Microsoft 365 Privacy Controls: Setup, Policies, and Admin Configuration Guide 2026

Before touching any policy, confirm you're actually working with a version that has the updated privacy controls architecture. The full diagnostic data level controls and connected experience policies were introduced in Microsoft 365 Apps for enterprise Version 1904. Running anything older means you're looking at a different, and less granular, control surface.

Open Word, go to File → Account, and look at the "About Word" section. You'll see something like "Version 2403 (Build 17425.20176 Click-to-Run)". The four-digit version number is what matters. If it reads 1904 or higher, you're in the right place. If you see a version like 1808 or 1902, you need to update before the privacy controls in this guide apply.

For enterprise-wide checking, run this PowerShell one-liner against a list of machines:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" `
  -Name VersionToReport | Select-Object VersionToReport

This reads the Click-to-Run registry key and returns the exact build string. Compare the first four digits of the version against 1904. Anything below that on a production machine is a version currency problem, not a privacy controls problem, and you'll need to address update channel configuration before the rest of this guide applies.

Also confirm the product type. The full privacy control policy set applies to Microsoft 365 Apps for enterprise (formerly Office 365 ProPlus). Office 2019 perpetual licenses and Microsoft 365 Apps for business have different, and in some cases, more limited, policy availability. The label in File → Account under "Product Information" will tell you exactly which SKU you're working with.

If everything checks out, version 1904+, Microsoft 365 Apps for enterprise, proceed to the next step. You've confirmed the foundation is in place.

Even if you plan to manage everything through Group Policy, start by looking at what the current per-machine state looks like at the user level. This gives you a baseline before you push any policies, and it's the fastest way to confirm whether existing GPOs are already doing something.

In any Office app, navigate to File → Options → Trust Center → Trust Center Settings → Privacy Options. This is slightly different from the File → Account → Manage Settings path, this one gives you the full Trust Center view, where you can see all connected experience toggles in one place, not just the quick-access panel.

Look at each setting carefully:

• Diagnostic data: Is the radio button set to Required, Optional, or Neither? Is it grayed out? Grayed out means a policy is controlling it.
• Connected experiences that analyze content: Is the checkbox checked and editable?
• Connected experiences that download online content: Same question.
• All connected experiences: There's a master toggle that disables everything including document coauthoring and online file storage. Note that even with this master toggle off, certain functionality stays active, Outlook mail sync, Teams, Skype for Business, and what Microsoft calls "essential services" continue to run.

Document what you see before making changes. Take a screenshot. If you're troubleshooting a compliance audit, you want a before/after record. If everything is grayed out, note that too, it tells you a GPO is already in play and you need to find it before adding a new policy that might conflict.

When the settings are correctly configured and editable, users signed in with a personal Microsoft account can adjust them. Users signed in with organizational credentials, your typical work accounts, cannot change these settings. The IT admin owns this configuration entirely for org-managed accounts.

This is where you get org-wide control. To manage Microsoft 365 Apps privacy settings through Group Policy, you first need the correct ADMX templates installed on your Domain Controller or central policy store. Download the Microsoft 365 Apps Administrative Templates (admintemplates_x64.exe or x86, depending on your architecture) from the Microsoft Download Center. Extract them and copy the ADMX files to %SystemRoot%\PolicyDefinitions and the ADML language files to the appropriate locale folder (e.g., en-US).

Open Group Policy Management Console (GPMC). Create or edit a GPO linked to the OU containing your Office users. Navigate to:

User Configuration
  └─ Administrative Templates
       └─ Microsoft Office 2016
            └─ Privacy
                 └─ Trust Center

The key policy setting for diagnostic data is "Configure the level of client software diagnostic data sent by Office to Microsoft". Double-click it. Set it to Enabled, then choose the level from the dropdown:

• 0, Neither (no diagnostic data, but required service data still flows)
• 1, Required only
• 2, Optional (includes Required; this is the default if no policy is set)

The equivalent registry value that this policy writes is:

HKEY_CURRENT_USER\Software\Policies\Microsoft\office\16.0\common\privacy
Value name: sendtelemetry
Type: REG_DWORD
Data: 0 (Neither) | 1 (Required) | 2 (Optional)

After applying the GPO, run gpupdate /force on a test machine, then reopen Word and check File → Options → Trust Center → Trust Center Settings → Privacy Options. The diagnostic data control should now be grayed out and showing your selected level, confirming the policy took effect.

Here's where a lot of admins miss something critical: diagnostic data and connected experiences are controlled by separate policy settings. Locking down diagnostic data doesn't touch connected experiences, and vice versa. You need to configure both independently if your compliance posture requires it.

In the same GPO, still under User Configuration → Administrative Templates → Microsoft Office 2016 → Privacy → Trust Center, you'll find these connected experience policies:

• "Allow the use of connected experiences in Office that analyze content", Controls features like PowerPoint Designer, Editor grammar and style suggestions, Excel data insights, and Translator. Set to Disabled to prevent these features from running.
• "Allow the use of connected experiences in Office that download online content", Controls access to online templates, stock images, 3D models from the online library, and PowerPoint QuickStarter. Set to Disabled to block these.
• "Allow the use of additional optional connected experiences in Office", This covers optional connected experiences not included in your organization's commercial agreement with Microsoft, like the 3D Maps feature in Excel (which uses Bing). These are governed by separate terms and conditions from the main Microsoft 365 agreement. Setting this to Disabled prevents users from accessing them with their organizational account.
• "Allow the use of connected experiences in Office", This is the master switch. Disabling it turns off all connected experiences at once, including document coauthoring and online file storage. Be careful: this has a wide blast radius and will confuse users who suddenly can't co-author a SharePoint document.

The corresponding registry paths follow the pattern:

HKEY_CURRENT_USER\Software\Policies\Microsoft\office\16.0\common\privacy
Value: connectededitingservices   (content analysis experiences)
Value: connecteddataservices      (online content download experiences)
Value: optionalconnectedexperiences
Value: disconnectedstate          (master off switch: 2 = all connected off)

After applying, test by opening PowerPoint on a managed machine. Try inserting a Designer suggestion (Design tab → Design Ideas). If the connected experience for content analysis is disabled, the Designer panel either won't appear or will show a message explaining it's been disabled by your organization. That's the confirmation you want.

Policy applied. Registry values confirmed. Now verify that what Microsoft is actually receiving matches what you configured. The Diagnostic Data Viewer is a free tool from Microsoft, available in the Microsoft Store, that shows you a real-time stream of exactly what diagnostic data Office is sending from a given machine. I consider this step non-negotiable for any compliance-sensitive deployment.

Install it from the Microsoft Store by searching "Diagnostic Data Viewer" or using the Store link from the Microsoft Privacy settings page. Once installed, you need to enable the data stream first, it doesn't log retroactively. Open the app, click Enable Diagnostic Data Viewer. Then go use Office for a few minutes: open a document, save it, close it. Come back to the viewer.

What you'll see depends on your configured level:

• On Required: You'll see events like Office.System.SystemHealthMetadata, crash reports, and performance signals. You won't see usage-pattern telemetry.
• On Optional: Additional events appear, including feature usage signals and timing data (like how long a save operation took). These are labeled with their category in the viewer's left panel.
• On Neither: The diagnostic data stream should be essentially empty, but you'll likely still see some required service data events. This is expected and documented behavior. Those events are not controlled by the diagnostic data level setting.

Use the search bar in the Diagnostic Data Viewer to filter by event name or category. If you're trying to prove to an auditor that no optional telemetry is leaving the machine, filter for events categorized as "Optional", if your policy is correct, nothing should appear in that category.

One thing I want to be direct about: even on the "Neither" setting, some data flows. Microsoft's documentation is explicit that required service data, the traffic needed to keep your subscription authenticated and your apps receiving security updates, continues regardless of your diagnostic data choice. This is not a misconfiguration. It is by design. If your compliance requirement is truly zero-data, you're looking at network-level controls, not Office policy settings, and that's a much bigger architectural conversation.