This is a side-by-side comparison of Claude, ChatGPT, Microsoft 365 Copilot, Gemini and Perplexity as business platforms. It covers what each one costs once the licensing fine print is included, how it reaches Microsoft 365 and other business systems, which security and compliance controls exist at which tier, how ready each is for MCP and agent write actions, and where each one tends to fail. Every cell carries the sources it rests on.
I use this matrix in vCIO work, where the same document has to serve the owner deciding what to buy and the IT lead who will have to deploy and govern it. That is why it is ordered the way it is. The first sections answer what each platform is and what it costs, the middle sections cover Microsoft 365 integration and connectors, and the later ones move into compliance scope, MCP, failure modes and rollout effort. A reader can stop wherever the detail stops being useful to them.
Evidence checked . Rebuilt 2026-10-07 17:58 UTC.
- 5Platforms compared
- 87Comparison rows
- 178Sources cited165 vendor-official
- 59Changes from the April 2026 working draft
Downloads
The Excel workbook is the fullest version and the one to open if you are making a decision with it. It carries the matrix, a pricing calculator where you set your own seat count, the full change log and every source with the date it was checked. The JSON holds the same data in one document for anyone who wants to automate against it.
How to read it
Each capability cell opens with a mark that summarises it, followed by the claim itself. Rely on the claim and its sources, which resolve to the full list at the foot of the page.
- Yes: Supported or strong
- Partly: Partial, conditional or worth verifying
- No: Not available or high risk
Two cautions apply to almost every row. Facts here are scoped to a plan: business and enterprise tiers of the same product differ in identity controls, logging, retention and residency, so a feature listed for one tier should not be assumed for another. And prices are public US list prices before tax, reseller discounts and promotions. They are a starting point for a quote, which is why the workbook calculator exists.
What each platform is and what it costs
Start here if you are deciding whether a platform belongs on the shortlist at all. The identity rows describe positioning, context limits and the agent products each vendor ships, and the pricing rows show the compared business tier for each platform at the default seat count.
1 · Core Product Identity & Positioning Business overview
| Dimension | Claude | ChatGPT | M365 Copilot | Gemini (Workspace) | Perplexity | Sources |
|---|---|---|---|---|---|---|
| Vendor / model family | Anthropic · Fable 5.1, Opus 5.5, Sonnet 5.5, Haiku 4.5 | OpenAI · GPT-5.6 and GPT-6 families (GPT-4o retired Feb 2026) | Microsoft · auto-routes between OpenAI GPT and Anthropic Claude models | Google · Gemini 3.x models in Fast, Thinking and Pro modes | Perplexity · multi-model: Sonar, GPT, Claude, Gemini, Grok and others | C13 · OA03 OA35 · MS03 MS11 · G03 G37 · PPLX18 |
| Primary positioning | Reasoning, long-doc analysis, coding, safety-first | Broadest general-purpose feature set; most familiar to users | AI in the flow of M365 work: embedded, Graph-grounded | AI built into Google Workspace; best fit for GW orgs | Real-time web research with citations, plus a task agent (Computer) | C13 · OA01 · MS03 · G02 · PPLX06 |
| Context window | 1M tokens on current Fable / Opus / Sonnet (paid plans) | Business: 54K fast / 256K reasoning. Enterprise: 128K / 256K | Not published; varies by model and app | 1M (Business Standard/ | Varies by selected model | C04 · OA27 · MS03 · G03 · PPLX18 |
| Core strengths | Document Q&A, coding, contract review, long-form reasoning; creates Word, Excel, PPT and PDF files | Text, image, voice, code and agents in one app; Office add-ins | Teams/ | Multimodal; Gemini Notebook (formerly NotebookLM); included in Workspace at no extra cost | Citations, source-grounded answers, several models in one seat | C27 · OA01 OA22 · MS03 · G02 G04 G29 · PPLX02 |
| Known weaknesses | No image generation; most admin and compliance controls require Enterprise | Business lacks SCIM and compliance logs; residency still rolling out; fast product churn | Exposes existing oversharing; needs SharePoint cleanup; ROI hard to prove | Frequent renames; Microsoft 365 data needs a separate product (Gemini Enterprise) | Copyright litigation exposure; no residency choice, customer keys or legal hold | C01 C13 · OA14 OA19 OA27 · MS15 · G20 G29 · PPLX03 PPLX23 |
| Agentic / extended product | Cowork (desktop and cloud tasks) and Claude Code, included in Team | ChatGPT Work (agent) and Codex, included in Business | Copilot Studio agents; Cowork (GA Jun 2026); Agent 365 governance ($15/user) | Gemini Enterprise (formerly Agentspace) for cross-system agents; Workspace Studio flows | Computer agent, Comet browser, Agent API (billed separately) | C02 C08 · OA01 · MS16 MS26 MS28 · G20 G28 · PPLX01 PPLX06 |
| Best-fit org profile | Document-heavy and technical teams; regulated orgs on Enterprise; not DoD contract work | Cross-functional teams wanting one platform for everything | Deep M365 shops with governance maturity | Google Workspace orgs; cost-conscious buyers | Research-intensive roles: analysts, legal, consulting | vCIO judgment · C44 |
2 · Pricing Reality Check Business overview
| Dimension | Claude | ChatGPT | M365 Copilot | Gemini (Workspace) | Perplexity | Sources |
|---|---|---|---|---|---|---|
| Entry business tier | Team Standard | Business Standard | Copilot Business add-on (needs an M365 Business base license) | Workspace Business Standard (full suite, Gemini included) | Enterprise Pro | C01 · OA01 · MS01 · G01 · PPLX01 |
| Per seat / mo (annual billing) | $20.00 | $20.00 | $21.00 | $14.00 | $33.33 | Pricing & Scope |
| Per seat / mo (monthly billing) | $25.00 | $25.00 | $25.20 | $16.80 | $40.00 | Pricing & Scope |
| Monthly cost at 50 seats (annual billing) | $1,000 | $1,000 | $1,050 | $700 | $1,667 | Pricing & Scope |
| What that price includes | AI assistant only; usage limits apply, extra usage billed at API rates | AI assistant only; optional credits extend usage | AI add-on only. With Business Standard base: $35. Bundle instead: $23.50 | Entire Workspace suite (Gmail, Drive, Meet) with Gemini included | Research assistant only; API billed separately | C02 C24 · OA01 · MS01 MS02 · G01 G34 · PPLX01 |
| Upper tier / enterprise pricing | Premium seat $100 (5× usage). Enterprise: $20/seat access fee, annual only, plus all usage at API rates; min 20 seats | Premium seat $100 (5× usage). Enterprise: custom quote, no published floor | Enterprise add-on $30 on E3 ($39) or E5 ($60) = $69-$90. E7 $99 bundles E5, Copilot, Agent 365, Entra Suite | Business Plus $22 (adds Vault). Enterprise editions by quote. Gemini Enterprise is separate, from $21 | Enterprise Max $325/mo or $3,250/yr. Confirm current pricing with sales | C01 C03 · OA01 OA27 · MS13 MS23 MS24 · G01 G06 · PPLX01 PPLX21 |
| Business data excluded from training? | Yes: Yes, unless you opt in or send feedback | Yes: Yes, unless you opt in | Yes: Yes | Yes: Yes, unless the customer gives permission | Yes: Yes (contractual commitment) | C10 · OA11 · MS04 · G05 · PPLX08 |
| Personal paid accounts excluded from training? | Partly: User's choice in settings (Free/ | Partly: Only if the user opts out (Free/ | Partly: Only if the user opts out (consumer Copilot app); Entra ID sign-ins are excluded | Partly: Only if Keep Activity is off and no feedback is sent (personal Google accounts) | Partly: Only if the user opts out (consumer Pro/ | C23 C35 · OA21 · MS36 · G17 · PPLX02 |
| Free tier available? | Yes: Yes (limited) | Yes: Yes | Yes: Copilot Chat included with M365 (web-grounded only) | Yes: Yes, via personal Google accounts (consumer terms) | Yes: Yes (limited) | C01 · OA21 · MS13 · G17 · PPLX02 |
| Pricing model risk | Per-session and weekly usage limits; overage at API rates. Apr 2026: third-party tools (OpenClaw) cut from subscriptions | Business cut $25→$20 (Apr 2026); Premium seats added Aug 2026; per-model usage windows | Jul 2026 increases: E3 $36→$39, E5 $57→$60, Business Standard $12.50→$14. $18 promo ends Dec 31 | AI bundled since Jan 2025; Starter promo access ends Nov 1, 2026; quota add-on changes limits | Computer credits (Pro 500, Max 15,000/mo) expire monthly; API separate; pricing page reportedly changed Aug 2026 | C02 C24 C47 · OA03 OA28 OA29 · MS01 MS02 · G34 G35 · PPLX12 PPLX21 |
| Cost surprise to warn clients | Enterprise seat fee includes no usage: every token billed at API rates. Budget usage, not seats | Needing SCIM, compliance logs or residency forces Enterprise (custom quote) | Buy the $23.50 bundle, not Standard + add-on ($35). E7 costs only $9 more than E5 + Copilot | Any SharePoint, Outlook or Teams access requires Gemini Enterprise (separate subscription) | SCIM, audit and retention: help center says 50 seats or one Max seat; pricing page reportedly says 'contract required' | C03 · OA14 OA16 OA27 · MS01 MS23 · G20 G21 · PPLX13 PPLX21 |
The headline seat prices are not like for like, and that is the most common way these comparisons mislead. The Copilot figure is an add-on that needs a Microsoft 365 base license underneath it, while the Workspace figure buys the whole suite with Gemini included. The tables below set out the tiers organisations actually end up buying, including the bundles and enterprise paths, with what each price does and does not include.
Compared business tiers
| Platform | Plan | Seat / mo (annual) | Seat / mo (monthly) | Monthly cost, 50 seats | Seats | What the price includes | Sources |
|---|---|---|---|---|---|---|---|
| Claude | Team Standard | $20.00 | $25.00 | $1,000 | 2-150 | AI assistant only. Per-session and weekly usage limits; optional extra usage billed at API rates | C01 C02 C24 |
| ChatGPT | Business Standard | $20.00 | $25.00 | $1,000 | 2-200 | AI assistant only. Per-model usage limits; optional credits; API billed separately | OA01 OA02 OA03 |
| M365 Copilot | Copilot Business add-on | $21.00 | $25.20 | $1,050 | 1-300 | AI add-on only: requires an M365 Business base license. $18 first-year promo for purchases Jul 1-Dec 31, 2026 not used here | MS01 MS29 |
| Gemini | Workspace Business Standard | $14.00 | $16.80 | $700 | 1-300 | Entire Workspace suite (Gmail, Drive, Meet) with Gemini included | G01 G34 |
| Perplexity | Enterprise Pro | $33.33 | $40.00 | $1,667 | 1+ | Research assistant. Help center price; a reported Aug 2026 pricing page differs (see notes) | PPLX01 PPLX21 |
Other tiers, bundles and upgrade paths
| Platform | Plan | Seat / mo (annual) | Seat / mo (monthly) | Monthly cost, 50 seats | Seats | What the price includes | Sources |
|---|---|---|---|---|---|---|---|
| Claude | Team Premium seat | $100.00 | $125.00 | $5,000 | 2-150 | 5× Standard usage; can mix with Standard seats | C01 C02 |
| Claude | Enterprise access fee only | $20.00 | Annual only | $1,000 | 20+ | Excludes ALL usage, billed at API rates. 20-seat self-serve minimum; 50 sales-assisted | C01 C03 |
| ChatGPT | Business Premium seat | $100.00 | $125.00 | $5,000 | 2-200 | 5× Standard usage; no 5-hour limit | OA01 OA28 |
| ChatGPT | Enterprise | Quote | Quote | Quote | 1+ | Custom pricing; credit- or token-based options; no published floor | OA27 |
| M365 Copilot | Business Standard + Copilot bundle | $23.50 | $28.20 | $1,175 | 1-300 | Permanent bundle since Jul 1, 2026; cheaper than base + add-on | MS01 MS19 |
| M365 Copilot | Business Premium + Copilot bundle | $32.00 | $38.40 | $1,600 | 1-300 | Permanent bundle; adds Intune and Defender for Business | MS01 MS19 |
| M365 Copilot | Business Standard + add-on (separately) | $35.00 | Not published | $1,750 | 1-300 | Shown for comparison: costs more than the bundle | MS01 MS02 |
| M365 Copilot | Business Premium + add-on (separately) | $43.00 | Not published | $2,150 | 1-300 | Shown for comparison: costs more than the bundle | MS01 MS02 |
| M365 Copilot | M365 E3 + Copilot (Enterprise add-on) | $69.00 | Not published | $3,450 | 1+ | Post-July E3 $39 + $30 add-on | MS13 MS23 |
| M365 Copilot | M365 E5 + Copilot (Enterprise add-on) | $90.00 | Not published | $4,500 | 1+ | Post-July E5 $60 + $30 add-on | MS13 MS23 |
| M365 Copilot | Microsoft 365 E7 | $99.00 | Not published | $4,950 | 1+ | E5 + Copilot + Agent 365 + Entra Suite; $90.45 without Teams | MS23 MS24 |
| Gemini | Workspace Business Starter | $7.00 | $8.40 | $350 | 1-300 | Gemini only in Gmail and Vids; 32K context; basic app access | G01 G03 |
| Gemini | Workspace Business Plus | $22.00 | $26.40 | $1,100 | 1-300 | Adds Vault. No Context-Aware Access or processing regions | G01 G13 G30 |
| Gemini | Incremental cost: existing Business Standard | $0.00 | $0.00 | $0 | 1-300 | Gemini already included; no AI add-on since Jan 2025 | G34 |
| Gemini | Gemini Enterprise Business (separate product) | $21.00 | Not published | $1,050 | 1-300 | Needed for M365/SaaS search and agents. Seat cap 300 vs 1-500 conflicts across Google pages | G06 G25 G36 |
| Gemini | Gemini Enterprise Standard/Plus (from) | $30.00 | Not published | $1,500 | 1+ | Starting price; quote billing term and limits | G06 |
| Perplexity | Enterprise Max seat | $270.83 | $325.00 | $13,542 | 1+ | 15,000 Computer credits/month; higher research quotas | PPLX01 PPLX12 |
| Perplexity | All Pro + one Max seat | $38.08 | $45.70 | $1,904 | 1+ | Blended per-seat cost. Help center: one Max seat unlocks SCIM, audit logs and retention (confirm) | PPLX01 PPLX13 |
- Promotions
- Microsoft: Copilot Business $18 for the first year on purchases Jul 1-Dec 31, 2026, and a Business Basic + Copilot promotion at $21, both ending Dec 31, 2026. Not used as the baseline above. MS01 MS19
- Metered usage
- Claude Enterprise bills every token at API rates on top of the seat fee. Copilot Cowork meters at $0.01 per credit; Copilot Studio agents beyond included employee use meter at $0.01 per credit pay-as-you-go or $200/month for 25,000 credits. Perplexity Computer credits (Pro 500, Max 15,000 per month) expire monthly. C03 · MS14 MS28 · PPLX12
- Perplexity conflict
- The help center lists $40/mo or $400/yr (Pro) and $325/mo or $3,250/yr (Max), with SCIM, audit logs and retention unlocked at 50 seats or one Max seat. A third-party capture of the pricing page from Aug 14, 2026 shows annual-only $34/$271 and those controls as 'contract required'. Get both in writing. PPLX01 PPLX13 PPLX21
- Legacy contracts
- Older seat-based Claude Enterprise contracts with included usage stay as they are until renewal; the access-fee model applies to new purchases. C03
- Out of scope
- Tax, regional pricing, reseller discounts, existing suite commitments, migration and implementation effort are not in these numbers.
Microsoft 365 integration and connectors
For most organisations the first technical question is how a platform reaches the documents, mail and chat already sitting in Microsoft 365. The answers differ more than the marketing suggests. Some platforms query content live with the user’s own delegated permissions, some build an index on the vendor’s side, and some copy files into their own storage when a user imports them. Each model has a different answer for where copies live, how quickly a permission change takes effect and what an administrator has to consent to.
3 · M365 / SharePoint Integration Depth IT integration
| Capability | Claude | ChatGPT | M365 Copilot | Gemini (Workspace) | Perplexity | Sources |
|---|---|---|---|---|---|---|
| Integration model | Anthropic-hosted M365 connector (MCP) with delegated Graph permissions; live search, no index | Live apps on most plans; admin-managed sync (index) on Enterprise/ | Native Graph / Work IQ grounding: deepest integration | No: None in Workspace. M365 connectors only in Gemini Enterprise | File connectors: live search, one-query snapshot, or Project import (copy) | C05 · OA04 OA05 · MS03 MS09 · G20 G21 · PPLX03 |
| SharePoint access | Yes: Search and read; admin can enable create/ | Yes: Live read on most plans; sync index on Enterprise/ | Yes: Native; returns only content the user can already open | Partly: Gemini Enterprise only; selected sites still need a FullControl grant per site | Yes: User picks folders/ | C05 C26 · OA04 · MS04 · G08 G09 · PPLX03 |
| OneDrive access | Yes: Same as SharePoint | Yes: Work/ | Yes: Native | Partly: Gemini Enterprise only | Yes: Live, snapshot or import | C26 · OA04 · MS03 · G21 · PPLX03 |
| Teams access | Yes: Reads chats and channels the user is in; can send with confirmation if enabled | Yes: Live app can send messages and manage Planner; Enterprise sync index is read-only | Yes: Native: meeting recaps, chat context (Teams license required) | Partly: Gemini Enterprise connector only (can send messages) | Yes: Teams app runs tasks; connector searches chats the user can see | C26 · OA06 · MS01 MS13 · G21 · PPLX10 |
| Outlook / email access | Yes: Search mail and calendar; admin-enabled draft, send, organize (no attachments on send) | Yes: Search, contacts, calendar edits; can send plain-text email, incl. shared mailboxes | Yes: Native: drafts, summaries, calendar | Yes: Native in Gmail; Outlook only via Gemini Enterprise | Partly: Outlook and Gmail via Computer agent; confirm allowed actions | C26 · OA07 · MS03 · G21 · PPLX06 |
| Word / Excel / PowerPoint | Yes: Excel, PowerPoint, Word add-ins GA on paid plans; Outlook add-in in beta | Yes: Word, Excel, PowerPoint add-ins GA; Word on by default since Oct 1, 2026 | Yes: Built into the app ribbon: deepest | No: No Office add-in documented; native in Docs, Sheets, Slides | Partly: Creates documents and slides; no Office add-in found | C14 · OA22 OA23 OA24 · MS13 · G20 · PPLX06 |
| Content copied outside tenant? | Partly: No file cache, but results saved in chats sit on Anthropic servers (US) | Partly: Sync builds an OpenAI-side index; live mode fetches on demand | Yes: Stored inside M365. Exceptions: web queries, Anthropic models, EU flex routing | Partly: Gemini Enterprise: federated mode copies nothing; ingestion copies to its index | Partly: Imports and attachments copied to AWS S3; live search reads in place | C05 C29 · OA04 OA08 · MS04 MS11 MS12 · G07 · PPLX03 |
| Data residency (SP data) | Partly: Originals stay in tenant; chat copies stored in US; processing global by default | Partly: Sync residency: EEA+Switzerland, Japan or US (Enterprise/ | Yes: Follows tenant region; EU Data Boundary; ADR add-on covers 27 countries | Partly: Gemini Enterprise connector: global, US or EU location | Partly: AWS S3, region not stated; no residency choice found | C05 C22 · OA05 OA10 OA27 · MS18 MS33 · G22 · PPLX03 |
| Admin gating / consent | One-time Entra Global Admin consent; Owner enables connector; each user signs in | Admin enables each app and action; sync needs Sites.FullControl.All (broad) | M365 Admin Center: full lifecycle control; connectors staged by Entra group | Workspace Admin by OU/ | Admin enables connectors; each user authenticates | C05 C26 · OA04 OA08 · MS10 · G08 · PPLX03 |
| Permission enforcement | Yes: Delegated: mirrors the user's access live | Partly: Enforced, but index changes 'may take time to appear' | Yes: Real-time for native content; synced external connectors refresh periodically | Yes: Only content the user can access (Gemini Enterprise) | Partly: Live search follows source; vendor says revoked files are removed immediately (test it); imports miss later edits | C05 · OA04 · MS09 · G10 · PPLX03 |
| File count / size limits | No published limit; on-demand search; OneNote unsupported | Synced files ≤100 MB; chat uploads 512 MB per file | No published limit | Gemini Enterprise: pooled index storage per seat (25-75 GiB by edition) | Projects: 5,000 files, 2.5 GB, 100 MB per file | C26 · OA04 OA20 · MS09 · G25 · PPLX04 |
| EEA / UK connector available? | Partly: Not stated by Anthropic; confirm for EU/ | Partly: Live apps: EEA/ | Yes: Yes; Anthropic models off by default in EU/ | Partly: Gemini Enterprise offers an EU location; no UK-specific option | Partly: Not stated; DPA includes EU SCCs and UK addendum | C05 C26 · OA05 · MS11 · G22 · PPLX19 |
| Biggest catch | Tenant-wide Sites.Read.All; no per-site restriction (users still limited to their own access) | Sync mode needs Sites.FullControl.All and is Enterprise/ | Oversharing: Copilot surfaces files users can access but didn't know existed | Any M365 access means buying Gemini Enterprise (a Google Cloud product) | Imported copies live in AWS and must be refreshed; not for residency-strict orgs | C05 · OA04 · MS15 · G20 · PPLX03 |
Connector counts are reported here as each vendor states them, and they are not comparable. Catalogs mix first-party and partner connectors, read-only search with write actions, and curated lists with open directories. Compare the specific operations a workflow needs.
4 · Connector Ecosystem & Integration Breadth IT integration
| Integration Category | Claude | ChatGPT | M365 Copilot | Gemini (Workspace) | Perplexity | Sources |
|---|---|---|---|---|---|---|
| Prebuilt connectors (vendor's own count; not comparable) | 914 listed in Anthropic's directory (Oct 7, 2026) | 'Plugins' directory; no official count | 100+ Copilot connectors; Power Platform catalog is separate | Workspace: 7 third-party connectors (Sep 2026). Gemini Enterprise: larger catalog | 'Hundreds' via Computer; 5 file connectors | C38 · OA37 · MS09 · G21 G27 · PPLX03 PPLX06 |
| Microsoft 365 stack | Yes: SharePoint, OneDrive, Teams, Outlook + Office add-ins | Yes: SharePoint, Teams, Outlook + Office add-ins | Yes: Full native: Word, Excel, PPT, Teams, Outlook, SP, OD | Partly: Only via Gemini Enterprise (separate product) | Yes: SharePoint, OneDrive, Teams, Outlook (via Computer) | C14 C26 · OA04 OA06 OA07 OA22 · MS13 · G21 · PPLX03 PPLX10 |
| Google Workspace | Yes: Gmail, Calendar, Drive connectors; Docs/ | Yes: Google Drive incl. Docs/ | Partly: Google Drive (synced); Gmail and Calendar via federated connectors | Yes: Native: Gmail, Drive, Docs, Sheets, Slides, Meet, Chat | Yes: Google Drive connector; Gmail via Computer | C06 C15 · OA08 OA23 · MS10 MS30 · G02 · PPLX03 PPLX06 |
| Salesforce / CRM | Partly: Not in directory; add Salesforce's MCP server as a custom connector | Partly: Confirm in current plugin directory; custom MCP possible | Yes: Microsoft-built Salesforce connectors | Yes: Salesforce connector in Workspace (Sep 2026, on by default) | Yes: Salesforce via Computer | C38 · OA37 · MS30 · G27 · PPLX06 |
| Slack / Teams messaging | Yes: Slack connector; Teams via M365 connector | Yes: Slack and Teams apps | Yes: Teams native; Slack only via partner connectors | Partly: Slack steps in Workspace Studio (off by default); Slack/ | Yes: Slack (Computer) and Teams app | C05 C38 · OA06 OA36 · MS31 · G21 G28 · PPLX06 PPLX10 |
| GitHub / Jira / Dev tools | Yes: GitHub (built-in), Jira/ | Yes: GitHub; Codex included in Business | Yes: Microsoft-built GitHub, Azure DevOps and Jira connectors | Partly: GitHub repos in Gemini app; Jira via Workspace Studio and Atlassian Rovo | Yes: GitHub, Linear; Jira not listed | C02 C38 · OA01 OA05 · MS30 · G16 G28 · PPLX06 |
| HubSpot / Marketing | Yes: HubSpot (Anthropic-verified) | Partly: Confirm in current plugin directory | Yes: Federated connector; write actions rolling out Oct 2026 | Yes: Workspace connector (Sep 2026) + Studio step; Mailchimp too | Partly: Not listed; custom MCP possible | C38 · OA37 · MS10 · G27 G28 · PPLX09 |
| Notion / Confluence / Docs | Yes: Notion, Confluence (Atlassian) | Yes: Notion; Confluence not listed | Yes: Confluence (Microsoft-built); Notion (federated) | Partly: Confluence via Studio and Rovo; Notion only in Gemini Enterprise | Partly: Notion yes; Confluence not listed | C38 · OA37 · MS10 MS30 · G21 G28 · PPLX06 |
| Databases / data lakes | Partly: Supabase listed; others via custom MCP | Partly: Via custom MCP apps | Yes: Azure SQL and Oracle SQL connectors | Partly: BigQuery via Gemini Enterprise (separate BigQuery licensing) | Yes: Snowflake, Databricks via Computer | C07 C38 · OA18 · MS30 · G21 · PPLX06 |
| Custom / internal systems | Yes: Remote MCP; server must be reachable from Anthropic's cloud | Yes: Custom MCP apps + Secure MCP Tunnel. Custom GPTs retire Dec 11, 2026 | Yes: Copilot Studio + Power Platform custom connectors | Partly: Gemini Enterprise custom MCP (preview); Workspace Studio webhooks | Yes: Custom remote MCP; AWS PrivateLink (Enterprise) | C07 · OA18 OA26 · MS16 · G11 G28 · PPLX09 |
| MCP support | Yes: Created MCP (donated to Linux Foundation, Dec 2025); local + remote | Yes: MCP client; full read/ | Yes: Copilot Studio MCP GA since May 2025 | Partly: Gemini CLI yes; Gemini Enterprise preview; Workspace curated only | Yes: MCP client + official server | C07 C42 · OA18 · MS32 · G11 G23 G27 · PPLX11 |
| Link to full connector directory | claude.com/ | chatgpt.com/ | learn.microsoft.com → Copilot connectors gallery | Workspace Updates blog; Gemini Enterprise connector list | perplexity.ai help center → Connectors | C38 · OA37 · MS30 · G21 G27 · PPLX03 |
Security, compliance and admin controls
Certifications are scoped to named services. A SOC 2 report or a HIPAA business associate agreement covers the products it lists, and new agents, browser extensions and preview features are frequently outside that scope even when they ship inside a covered product. Where a row says to confirm, the vendor’s own documentation either conflicts or is silent, and the open questions further down say what to ask.
5 · Security, Compliance & Admin Controls Security & compliance
| Capability | Claude | ChatGPT | M365 Copilot | Gemini (Workspace) | Perplexity | Sources |
|---|---|---|---|---|---|---|
| SOC 2 Type II | Yes: | Yes: API + business products | Partly: M365 report; confirm Copilot is in scope (Service Trust Portal) | Yes: Quarterly reports (not Gemini Notebook) | Yes: | C09 · OA12 · MS22 · G05 G18 · PPLX16 |
| ISO 27001 | Yes: 27001:2022 | Partly: API, Enterprise, Edu (Business not named) | Yes: | Yes: | Yes: 27001:2022 | C09 · OA12 · MS04 · G05 · PPLX16 |
| ISO 42001 (AI-specific) | Yes: | Yes: | Yes: Copilot, Copilot Chat, Copilot Studio | Yes: (Google claims industry first, Dec 2024) | No: Not found | C09 · OA12 · MS21 · G05 G33 · PPLX16 |
| FedRAMP | Partly: Claude for Government, or via AWS GovCloud / Vertex (FedRAMP High); not Team/ | Partly: Separate FedRAMP 20x Moderate Enterprise/ | Partly: Available in GCC, GCC High, DoD; Copilot-specific authorization not confirmed; some features missing | Yes: FedRAMP High (Workspace Gemini + Gemini app) | Yes: FedRAMP 20x Low (Class B) | C21 C40 · OA25 · MS07 · G05 G32 · PPLX17 |
| HIPAA BAA | Yes: Enterprise (HIPAA enabled) and API; not Team | Partly: Healthcare or Regulated Workspace only; not Business or standard Enterprise | Yes: Included by default via DPA (Copilot + Copilot Chat) | Yes: With executed BAA (excludes Gemini in Chrome, Gemini Notebook) | Partly: Requires executed BAA; terms not public | C11 · OA13 · MS08 · G24 · PPLX08 |
| GDPR compliance | Yes: Documented + DPA | Yes: Documented + DPA | Yes: EU Data Boundary (exceptions: Anthropic models, flex routing) | Yes: Cloud DPA | Partly: DPA with EU SCCs; compliance self-declared | C05 · OA11 · MS04 MS11 MS12 · G05 · PPLX19 |
| SSO / SAML | Yes: Team + Enterprise | Yes: Business + Enterprise | Yes: Via Entra ID | Yes: All Business editions | Yes: Enterprise Pro, no seat minimum | C37 · OA15 · MS15 · G02 · PPLX15 |
| SCIM provisioning | Partly: Enterprise only (Team has JIT provisioning) | Partly: Enterprise only | Yes: Via Entra ID | Yes: Inbound SCIM 2.0 | Partly: 50 seats or one Max seat (help center); confirm | C01 C02 · OA14 · MS15 · G15 · PPLX13 |
| Audit logs | Partly: Enterprise: 180-day export (no chat content) + Compliance API | Partly: Enterprise: Compliance Platform, 30-day retention, export to SIEM | Yes: Purview unified audit log | Yes: Admin console / Reporting API | Partly: Help center: 50 seats or one Max (confirm); streams to Splunk or webhook | C12 C32 · OA16 · MS05 · G05 · PPLX14 |
| Conditional Access support | Partly: MFA and device checks work; location and sign-in-frequency rules not supported | Partly: Applied at SSO sign-in through your IdP; test connector tokens | Yes: Full Entra CA with Entra P1 (E3, Business Premium) or P2 (E5); not in Business Standard | Partly: Context-Aware Access needs Enterprise editions, not Business | Partly: Through SSO IdP only; nothing further documented | C05 · OA15 · MS15 · G30 · PPLX15 |
| Data retention controls | Partly: Enterprise only: default indefinite, minimum 30 days | Partly: Enterprise yes; Business: OpenAI says admins can, verify in console | Yes: Full Purview retention | Yes: Side panel 90/540/1,080 days; Gemini app 3/18/36 months | Partly: Help center: 50 seats or one Max (confirm); uploads deleted after 7 days | C19 · OA11 OA19 · MS05 · G03 G31 · PPLX05 |
| Customer-managed keys (CMK) | Yes: Enterprise: US-only, irreversible, disables exports and chat search | Yes: EKM (Enterprise/ | Yes: Customer Key / BYOK | Partly: Client-side encryption (Enterprise Plus etc.) blocks Gemini from that content | No: None found | C18 · OA17 · MS05 · G26 · PPLX16 |
| Zero Data Retention (ZDR) | Partly: API only, by agreement; not Team/ | Partly: API (eligible endpoints); ChatGPT only by sales-led contract, not self-serve Business | No: Prompts and responses stored for history and compliance | No: Even with history off, chats kept up to 72 hours | Partly: API not retained; Enterprise app retains | C20 · OA01 OA11 · MS04 · G05 G17 · PPLX05 PPLX26 |
| Data residency options | Partly: Stored in US; US-only processing on usage-based Enterprise at 1.1× API rates | Yes: Enterprise/ | Yes: Tenant region, EU Data Boundary, ADR (27 countries) | Yes: Data at rest US or Europe (Standard/ | No: No selectable residency; AWS S3 | C22 C28 · OA09 · MS18 MS33 · G12 G13 · PPLX03 |
| eDiscovery / litigation hold | Partly: Compliance API feeds eDiscovery tools (Relativity, Smarsh); no native hold | Partly: Compliance Platform export to eDiscovery; no native hold | Yes: Purview eDiscovery + holds | Partly: Vault in Business Plus and up (not Standard) | No: None found | C12 C31 C41 · OA16 · MS05 · G14 · PPLX14 |
| DLP policy integration | Partly: Inference hooks (beta) + DLP partners via Compliance API | Partly: Partner DLP via Compliance Platform (Enterprise) | Partly: Label-based blocking GA; typed-prompt blocking still preview | Partly: Workspace DLP covers AI output on supported editions; confirm for Business Standard | Partly: No native DLP; Comet + CrowdStrike option | C33 C41 · OA16 · MS06 · G05 · PPLX20 |
| Admin-controlled connector enable/disable | Yes: Owners enable connectors and write tools | Yes: Per-app read/ | Yes: Per connector, staged by Entra group | Partly: By OU/ | Yes: Admin enables/ | C07 C26 · OA08 · MS10 · G27 · PPLX03 PPLX06 |
| HIPAA feature-level exclusions | Partly: Not covered: connector/ | Partly: Not covered: Codex cloud, event-triggered tasks, Sites, improved memory and more | Yes: Copilot + Copilot Chat in scope (commercial, GCC); check each new agent | Partly: Gemini in Chrome and Gemini Notebook excluded | Partly: Defined in the executed BAA; no public list | C11 · OA13 · MS08 · G05 G24 · PPLX08 |
MCP readiness
The Model Context Protocol is how these assistants call tools and reach systems that have no built-in connector. The exposure grows with write access: a connected server can carry instructions the model follows, and a write action approved once can keep running. These rows track authentication, write approvals, logging and what has changed recently, because this is the part of the market moving fastest.
6 · MCP (Model Context Protocol) Readiness Technical deep-dive
| MCP Dimension | Claude | ChatGPT | M365 Copilot | Gemini (Workspace) | Perplexity | Sources |
|---|---|---|---|---|---|---|
| MCP role | Client; created the protocol (now Linux Foundation) | Client (custom apps, developer mode) | Client (Copilot Studio, federated connectors) | Client (Gemini CLI; Enterprise preview); Workspace MCP servers in developer preview | Client (custom connectors) + server (official) | C07 C42 · OA18 · MS10 MS16 · G11 G23 G38 · PPLX09 PPLX11 |
| Native MCP support | Yes: Local + remote; Research can't call local servers | Partly: Full read/ | Yes: GA since May 2025; federated writes rolling out Oct 2026 | Partly: Preview in Gemini Enterprise; curated only in Workspace | Yes: Hosted + local server; custom connectors | C07 · OA18 · MS10 MS32 · G11 G27 · PPLX11 |
| Custom MCP servers | Yes: Owners add; no documented server limit (Free: 1) | Yes: Custom apps; Secure MCP Tunnel for private servers | Yes: Wizard or Power Platform custom connector; DLP policies apply | Partly: HTTPS StreamableHTTP only (preview) | Yes: Streamable HTTP or SSE; admin must allow member-added | C07 · OA18 · MS16 · G11 · PPLX09 |
| Enterprise auth on MCP | Yes: OAuth, API keys; Okta-managed auth GA (Team + Enterprise) | Yes: OAuth; tool snapshots frozen until admin re-approves | Yes: OAuth 2.0 (dynamic discovery), API key; user-scoped | Partly: OAuth optional; IdP must be publicly reachable | Partly: OAuth, API key, or none (admin's choice) | C07 C16 · OA18 · MS10 MS16 · G11 · PPLX09 PPLX11 |
| Audit trail for MCP calls | Partly: Compliance API + OpenTelemetry (Cowork, Claude Code); coverage varies by surface | Partly: App logs in Compliance Platform (30 days); per-call coverage unclear | Yes: Purview audit for federated connectors | Partly: No MCP-specific audit found for Workspace | Yes: Audit logs include connector + Computer actions (if entitled) | C08 C12 C43 · OA16 · MS10 · G38 · PPLX14 |
| Write-action safety | Partly: Confirmation prompts; admins can restrict 'Always allow' | Partly: Approval levels from 'Always ask' to 'Allow all actions' | Partly: Allow once / conversation / always, per tool; Researcher read-only | Partly: CLI 'trust' setting can skip all confirmations | Partly: Computer can write; per-action approval not documented | C05 C08 · OA08 · MS10 · G23 · PPLX06 |
| Prompt injection exposure | Partly: Real with any third-party server; Anthropic warns of hidden instructions | Partly: Real; OpenAI warns in developer-mode docs | Partly: Injection classifiers help; still test connected content | Partly: Test untrusted tool content before enabling writes | Partly: Computer acts on connected content; custom connectors are your risk | C07 · OA18 · MS04 · G23 · PPLX09 |
| Governance maturity (vCIO view) | Partly: Improving: managed auth, Compliance API, inference hooks (beta) | Partly: Enterprise controls solid; Business thin | Yes: Most mature: Admin Center, Purview, Power Platform DLP | Partly: Split across Workspace, CLI and Gemini Enterprise | Partly: Controls gated behind seat count / Max (confirm) | vCIO judgment · C16 C33 · OA14 OA16 · MS14 · G23 · PPLX13 |
| What changed recently | OAuth roadmap delivered; MCP tunnels in preview (API only) | Custom GPTs move to plugins by Dec 11, 2026 | Federated connector writes rolling out Oct 2026 | Third-party connectors Sep 2026; Enterprise custom MCP in preview | Products still ship MCP; CTO reportedly described an internal shift to APIs/ | C16 C17 · OA26 · MS10 · G11 G27 · PPLX11 PPLX22 |
| vCIO recommendation on MCP | Partly: Pilot with approved servers, read-only first | Partly: Same; plan the Custom GPT migration | Yes: Safest starting point if already on M365 | Partly: Review the on-by-default connectors first | Partly: Use built-in connectors; custom MCP only with a named owner | vCIO judgment |
Failure modes and operational reality
Every platform here can produce a confident wrong answer, expose data through permissions that were already too broad, and change its pricing or terms between one renewal and the next. These rows record the specific, sourced version of each risk for each vendor, so the conversation can be about what has actually happened to each vendor.
7 · Known Failure Modes & Operational Reality Risk
| Failure Mode | Claude | ChatGPT | M365 Copilot | Gemini (Workspace) | Perplexity | Sources |
|---|---|---|---|---|---|---|
| Hallucination / overconfidence | Partly: Present in all LLMs; verify citations and numbers | Partly: Present; GPT-4o sycophancy update rolled back (Apr 2025) | Partly: Inherits model risk; users over-trust embedded output | Partly: Google: may 'hallucinate or provide outdated information' | Partly: Citations shown, but the terms make you verify them | OA30 · G16 · PPLX08 |
| Data leakage risk | Partly: Mar 2026: ~3,000 draft website files exposed via CMS error (no customer data) | Partly: Nov 2025 Mixpanel vendor breach (API user profiles, no chats); Feb 2026 Check Point flaw patched | Partly: Oversharing: surfaces files a user can access but shouldn't find | Partly: New third-party connectors on by default; review before rollout | Partly: Mar 2026 class action alleges chat data shared with ad trackers (unproven, consumer) | C46 · OA31 OA32 · MS15 · G27 · PPLX25 |
| Prompt injection via connectors | Partly: Third-party MCP servers unvetted by default | Partly: OpenAI warns; write-capable apps raise the stakes | Partly: Classifiers + admin scoping; still test | Partly: Developer responsibility in CLI; test connectors | Partly: Computer acts on connected content; test before production | C07 · OA18 · MS04 · G23 · PPLX09 |
| Vendor / product stability risk | Partly: Sep 2026: appeals court upheld Pentagon 'supply-chain risk' label (DoD work barred); Mar 31 code leak | Partly: Mission statement changed 6×; nonprofit-controlled PBC since Oct 2025; NYT suit ongoing | Yes: Lowest vendor risk; 30M+ paid Copilot seats (Jul 2026) | Partly: Frequent renames: Agentspace, NotebookLM → Gemini Notebook, Gems → Skills | No: Active suits: NYT, CNN, Dow Jones, Reddit and others; business model under challenge | C44 C45 · OA33 OA34 OA38 · MS35 · G29 G37 · PPLX23 PPLX24 |
| Compliance gap at feature level | Partly: Cloud Cowork, Office add-ins and connector data outside the BAA | No: Standard Enterprise not HIPAA-eligible; needs Healthcare or Regulated SKU | Partly: Typed-prompt DLP still preview; gov clouds missing some features | Partly: Gemini in Chrome + Gemini Notebook outside BAA; Notebook outside SOC/ | Partly: SOC 2 + ISO 27001 yes; no native hold or DLP; BAA contractual | C11 · OA13 · MS06 MS34 · G05 G24 · PPLX08 PPLX16 |
| Oversharing / permission sprawl | Partly: Tenant-wide search; loose SharePoint sharing widens reach | Partly: Sync index lags permission changes | No: Most critical: years of permission debt become instantly searchable | Partly: Drive sharing hygiene still required | Partly: Shared Projects and threads expose imported content | C05 · OA04 · MS15 · G16 · PPLX03 PPLX04 |
| Usage cap / rate limit surprise | Partly: Per-session + weekly limits; overage at API rates | Partly: Per-model 5-hour limits; Standard gets 15 Pro messages/ | Partly: Cowork metered via Azure ($0.01/credit); agents for licensed users under fair-use limits | Partly: Pro mode up to 25 prompts per 4 hrs; Starter limits change often | Partly: Research 50/mo (Pro) vs 500 (Max); Computer credits expire monthly | C02 C24 · OA03 · MS14 MS28 · G03 · PPLX02 PPLX12 |
| Shadow AI / unmanaged use | Partly: Free tier + consumer training setting | No: Largest consumer user base; free tier | Partly: Blocking other AI sites needs Purview Endpoint DLP | Partly: Personal accounts follow consumer terms | Partly: Free tier + research appeal = common shadow use | C01 C23 · OA21 · MS05 · G17 · PPLX02 |
| Rapid product / pricing changes | Partly: Apr 2026: third-party tools cut from subscriptions; Enterprise moved to usage billing | No: Price cut Apr 2026; Premium seats Aug; Custom GPTs retiring Dec 2026 | Partly: Jul 2026 price increases; E7 launched May; promos end Dec 31 | Partly: Starter promo ends Nov 1; connectors added Sep; renames continue | Partly: Org file repository retired Oct 1; pricing page reportedly changed Aug 2026 | C03 C47 · OA26 OA28 OA29 · MS01 MS02 MS24 · G27 G35 · PPLX04 PPLX21 |
Rollout effort
These rows are practitioner estimates and are labelled that way in the sources column. Rollout effort depends on the state of the environment far more than on the product, and a tenant with years of loose sharing will take longer to prepare for any assistant that searches it.
8 · Deployment Readiness vs. Governance Investment Required Rollout planning (vCIO estimates)
| Factor | Claude | ChatGPT | M365 Copilot | Gemini (Workspace) | Perplexity | Sources |
|---|---|---|---|---|---|---|
| Time to first productive use (business tier) | Hours: web/ | Hours: web/ | Days to weeks (licensing, permission review, labels) | Hours for GW orgs; weeks if M365 data needed (Gemini Enterprise) | Hours: web/ | vCIO estimate |
| Pre-deployment IT work required | Partly: Low: SSO, Entra consent, connector allow-list | Partly: Low to medium: SSO, app policies; Enterprise for SCIM/ | No: High: SharePoint oversharing review, sensitivity labels, DLP, Restricted Search | Yes: Very low for GW orgs; review default-on connectors | Yes: Low: SSO, connector OAuth | vCIO estimate · MS15 · G27 |
| Admin training required | Partly: Medium: seat types, spend caps, connectors | Partly: Medium: app/ | No: High: Purview, SharePoint Advanced Management (now included with Copilot), Copilot analytics | Partly: Medium: Workspace Admin Console | Partly: Low to medium: mixed tiers, credits, connectors | vCIO estimate · MS13 |
| End-user training required | Partly: Medium: prompting, connector use, file outputs | Partly: Medium: broad feature set needs guidance | No: High: embedded in every M365 app; users need workflow-specific training | Yes: Low for GW users (already in familiar apps) | Yes: Low: search-first UX is intuitive | vCIO estimate |
| Rollout governance artifacts needed | Acceptable Use Policy; connector allow-list; SSO config; spend limits | AUP; app allow-list; SSO; shadow AI DLP policy; Custom GPT migration plan | SP permission remediation plan; sensitivity labels; Restricted Search config; Copilot Analytics; DLP policy; training playbooks | GW admin policy; feature enable/ | AUP; connector scope policy; citation validation standard | vCIO estimate |
| Ongoing governance burden | Partly: Medium: MCP server vetting; usage and spend review | Partly: Medium: app review; credit monitoring | No: High: continuous SP hygiene; Copilot analytics; label maintenance | Yes: Low for GW orgs (existing Admin Console) | Partly: Medium: litigation monitoring; connector audit | vCIO estimate |
| Compliance review cadence | Annual SOC 2 review; BAA scope check for each new feature | Annual SOC 2 review; Healthcare/ | Annual M365 compliance review (already in M365 cycle) | Annual GW compliance review (already in GW cycle) | Quarterly: litigation exposure and pricing terms evolving | vCIO estimate |
The real tradeoffs
Each choice gives something up. The hidden catch column is the one worth reading twice, because it is the cost that tends to surface after the contract is signed.
| If you choose… | You gain | You give up | Hidden catch | Best client fit | Sources |
|---|---|---|---|---|---|
| Claude | Strong long-document analysis and coding; 1M-token context; Office add-ins GA; MCP creator; runs on AWS, Google Cloud and Azure | No image generation; SCIM, audit logs and retention controls need Enterprise; data stored in the US | Enterprise seat fee includes no usage, so cost tracks consumption. Defense contractors: Pentagon supply-chain-risk label upheld Sep 2026 | Law firms, financial analysts, consultants, dev-heavy teams, regulated orgs on Enterprise; not DoD contract work | C03 C13 C14 C44 |
| ChatGPT | Broadest feature surface (text, image, voice, agents, Codex); $20 Business seat; Office add-ins; widest user familiarity | Business lacks SCIM and compliance logs, and residency is still rolling out; Enterprise is custom-quoted; HIPAA needs a separate SKU | Custom GPTs retire Dec 11, 2026 (move to plugins). Governance history: mission statement changed 6×; NYT suit ongoing | SMBs wanting one platform for everything; US-based orgs comfortable with vendor risk | OA01 OA13 OA14 OA26 OA33 OA38 |
| M365 Copilot | Deepest M365 integration (Graph / Work IQ); inherits Purview, eDiscovery, Entra CA; HIPAA BAA by default; government clouds | Needs a base M365 license; value depends on SharePoint hygiene; Office-centric | The oversharing problem is real: Copilot makes years of permission debt instantly visible and exploitable | M365-heavy orgs with Entra/Purview ownership; SMBs via the $23.50 / $32 bundles; E5 shops weighing E7 | MS01 MS03 MS05 MS08 MS15 MS23 |
| Gemini | Included in Workspace Business Standard ($14); native in Gmail, Docs, Drive, Meet; FedRAMP High; 1M context | No M365 access without Gemini Enterprise; Context-Aware Access and processing regions need Enterprise editions | Sep 2026 third-party connectors (Salesforce, HubSpot and others) are ON by default; product names change often | Google Workspace orgs; education; cost-conscious SMBs; orgs using BigQuery/Looker | G01 G03 G20 G27 G30 |
| Perplexity | Best real-time research with citations; several models (GPT, Claude, Gemini, others) in one seat; Computer agent; SOC 2, ISO 27001, FedRAMP 20x Low | No selectable residency, customer keys, native DLP or legal hold; admin controls gated (confirm) | The core business model (answers built from web content) faces multiple publisher lawsuits | Research-intensive roles as a secondary tool; never the primary platform for document creation or regulated data | PPLX06 PPLX13 PPLX16 PPLX17 PPLX23 PPLX24 |
Solution patterns
Most organisations end up in one of the shapes below. The last one, MCP-led extensibility, is only worth starting once one of the others is in place and governed.
| Option A · "Suite-Native" (M365 Copilot primary) | Option B · "Best-of-Breed Assistant" (Claude or ChatGPT as default) | Option C · "Research + Writing Combo" (Perplexity + Claude/ChatGPT) | Option D · "Google-First" (Gemini + GW) | Option E · "MCP-Led Extensibility" (High-maturity only) | |
|---|---|---|---|---|---|
| Components | M365 Copilot (Business bundle, Enterprise add-on or E7) + SharePoint oversharing remediation + Purview DLP + Copilot Analytics | Claude Team or ChatGPT Business + SSO/ + Connector allow-list + M365 connector (read-only to start) | Perplexity Enterprise Pro (research) + Claude Team or ChatGPT Business (drafting) + Citation validation standards | Gemini in Workspace (Business Standard or higher) + Gemini Enterprise (if M365 data needed) + GW Admin policy + Review of default-on connectors | MCP governance standard + Approved server registry + OAuth / managed authorization + Write-action approval rules |
| Positioning | The 'real integration': no other tool matches Graph grounding. SP hygiene is not optional. | Fastest to deploy. Best for cross-functional teams. Governance lives in connector policy + SSO, not the AI tool. | Separates research from creation. Best for analyst, legal, consulting roles. Two tools, two budgets. | Best value if GW is home base. AI is already there: turn it on and govern it. | Maximum extensibility. Maximum risk. Only viable with a dedicated IT security owner for MCP governance. |
| Requires | SP permissions audit Partly: Budget remediation time before broad rollout (vCIO estimate: often 2-4 months) | Sanctioned tool policy Connector allow-list SSO config Shadow AI DLP rule | Research standards (citation rules) Connector scope policy for Perplexity User training on when to use which tool | GW tenant Workspace Admin policy per OU Connector review Acceptable Use Policy | Security owner for MCP vetting Approved server registry Red-team prompt injection testing Partly: Do not start this without Option A or B in place first |
| Best for | M365-heavy orgs, E5 licensees, orgs with existing Purview/ | US-based SMBs, cross-functional teams, orgs wanting fast deployment without M365 dependency | Research-intensive teams (analysts, legal, consulting) as a complement to a primary platform | Google Workspace orgs, education, cost-sensitive orgs already paying for GW | High-maturity IT orgs with dedicated security engineering capacity; not for SMBs |
| Hidden cost / catch | SP audit is the real work: budget IT time before Copilot is safe to enable broadly. Bundles beat base + add-on pricing | Shadow AI remains a risk: users will use personal accounts unless DLP policy blocks it. Business tiers lack SCIM and compliance logs | Two vendor relationships, two contracts, two renewal cycles. Tool sprawl if not managed | M365 users get limited value: Gemini's power is in GW. Don't force it on M365 shops | OAuth now ships, but a malicious or compromised MCP server can still exfiltrate data silently |
A rollout sequence
Phase 1 (Immediate)
• Conduct AI readiness assessment
• Identify primary productivity suite (M365 or GW)
• Audit SP/Drive permissions
• Identify shadow AI in use (Purview / CASB report)- 1) AI Policy Charter: acceptable use, approved platforms, shadow AI DLP rule, data classification for AI inputs
- 2) Vendor Shortlist Matrix: score each platform against client's compliance, budget, and integration requirements
Phase 2 (Selection)
• Score platforms against this matrix for client specifics
• Run 30-day pilot with 10-20 power users
• Measure: time saved, accuracy, shadow AI reduction- 3) Integration Architecture Diagram: how the chosen platform connects to SP/OneDrive/Teams/Outlook; data flow; permission model
- 4) Pilot Playbook: 30-day pilot guide with prompt templates, use case catalog, and user feedback form
Phase 3 (Governance)
• Enable SSO + SCIM
• Deploy connector allow-list
• Configure audit logs
• Run SP permission remediation (if Copilot)
• Train end users on approved use cases- 5) AI Governance Framework: roles (who approves MCP servers, who reviews connector list), triggers (new feature released = re-review), outcomes (what happens when violation detected)
- 6) Training Playbook: role-specific prompt guide; what NOT to put in AI (PII, confidential data, attorney-client privileged content)
Phase 4 (Optional Maturity)
• Evaluate MCP integration (if high maturity)
• Build custom connectors for internal systems
• Establish ROI measurement program- 7) MCP Governance Standard (only if pursuing Option E): approved server registry, auth requirements, write-action safety rules, red-team schedule
- 8) Quarterly AI Review: new platform features, compliance changes, updated risk signals, usage analytics review
What changed in this refresh
The evidence date and the rebuild date are shown separately at the top of the page on purpose. A rebuild is not new evidence. Each entry below records what the previous version said and what is true now, and marks whether the difference came from the vendor changing something or from the earlier version being wrong.
This is the first public edition. Its change log compares it with the April 2026 working draft, which was not published, so the entries show what that draft said and what the evidence shows now.
| Platform | Topic | Previous version said | As of this refresh | Type | Sources |
|---|---|---|---|---|---|
| All | Personal paid accounts excluded from training? | Row asked "Trains on personal paid accounts?", so "Yes" meant the opposite of the row above it | Row asks "Personal paid accounts excluded from training?". ChatGPT and Gemini cells now name the feedback exception their sources state | Clarified | C23 C35 · OA21 · G17 · PPLX02 |
| M365 Copilot | Personal paid accounts excluded from training? | Consumer Copilot has separate terms; keep work in Entra accounts (cited MS04, which covers work accounts only) | Consumer Copilot trains unless the user opts out; Entra ID sign-ins are excluded | Clarified | MS36 |
| All | Business data excluded from training? | Row asked "Trains on business data?", so every platform's No carried the "not available or high risk" mark and read as a risk | Row asks "Business data excluded from training?", so every platform carries the "supported or strong" mark. No vendor's terms changed; the exceptions stay in each cell | Clarified | C10 · OA11 · MS04 · G05 · PPLX08 |
| Claude | Team pricing | $25/seat | Team Standard $20/seat annual, $25 monthly. Premium seat $100/$125 with 5× usage | Clarified | C01 C02 |
| Claude | Enterprise pricing | ~$50K/ | $20/seat access fee, billed annually, plus all usage at API rates. Minimum 20 seats self-serve or 50 sales-assisted. Older seat-based contracts keep included usage until renewal | Vendor change | C03 |
| Claude | Customer-managed keys | Planned H1 2026 | CMEK generally available for Enterprise: US regions only, cannot be undone, disables exports and chat search, requires ZDR or 30-day retention | Vendor change | C18 |
| Claude | Data residency | US inference only | Data stored in the US; processing routes globally by default. US-only inference available on usage-based Enterprise at 1.1× API rates | Correction | C22 C28 |
| Claude | Zero data retention | Available on API and Enterprise | API only, by agreement. Team and Enterprise chat interfaces are not ZDR-eligible | Correction | C20 |
| Claude | FedRAMP | No: | Claude for Government generally available Sep 30, 2026 (FedRAMP High). Team and Enterprise are not FedRAMP authorized | Vendor change | C21 C40 |
| Claude | SSO | Enterprise only | Team and Enterprise | Correction | C37 |
| Claude | M365 connector | Read-only | Read plus admin-enabled writes: create/ | Vendor change | C05 C26 |
| Claude | Conditional Access | Entra CA honored | MFA and device checks work. Location/ | Correction | C05 |
| Claude | MCP authentication | Static secrets; OAuth 2.1 on roadmap for Q2 2026 | OAuth and API keys supported; Okta-managed authorization generally available on Team and Enterprise | Vendor change | C07 C16 |
| Claude | Connector directory size | 75+ | 914 connectors listed on Oct 7, 2026 | Vendor change | C38 |
| Claude | Malicious skills statistic | Snyk found 30+ malicious skills in community registry | Snyk's Feb 2026 study found 76 malicious skills on OpenClaw's ClawHub, not in Anthropic's directory. Removed from Claude's column | Correction | C48 |
| Claude | Pentagon dispute | Pentagon litigation | Sep 2026: D.C. Circuit (2-1) upheld the Pentagon's supply-chain-risk designation. DoD and its contractors may not use Claude for DoD work; Anthropic is considering further review | Vendor change | C44 |
| Claude | Code leak date | Accidental code release Apr 2026 | Claude Code source leaked Mar 31, 2026; no customer data involved | Correction | C45 |
| Claude | Office add-ins | Add-ins available | Excel, PowerPoint and Word add-ins generally available on paid plans; Outlook add-in in beta. BAA page still treats them as beta and excludes them | Vendor change | C11 C14 |
| ChatGPT | EEA / UK connectors | Not available in EEA/ | Live-app availability depends on plan and location (EEA/ | Correction | OA05 |
| ChatGPT | SharePoint sync residency | US-only; copies files out of tenant | Sync is Enterprise/ | Correction | OA04 OA05 |
| ChatGPT | Office integration | File upload only (no live app embed) | Word, Excel and PowerPoint add-ins generally available. Word add-in enabled by default from Oct 1, 2026 | Vendor change | OA22 OA23 OA24 |
| ChatGPT | Custom GPTs | Not covered | Being retired: new Enterprise GPT creation ends Oct 26, 2026; GPTs become inaccessible Dec 11, 2026 and migrate to plugins | New item | OA26 |
| ChatGPT | Business tiers | Business $20 (cut from $25 in Apr 2026) | Business Standard $20 annual / $25 monthly; Premium seat $100 / $125 added Aug 2026 | Vendor change | OA01 OA28 OA29 |
| ChatGPT | Context window | 128K (GPT-4o); GPT-4.5 extended | Business 54K (fast) / 256K (reasoning). Enterprise 128K / 256K. GPT-4o retired from ChatGPT Feb 2026 | Vendor change | OA03 OA27 |
| ChatGPT | Agent products | Operator + Codex | ChatGPT Work (agent) and Codex included with Business | Vendor change | OA01 |
| ChatGPT | ISO 42001 | Not certified | ISO/ | Clarified | OA12 |
| ChatGPT | FedRAMP | No: | FedRAMP 20x Moderate for a separate ChatGPT Enterprise / API environment (Apr 2026). Business not covered | Vendor change | OA25 |
| ChatGPT | Enterprise floor | ~$108K/ | Custom pricing; no published floor or seat minimum | Correction | OA27 |
| ChatGPT | Business data residency | Not covered | Storage-region choice for Business is rolling out gradually; pricing page still lists residency as Enterprise only | New item | OA10 OA27 |
| M365 Copilot | Entry pricing | $30 add-on on top of M365 | SMB: Copilot Business add-on $21 (up to 300 seats) or bundles $23.50 (Standard) / $32 (Premium). Enterprise add-on remains $30 | Vendor change | MS01 MS13 |
| M365 Copilot | July 2026 increases | E3 +10%, E5 +5% | E3 $36→$39 (+8%), E5 $57→$60 (+5%), Business Standard $12.50→$14, Business Basic $6→$7, Premium unchanged at $22 | Correction | MS02 |
| M365 Copilot | Microsoft 365 E7 | E7 $99/seat announced | Available since May 1, 2026 at $99 ($90.45 without Teams): E5 + Copilot + Agent 365 + Entra Suite | Vendor change | MS23 MS24 MS25 |
| M365 Copilot | Connector count | 1,400+ (Graph + Power Platform + MCP) | Microsoft states 100+ Copilot connectors; Power Platform catalog is separate and not comparable | Correction | MS09 |
| M365 Copilot | Prompt DLP | Purview DLP on Copilot prompts GA Jun 2026 | Label-based blocking generally available; blocking typed sensitive data in prompts still in preview (page updated Oct 5, 2026) | Correction | MS06 |
| M365 Copilot | HIPAA prerequisite | HIPAA requires E5 + Defender | Copilot and Copilot Chat are in HIPAA scope with the BAA offered by default; no E5 or Defender prerequisite stated | Correction | MS08 |
| M365 Copilot | Copilot Studio MCP | GA 2026 | Generally available since May 29, 2025; federated connector write actions rolling out from early Oct 2026 | Correction | MS10 MS32 |
| M365 Copilot | Adoption figure | 3.3% conversion | Microsoft reports over 30 million paid Copilot seats (Jul 2026) | Vendor change | MS35 |
| M365 Copilot | Oversharing statistic | 73% of enterprises discover exposure risks post-deploy | Removed: no source found. The oversharing risk itself stands and is in Microsoft's own guidance | Correction | MS15 |
| M365 Copilot | Zero data retention | N/ | No ZDR. Prompts and responses are stored for history and compliance | Correction | MS04 |
| M365 Copilot | Agents | Copilot Studio + Agent 365 agents | Cowork generally available Jun 2026 (metered); Agent 365 is a $15/user governance control plane, generally available May 1, 2026 | Vendor change | MS26 MS27 MS28 |
| Gemini | FedRAMP | Pursuing | FedRAMP High for Gemini in Workspace and the Gemini app (Mar 2025) | Correction | G05 G32 |
| Gemini | Third-party connectors | Salesforce via Workspace; HubSpot limited | Sep 15, 2026: Salesforce, HubSpot, Asana, Atlassian Rovo, Monday, QuickBooks and Mailchimp connectors for Business Standard/ | Vendor change | G27 |
| Gemini | Workspace Studio | Not covered | Sep 17, 2026: Slack, Jira, Confluence, HubSpot, Salesforce and other steps plus webhooks in all Business editions, OFF by default | New item | G28 |
| Gemini | NotebookLM | NotebookLM bundled | Renamed Gemini Notebook (Jul 16, 2026). Not covered by the BAA, SOC, ISO or FedRAMP | Vendor change | G05 G29 |
| Gemini | Context window | 1-2 million tokens | 1M tokens on Business Standard/ | Correction | G03 |
| Gemini | Agentspace | Agentspace / Gemini Enterprise | Agentspace is now Gemini Enterprise, a separate subscription from $21/seat | Vendor change | G06 G18 |
| Gemini | SharePoint access | Sites.Selected: granular, least privilege | Only through Gemini Enterprise; selected sites still need a FullControl grant to the app on each site | Correction | G08 |
| Gemini | Teams | Third-party connector | First-party Gemini Enterprise connector (can send messages); none in bundled Workspace | Correction | G21 |
| Gemini | Context-Aware Access | Context-Aware Access (CAA) | Not available in any Business edition, Business Plus included; requires Enterprise or equivalent editions | Clarified | G30 |
| Perplexity | ISO 27001 | Not confirmed | ISO/ | Correction | PPLX16 |
| Perplexity | FedRAMP | No: | FedRAMP 20x Low (Class B), certified Feb 1, 2026 | Correction | PPLX17 |
| Perplexity | Teams | No native Teams connector | Teams app (runs Computer tasks) and a Teams connector that searches chats the user can see | Vendor change | PPLX10 |
| Perplexity | Admin controls threshold | Enterprise controls require 50+ seats | Help center: SCIM, audit logs and retention need 50 seats or one Enterprise Max seat. A reported Aug 2026 pricing page marks them 'contract required'. Confirm in writing | Vendor change | PPLX13 PPLX14 PPLX21 |
| Perplexity | MCP direction | Pivoting away from MCP; Agent API replacing it | Products still ship an MCP client and official MCP server. CTO reportedly described an internal shift to APIs/ | Clarified | PPLX11 PPLX22 |
| Perplexity | File limits | 15K files (Pro) / 50K files (Max) | Projects: 5,000 files, 2.5 GB, 100 MB per file. Organization file repository retired Oct 1, 2026 | Vendor change | PPLX04 |
| Perplexity | Write actions | Research only, no write actions | Computer agent performs write-capable tasks across Gmail, Outlook, Slack, Salesforce and other apps | Vendor change | PPLX06 |
| Perplexity | Litigation | NYT + 6 other lawsuits (incl. Reuters) | Active suits include NYT, CNN, Dow Jones/ | Correction | PPLX23 PPLX24 |
| Perplexity | Enterprise floor | ~$24K/ | No purchase minimum published; $24K is the cost of reaching the 50-seat control threshold at monthly rates | Correction | PPLX01 |
| Perplexity | HIPAA | Contractual only (50+ seats) | Executed BAA required; no public seat minimum | Correction | PPLX08 |
Open questions
Where vendor documentation conflicts with itself or says nothing, the matrix records the gap and leaves the answer open. These are the questions to put to the vendor in writing before purchase.
| Platform | Topic | What the research found | What to confirm | Status | Sources |
|---|---|---|---|---|---|
| Perplexity | Pricing and control threshold | Help center lists $40/mo or $400/yr (Pro) and $325/mo or $3,250/yr (Max), with SCIM/audit/retention at 50 seats or one Max. A reported Aug 2026 pricing page shows annual-only $34/$271 and 'contract required' | Get current price sheet and the exact entitlement for SCIM, audit logs and retention in writing | Open | PPLX01 PPLX13 PPLX21 |
| Perplexity | BAA availability | Terms require an executed BAA for PHI; third-party sources disagree on whether one is offered | Ask whether a BAA is available for your tier and which features it covers | Open | PPLX08 |
| Claude | M365 connector in EEA/UK | Anthropic's connector pages neither restrict nor confirm EEA/UK availability | Confirm availability and data handling for EU/UK tenants before promising it | Open | C05 C26 |
| Claude | Office add-ins and HIPAA | Add-ins are generally available, but the BAA page still lists 'Claude in Office' as beta and excluded | Treat as not covered until Anthropic confirms in writing | Open | C11 C14 |
| Claude | Pentagon designation | Appeals court upheld the designation in Sep 2026; Anthropic is considering further review | Defense supply-chain organizations: confirm contractual restrictions before any Claude use on DoD work | Monitor | C44 |
| ChatGPT | Business retention and residency | Privacy page says Business admins can control retention; help articles don't document it. Business storage residency is still rolling out | Check the Business admin console and contract before promising retention or residency | Open | OA10 OA11 OA19 |
| M365 Copilot | Federated connector writes | Write, update and delete actions 'begin rolling out in early October 2026' | Confirm availability in your tenant before relying on write actions | Monitor | MS10 |
| M365 Copilot | Cowork and EU Data Boundary | Anthropic models are excluded from the EU Data Boundary; Cowork can now run on GPT models, but no page states its boundary status on GPT | Confirm with Microsoft for EU/EFTA tenants | Open | MS11 MS17 |
| Gemini | Gemini Enterprise seat cap | Product page and FAQ say up to 300 seats for Business; editions documentation says 1-500. Billing term not published | Get a quote that states the seat cap and term | Open | G06 G25 G36 |
| All | Certification scope | Certificates and SOC reports name specific services; new agents and preview features are often outside scope | Request current reports and confirm the exact products and features you will deploy are listed | Ongoing | C09 · OA12 · MS22 · G18 · PPLX16 |
Methodology and limitations
Facts come from vendor pricing pages, help centres, documentation, trust centres and official announcements, opened and read on the date recorded against each source. Press reporting is used only for dated events such as lawsuits, incidents and court rulings, and third-party captures only to flag a conflict that the vendor has not resolved. Each is labelled with its type in the source list.
The matrix records what vendors document and what reporting establishes. It does not measure answer quality, and it cannot tell you how a platform will perform on your own data, which is what a bounded pilot is for. Vendor documentation also changes without notice, which is the reason the page is refreshed on a schedule and states the date its evidence was checked.
The matrix is free to use with attribution under CC BY 4.0. Corrections are welcome and useful, particularly from vendors who can point to documentation that shows a row is out of date. There is more about me on the about page.
- C01 Claude pricing Published business prices and plan control comparison. Checked 2026-10-07.
- C02 What is the Team plan? Team seat prices, 2-150 seats, included Claude Code and Cowork, SSO, usage multiples. Checked 2026-10-07.
- C03 What is the Enterprise plan? Access-plus-metered-usage Enterprise; published seat minimums. Checked 2026-10-07.
- C04 How large is the context window on paid Claude plans? Model and surface specific context limits; compaction. Checked 2026-10-07.
- C05 Microsoft 365 connector security guide Architecture, delegated permissions, retention, actions and Conditional Access. Checked 2026-10-07.
- C06 Use Google Workspace connectors Google connector operations, permission mirroring and stored chat data. Checked 2026-10-07.
- C07 Get started with custom connectors using remote MCP Current OAuth and fixed credentials, cloud networking and tool safeguards. Checked 2026-10-07.
- C08 Use Claude Cowork on Team and Enterprise plans Cloud/local execution, organization controls and monitoring coverage. Checked 2026-10-07.
- C09 What Certifications has Anthropic obtained? Verified SOC 2 and ISO security/AI management credentials. Checked 2026-10-07.
- C10 Is my data used for model training? (commercial) Commercial input/output training excluded by default; consent/feedback exceptions. Checked 2026-10-07.
- C11 Business Associate Agreements (BAA) for Commercial Customers Required HIPAA setup and feature-specific BAA coverage. Checked 2026-10-07.
- C12 Compliance API Enterprise Compliance API: programmatic access to chats, files and projects. Checked 2026-10-07.
- C13 Models overview Current API model lineup and modalities. Checked 2026-10-07.
- C14 Claude for Microsoft 365 Office add-in availability and cloud-provider deployments. Checked 2026-10-07.
- C15 Use Claude in Google Docs, Sheets, and Slides Separate Google sidebar beta and feature-level data controls. Checked 2026-10-07.
- C16 Centrally manage authorization for MCP connectors Enterprise-managed authorization GA with Okta and supported connectors. Checked 2026-10-07.
- C17 MCP tunnels Preview private-network transport only for API and Managed Agents. Checked 2026-10-07.
- C18 Customer-managed encryption keys Eligible key-management providers, coverage and limitations. Checked 2026-10-07.
- C19 Configure custom data retention controls for Enterprise plans Enterprise chat/project expiry and excluded products. Checked 2026-10-07.
- C20 API and data retention API retention and ZDR/BAA feature eligibility. Checked 2026-10-07.
- C21 Claude for Government is now generally available Government offering GA in a FedRAMP High environment. Checked 2026-10-07.
- C22 Where are your servers located? Do you host your models on EU servers? US storage and global processing locations. Checked 2026-10-07.
- C23 Is my data used for model training? (consumer) Consumer user-selected training and safety exceptions. Checked 2026-10-07.
- C24 Manage usage credits for Team and seat-based Enterprise plans Team prepaid extra use at API rates after included limits. Checked 2026-10-07.
- C26 Connect to Microsoft 365 File formats and retrieval limitations. Checked 2026-10-07.
- C27 Create and edit files with Claude Downloadable Office/PDF files, code/chart outputs and file-size maximum. Checked 2026-10-07.
- C28 Enable US-only inference for your organization Enterprise US-only inference scope and surcharge. Checked 2026-10-07.
- C29 How long do you store my organization's data? Commercial saved-chat and deletion retention. Checked 2026-10-07.
- C31 Retrieve session transcripts Session endpoint coverage, read-only behavior and transcript retention. Checked 2026-10-07.
- C32 Access audit logs 180-day CSV audit lookback excludes chat content. Checked 2026-10-07.
- C33 Inference hooks overview Customer policy checks before inference, currently beta. Checked 2026-10-07.
- C35 Updates to Consumer Terms and Privacy Policy Training preference requires user choice. Checked 2026-10-07.
- C37 Set up single sign-on (SSO) Explicit Team and Enterprise SSO availability; SAML identity-provider setup. Checked 2026-10-07.
- C38 Connectors and plugins | Claude Marketplace Connector directory: HubSpot, monday.com, Slack, Notion, Atlassian, Supabase, Linear; 914 connectors on Oct 7, 2026. Checked 2026-10-07.
- C40 Public sector FAQs Claude for Government is Anthropic's FedRAMP High authorized product. Checked 2026-10-07.
- C41 Compliance API integrations eDiscovery (Relativity, Smarsh) and DLP partners via the Compliance API. Checked 2026-10-07.
- C42 Donating the Model Context Protocol and establishing the Agentic AI Foundation MCP donated to the Linux Foundation's Agentic AI Foundation, Dec 9, 2025. Checked 2026-10-07.
- C43 Compliance API now covers Cowork and Claude Code Session and tool-call capture for Cowork and Claude Code. Checked 2026-10-07.
- C44 Federal court says Pentagon can label Anthropic a supply chain risk (Broadband Breakfast) Press D.C. Circuit 2-1 ruling, Sep 2026; DoD and contractors barred from using Claude for DoD work. Checked 2026-10-07.
- C45 Claude Code source code leak (The Register) Press Mar 31, 2026 source leak via npm source map; no customer data. Checked 2026-10-07.
- C46 Anthropic exposed nearly 3,000 internal files in CMS misconfiguration (Techloy) Press Mar 2026 website CMS exposure of draft files. Checked 2026-10-07.
- C47 Claude subscriptions no longer cover OpenClaw (TechRadar) Press Apr 4, 2026 change: third-party tools removed from subscription limits. Checked 2026-10-07.
- C48 ToxicSkills: malicious AI agent skills on ClawHub (Snyk) Press Feb 5, 2026 study: 76 malicious skills on OpenClaw's ClawHub/skills.sh. Checked 2026-10-07.
- OA01 ChatGPT Business overview Business Standard $20 annual / $25 monthly; Premium $100 / $125; 2-seat minimum; Work and Codex included; API billed separately. Checked 2026-10-07.
- OA02 Sign up for ChatGPT Business Business supports up to 200 paid seats; Standard and Premium both count. Checked 2026-10-07.
- OA03 Business models and limits Business model menu (GPT-5.6, GPT-6 families), per-model usage limits, Premium 5x usage. Checked 2026-10-07.
- OA04 SharePoint app and setup SharePoint live access vs Enterprise/Edu admin sync; Sites.FullControl.All; 100 MB synced-file limit. Checked 2026-10-07.
- OA05 Administrator-managed apps with sync Admin-managed sync: residency regions supported for SharePoint/Teams (EEA+CH, Japan, US). Checked 2026-10-07.
- OA06 Microsoft Teams app and setup Teams app actions (send, Planner) and read-only Enterprise/Edu index. Checked 2026-10-07.
- OA07 Outlook Email and Calendar apps Outlook email (search, contacts, send plain text) and calendar (read/write) apps. Checked 2026-10-07.
- OA08 Admin controls for plugins and apps Admin app/action controls and approval levels; Drive covers Docs/Sheets/Slides actions. Checked 2026-10-07.
- OA09 Data and inference residency Enterprise/Edu: 10 storage regions; inference residency in Europe, US, UAE. Checked 2026-10-07.
- OA10 Business content storage Business storage-region choice rolling out; excludes inference; temporary US copies. Checked 2026-10-07.
- OA11 Enterprise privacy Business/Enterprise excluded from training by default; DPA; retention statements. Checked 2026-10-07.
- OA12 Security and privacy SOC 2 Type 2; ISO 27001 scope (API, Enterprise, Edu); ISO 42001. Checked 2026-10-07.
- OA13 HIPAA eligible functionality BAA-eligible products (Healthcare, Regulated Workspace and others) and excluded features. Checked 2026-10-07.
- OA14 SCIM provisioning SCIM not included in standalone Business; supported on Enterprise/Edu. Checked 2026-10-07.
- OA15 SSO setup SAML SSO on Business and Enterprise; domain verification. Checked 2026-10-07.
- OA16 Compliance Platform Compliance Platform (Enterprise/Edu): log export to SIEM/eDiscovery/DLP; 30-day retention. Checked 2026-10-07.
- OA17 Enterprise Key Management EKM for Enterprise/Edu with AWS, Google Cloud or Azure keys; alpha/beta features disabled. Checked 2026-10-07.
- OA18 Developer mode and MCP apps Developer mode: MCP apps with read/write (beta), OAuth, Secure MCP Tunnel, prompt-injection warning. Checked 2026-10-07.
- OA19 Business data and sharing Business: no bulk export or workspace-wide shared-link disable; event-triggered tasks. Checked 2026-10-07.
- OA20 Uploading files and audio Upload limits: 512 MB and 2M tokens per document; spreadsheets about 50 MB. Checked 2026-10-07.
- OA21 Consumer training controls Consumer plans may train unless the user opts out; feedback exception. Checked 2026-10-07.
- OA22 ChatGPT for Word ChatGPT for Word: all plans; enabled by default from Oct 1, 2026. Checked 2026-10-07.
- OA23 ChatGPT for Excel and Google Sheets ChatGPT for Excel and Google Sheets sidebars. Checked 2026-10-07.
- OA24 ChatGPT for PowerPoint ChatGPT for PowerPoint sidebar. Checked 2026-10-07.
- OA25 FedRAMP Moderate offering FedRAMP 20x Moderate for a separate ChatGPT Enterprise / API environment. Checked 2026-10-07.
- OA26 Custom GPT retirement and migration FAQ Enterprise GPT creation ends Oct 26, 2026; GPTs inaccessible Dec 11, 2026; migrate to plugins. Checked 2026-10-07.
- OA27 ChatGPT Business and Enterprise pricing Context windows by plan (Business 54K/256K, Enterprise 128K/256K); residency listed for Enterprise only; Enterprise custom pricing. Checked 2026-10-07.
- OA28 Premium seats for ChatGPT Business Premium seat launch Aug 2026; 5x usage. Checked 2026-10-07.
- OA29 Codex flexible pricing for teams Apr 2, 2026: Business annual price lowered from $25 to $20. Checked 2026-10-07.
- OA30 Expanding on what we missed with sycophancy Apr 2025 GPT-4o update rolled back. Checked 2026-10-07.
- OA31 Mixpanel security incident Nov 2025 vendor breach exposed API user profile data; no chats or keys. Checked 2026-10-07.
- OA32 OpenAI patches ChatGPT data exfiltration flaw (The Hacker News) Press Check Point finding patched Feb 20, 2026; no known exploitation. Checked 2026-10-07.
- OA33 OpenAI's mission statement has changed six times (Fortune) Press Mission statement changes in IRS filings. Checked 2026-10-07.
- OA34 Built to benefit everyone Oct 2025 recapitalization: OpenAI Group PBC controlled by the OpenAI Foundation. Checked 2026-10-07.
- OA35 GPT-6 Astra GPT-6 Astra rolling out to Plus, Pro, Business and Enterprise. Checked 2026-10-07.
- OA36 ChatGPT release notes Dated product changes, including add-in GA dates and Slack/Gmail/GitHub task triggers. Checked 2026-10-07.
- OA37 ChatGPT plugins directory Current app/plugin directory; no official total. Checked 2026-10-07.
- OA38 Summary judgment briefing starts in OpenAI MDL litigation (ChatGPT Is Eating the World) Press Consolidated copyright cases including NYT v. OpenAI in summary judgment briefing, Sep 2026. Checked 2026-10-07.
- MS01 Microsoft Copilot Plans and Pricing: AI for Business Business add-on, bundle, commitment, promotion and eligibility prices. Checked 2026-10-07.
- MS02 Microsoft 365 Pricing and Packaging Updates July 2026 base-suite prices and packaging. Checked 2026-10-07.
- MS03 What is Microsoft Copilot? Basic versus premium grounding, model routing, independent GitHub product. Checked 2026-10-07.
- MS04 Data, Privacy, and Security for Microsoft Copilot Graph grounding, permissions, no training, stored interactions, model exceptions. Checked 2026-10-07.
- MS05 Use Microsoft Purview to manage data security & compliance for Microsoft 365 Copilot & Microsoft 365 Copilot Chat Audit, labels, Customer Key, eDiscovery and retention. Checked 2026-10-07.
- MS06 Microsoft Purview DLP for Microsoft 365 Copilot and Cowork Precise DLP coverage, previews and limitations. Checked 2026-10-07.
- MS07 Understand Microsoft U.S. government cloud environments for Microsoft 365 and Microsoft Copilot GCC, GCC High, DoD boundaries and differing availability. Checked 2026-10-07.
- MS08 HIPAA & HITECH Act - Microsoft Compliance In-scope Copilot and Copilot Chat and default BAA. Checked 2026-10-07.
- MS09 Copilot connectors overview Synced vs federated connectors; 100+ prebuilt connectors. Checked 2026-10-07.
- MS10 Federated connectors overview Federated (MCP) connectors: OAuth, admin staging, approvals; writes rolling out early Oct 2026. Checked 2026-10-07.
- MS11 Anthropic models in Microsoft Online Services Subprocessor, regional exclusions and distinct retention-enabled models. Checked 2026-10-07.
- MS12 Flex routing (EU and EFTA) Optional inference geography and defaults. Checked 2026-10-07.
- MS13 Microsoft Copilot Plans and Pricing: Enterprise Enterprise annual $30 add-on and separate qualifying base. Checked 2026-10-07.
- MS14 Copilot Studio Licensing Guidance Credit pricing, included user rights, separate Power Platform catalog. Checked 2026-10-07.
- MS15 Apply Zero Trust principles to Microsoft Copilot Conditional Access and identity protection depend on base licenses. Checked 2026-10-07.
- MS16 Connect your agent to an existing MCP server Copilot Studio MCP authentication and data-policy scope. Checked 2026-10-07.
- MS17 Manage Copilot Cowork for your organization Usage billing, model controls and temporary runtime boundary. Checked 2026-10-07.
- MS18 Data Residency for Microsoft 365 Copilot (including Cowork) Cowork interaction-at-rest country commitments versus workspace storage. Checked 2026-10-07.
- MS19 June 2026 Partner Center announcements: New Microsoft 365 Business with Copilot SKUs available July 1 Durable Standard and Premium bundles, distinct temporary promotions. Checked 2026-10-07.
- MS21 ISO 42001 service scope Named Microsoft AI services in ISO 42001 scope; request current certificate/report. Checked 2026-10-07.
- MS22 SOC 2 Type 2 service scope Office 365/Microsoft online-service audit scope; current reports available via Service Trust Portal. Checked 2026-10-07.
- MS23 Microsoft 365 Enterprise plans and pricing E3 $39, E5 $60, E7 $99 (with Teams). Checked 2026-10-07.
- MS24 Microsoft 365 E7 E7 contents: E5, Copilot, Agent 365, Entra Suite. Checked 2026-10-07.
- MS25 Introducing the first Frontier Suite Mar 9, 2026 announcement of E7, Agent 365 and Cowork. Checked 2026-10-07.
- MS26 Microsoft Agent 365 overview Agent 365 as a control plane to observe, govern and secure agents. Checked 2026-10-07.
- MS27 Microsoft 365 additional services pricing Agent 365 $15, Entra Suite $12, Copilot $30. Checked 2026-10-07.
- MS28 Copilot Cowork is now generally available Cowork GA Jun 16, 2026; metered usage. Checked 2026-10-07.
- MS29 Copilot Business FAQ Copilot Business up to 300 seats per tenant. Checked 2026-10-07.
- MS30 Microsoft-built Copilot connectors gallery Salesforce, GitHub, Azure DevOps, Jira, Confluence, Google Drive, Azure SQL, Oracle SQL connectors. Checked 2026-10-07.
- MS31 Partner-built Copilot connectors gallery Slack connectors are partner-built (RheinInsights, ServiceNow). Checked 2026-10-07.
- MS32 MCP is now generally available in Copilot Studio Copilot Studio MCP GA May 29, 2025. Checked 2026-10-07.
- MS33 Advanced Data Residency ADR add-on country list. Checked 2026-10-07.
- MS34 Microsoft 365 Copilot service description Feature availability by cloud, including GCC High and DoD gaps. Checked 2026-10-07.
- MS35 FY26 Q4 earnings release Over 30 million paid Copilot seats (Jul 29, 2026). Checked 2026-10-07.
- MS36 Privacy FAQ for Microsoft Copilot Consumer Copilot conversations train models unless the user opts out; Entra ID sign-ins, signed-out users, under-18s and some countries excluded. Checked 2026-10-07.
- G01 Google Workspace business plans Regular annual/flexible USD pricing, pooled storage, user limits, Vault and Enterprise controls. Checked 2026-10-07.
- G02 Compare Business editions Edition-specific AI capabilities, quotas and SSO. Checked 2026-10-07.
- G03 Use Gemini Apps with a work or school Google Account Workspace Gemini app context, limits, terms and history controls. Checked 2026-10-07.
- G04 Use Gemini Notebook with a work or school Google account Notebook edition access, limits and enterprise data protection. Checked 2026-10-07.
- G05 Generative AI in Google Workspace Privacy Hub Training, retention, audit, DLP/CSE, certifications and Notebook/Chrome exclusions. Checked 2026-10-07.
- G06 Gemini Enterprise app Separate app product, starting seat prices, tier controls and no training. Checked 2026-10-07.
- G07 Introduction to connectors and data stores Federation/ingestion data flow, regions, storage and sync semantics. Checked 2026-10-07.
- G08 Microsoft SharePoint configuration Entra app/scopes, consent, selected-site FullControl requirement. Checked 2026-10-07.
- G09 Set up a Microsoft SharePoint data store Store modes, scope filters, sync configuration and real-time preview exclusions. Checked 2026-10-07.
- G10 Configure identity provider Source permissions, access-controlled stores, Microsoft ingestion Entra/WIF and SCIM. Checked 2026-10-07.
- G11 Set up your custom MCP server connection Enterprise Business custom MCP UI, Pre-GA terms and transport/auth constraints. Checked 2026-10-07.
- G12 Data covered by data regions Gemini prompts/responses covered at rest/processing; excluded logs/cache. Checked 2026-10-07.
- G13 Compare data region features across Google Workspace editions Fundamental at-rest versus higher-tier processing policy availability. Checked 2026-10-07.
- G14 Retain Gemini app messages with Vault Retention/hold overrides and Gemini app eDiscovery. Checked 2026-10-07.
- G15 Get started with Inbound SCIM SCIM 2.0 users/groups and manual admin synchronization limitation. Checked 2026-10-07.
- G16 Use apps connected to Gemini with a work or school Google Account Connected app actions, prerequisites and unsupported operations. Checked 2026-10-07.
- G17 Gemini Apps Privacy Hub Personal-account training/activity settings, feedback and 72-hour retention. Checked 2026-10-07.
- G18 SOC 2 compliance SOC 2 Type II reports (quarterly); scope lists Gemini app and Gemini in Workspace. Checked 2026-10-07.
- G20 Choose your Gemini Enterprise edition Explicit Workspace/Enterprise/consumer product distinctions. Checked 2026-10-07.
- G21 Connect your Google apps and third-party data Enterprise Business supported connectors and write actions. Checked 2026-10-07.
- G22 Microsoft SharePoint connector overview Federated search limitations, locations and supported actions. Checked 2026-10-07.
- G23 MCP servers with Gemini CLI Developer CLI MCP transports, OAuth and server/tool allowlists. Checked 2026-10-07.
- G24 HIPAA compliance on Google Cloud and Google Workspace BAA included services and Chrome exclusion; Cloud Notebook Enterprise is separate. Checked 2026-10-07.
- G25 Compare Gemini Enterprise editions Edition-specific user bounds, indexing allowances and controls; Business lists 1-500 users. Checked 2026-10-07.
- G26 About Workspace client-side encryption CSE supported in Frontline Plus, Enterprise Plus, Education Standard and Education Plus. Checked 2026-10-07.
- G27 Connect to more tools with Gemini in Google Workspace Sep 15, 2026: seven third-party MCP connectors, ON by default. Checked 2026-10-07.
- G28 Third-party integrations and webhooks in Workspace Studio Sep 17, 2026: Slack, Jira, Confluence, HubSpot, Salesforce steps; OFF by default. Checked 2026-10-07.
- G29 NotebookLM is now Gemini Notebook Rename on Jul 16, 2026. Checked 2026-10-07.
- G30 Protect your business with Context-Aware Access Editions that include Context-Aware Access (no Business editions). Checked 2026-10-07.
- G31 Manage Gemini in Workspace conversation history Side panel history: 90, 540 or 1,080 days, never, or user choice. Checked 2026-10-07.
- G32 Gemini in Workspace apps and the Gemini app achieve FedRAMP High FedRAMP High authorization, Mar 2025. Checked 2026-10-07.
- G33 HIPAA and more ISO certifications for the Gemini app ISO 42001; Google's 'first in the industry' claim (Dec 2024). Checked 2026-10-07.
- G34 AI features and pricing updates for Business editions Gemini included since Jan 2025; current Business prices. Checked 2026-10-07.
- G35 AI Expanded Access Quota add-on; Starter promotional access ends Nov 1, 2026. Checked 2026-10-07.
- G36 Gemini Enterprise FAQ Gemini Enterprise Business 'up to 300 seats'; separate product. Checked 2026-10-07.
- G37 Gemini release notes Model releases and renames (Gems to Skills, Sep 2026). Checked 2026-10-07.
- G38 Configure Google Workspace MCP servers Workspace remote MCP servers in developer preview. Checked 2026-10-07.
- PPLX01 Enterprise Pricing and Billing: Frequently Asked Questions Exact seat prices, purchased-seat billing and separate API charges. Checked 2026-10-07.
- PPLX02 Which Perplexity Subscription Plan is right for you? Plan comparison: allowances, multi-model access, consumer vs Enterprise training terms. Checked 2026-10-07.
- PPLX03 Using File Connectors in Perplexity File connectors distinguish live retrieval, session snapshots and static imports. Checked 2026-10-07.
- PPLX04 Enterprise file limits Current storage limits and retired organization repository. Checked 2026-10-07.
- PPLX05 Data Retention for Enterprise Attachment deletion differs from session and persistent file retention. Checked 2026-10-07.
- PPLX06 Computer for Enterprise Agent actions, integrations, sandboxing, audit inheritance and administrator controls. Checked 2026-10-07.
- PPLX08 Perplexity Enterprise Terms and Conditions Customer-content no-training commitment, executed BAA prerequisite and source-verification obligation. Checked 2026-10-07.
- PPLX09 Adding Custom Remote Connectors MCP transports, authentication, admin governance and managed PrivateLink. Checked 2026-10-07.
- PPLX10 Using Perplexity in Microsoft Teams Teams app and connector, native permissions and transient query context. Checked 2026-10-07.
- PPLX11 Perplexity API MCP Server Hosted/local MCP tools use Search API and Agent API presets. Checked 2026-10-07.
- PPLX12 How credits work for Enterprise organizations: admin guide Included 500/15,000 monthly credits, pools, expiry and administrator spend limits. Checked 2026-10-07.
- PPLX13 SCIM-based user account management SCIM for organizations with 50+ seats or at least one Enterprise Max user. Checked 2026-10-07.
- PPLX14 Audit logs Audit logs (same threshold); connector and Computer events; Splunk/webhook streaming. Checked 2026-10-07.
- PPLX15 SSO integration: getting started SSO on Enterprise Pro; SAML/OIDC; one IdP per organization. Checked 2026-10-07.
- PPLX16 Perplexity security SOC 2 Type 2 and ISO/IEC 27001:2022 claims. Checked 2026-10-07.
- PPLX17 FedRAMP Marketplace: Perplexity Enterprise and API Platform FedRAMP 20x Low (Class B), certified Feb 1, 2026. Checked 2026-10-07.
- PPLX18 Advanced AI models included in your subscription Model list as of Sep 4, 2026. Checked 2026-10-07.
- PPLX19 Data Processing Addendum DPA (Aug 13, 2026) with EU SCCs and UK addendum. Checked 2026-10-07.
- PPLX20 CrowdStrike and Perplexity extend security to Comet Enterprise Opt-in Falcon integration for Comet data-movement control (Mar 2026). Checked 2026-10-07.
- PPLX21 Perplexity pricing page capture, Aug 14, 2026 (usagepricing.com) Third-party Reported annual-only $34/$271 and 'contract required' controls; unconfirmed. Checked 2026-10-07.
- PPLX22 Perplexity drops MCP internally (Noqta) Press Reported CTO remarks at Ask 2026 (Mar 11, 2026); secondary source. Checked 2026-10-07.
- PPLX23 The New York Times is suing Perplexity (TechCrunch) Press NYT copyright suit, Dec 2025. Checked 2026-10-07.
- PPLX24 The Perplexity docket (TechJack Solutions) Press Publisher suits including CNN (May 2026). Checked 2026-10-07.
- PPLX25 Lawsuit claims Perplexity shared AI chat data (PPC Land) Press Doe v. Perplexity AI, N.D. Cal., filed Mar 31, 2026 (allegation). Checked 2026-10-07.
- PPLX26 API privacy and security Chat Completions API data not retained. Checked 2026-10-07.