI evaluation, red teaming, or similar services”.
“prior to a customer intentionally generating or attempting to generate High-Risk Content, the customer must obtain prior approval by Microsoft through the applicable Limited Access Service program.”

“Limited access services”:

“Limited Access Services require registration and are only available to approved customers and partners.”

“Autonomous AI Systems”:

Customers must “Ensure adequate human user controls to monitor such system’s decisions and actions, detect anomalies, and intervene when appropriate”.

“Report abuse” (enforcement):

“Customers deemed by Microsoft to have violated the Code of Conduct or the Microsoft Product Terms may lose access to the Online Service, at Microsoft’s sole discretion.”

This is a policy document, not research. It states rules. It gives no data on how often Microsoft enforces them.

The Code does not name critical infrastructure.
The Code does not name political campaigning. It covers “election integrity” under deception, and the impersonation of politicians.
The general Azure Acceptable Use Policy is in the Microsoft Product Terms. It is a Source Lead.
The Code does not say how Microsoft monitors use, other than the abuse report portal and “abuse monitoring”.

Source file: wiki/sources/Microsoft Enterprise AI Services Code of Conduct 2026-05-01.md, updated 2026-10-15.