Microsoft 365 data residency in Australia: where your data lives
"Is our data in Australia?" is a fair question, and it comes up more often in security questionnaires than it used to. For Microsoft 365 the answer is usually yes for the core services, but it's worth understanding why, and what the commitment does and doesn't cover.
The sign-up country decides the default
When a Microsoft 365 tenant is created, someone picks a country or region. That choice sets the tenant's default geography: where Microsoft stores the data for its core services at rest. A tenant created with Australia as its country uses Microsoft's Australian geography by default.
This is easy to get wrong without noticing. A tenant set up years ago by a reseller overseas, or with a placeholder address, may have a different default geography. Moving it later is not a simple setting.
What Microsoft commits to
Microsoft makes contractual commitments about the location of customer data at rest in its Product Terms. For tenants provisioned in Australia, those commitments cover the core services most businesses rely on. For example, Microsoft states that Exchange Online mailbox content (email bodies, calendar entries and attachments) is stored at rest only within that geography.
Two points to keep in mind:
- the commitments apply to data at rest for the services listed; not every Microsoft 365 feature or add-on is covered in the same way;
- broader questions about how Microsoft handles, secures and accesses data are answered in its Trust Center, not in the residency commitments.
Advanced Data Residency and Multi-Geo
For organisations that need more, Microsoft offers two paid add-ons:
- Advanced Data Residency extends the commitments to more services in eligible "local region" geographies. Australia is one of them. It requires the add-on for all users in the tenant.
- Multi-Geo lets a multinational assign the data location for Exchange, SharePoint, OneDrive and Teams per user or site across supported geographies.
Most Australian businesses of 30 to 150 people don't need either. They're relevant when a contract, regulator or government client requires specific commitments, and it's worth reading the exact wording before buying.
How to check your own tenant
A global administrator can see where committed data is stored in the Microsoft 365 admin centre: Settings > Org settings > Organization profile > Data location. The page lists each core service and its location.
Check it once and write the answer down. Next time a questionnaire asks, you'll have it.
Residency isn't the whole story
Where data sits is only one part of protecting it. In Australia, the Privacy Act's Notifiable Data Breaches scheme requires organisations covered by the Act to notify affected individuals and the OAIC when a data breach is likely to result in serious harm. Strong sign-in controls, managed devices and backups do more to prevent that than the location of a datacentre.
Backups matter here too. A copy of your Microsoft 365 data held outside the tenant protects you if an account is compromised or something is deleted. When choosing a backup service, ask where it stores your data as well.
How we handle it
We check the tenant's default geography during our read-only assessment, record it in the client's register and keep an independent Microsoft 365 backup outside the tenant. See cyber security services or managed IT in Melbourne.
Sources
Checked October 2026.