Microsoft 365 and § 203 StGB: How to Get the Professional Secrecy Addendum

Most law firms, practices and clinics have long had their most sensitive data in the Microsoft cloud, just not in Azure. It sits in Exchange Online, in Teams chats, on SharePoint and in OneDrive: client correspondence, doctors’ letters, findings, pleadings. § 203 of the German Criminal Code (StGB) applies to this data just as it does to any Azure database. A license bought via self-service in the admin center, however, does not come with the required confidentiality obligation from Microsoft.

The path there is the same as with Azure: the addendum for professional-secrecy holders to the Microsoft Customer Agreement. innFactory enables companies with adequate liability, such as a GmbH or AG (German limited liability company or stock corporation), to procure their Microsoft licenses through us, at Microsoft list prices with no markup. Through our indirect CSP model you receive the addendum. The process is the same as for Azure procurement.

Note: This article is not legal advice. We cover the legal basis, the deadlines and the evidence in detail in the article § 203 StGB in the public cloud. This article is about license procurement.

Why Microsoft 365 raises the same question as Azure

Since 2017, professional-secrecy holders may involve external service providers, but only if those providers are obligated to secrecy (§ 203 paragraphs 3 and 4 StGB). Microsoft operates Exchange, Teams and SharePoint for you and is therefore such a contributing person. Microsoft governs data processing under Art. 28 GDPR in its Data Protection Addendum (DPA). The criminal-law confidentiality obligation only arises through the addendum.

Whether a lawyer reads a client’s e-mail in Outlook or a model in Azure OpenAI works with it makes no difference for § 203. Anyone who has prepared Azure properly but runs Microsoft 365 without the addendum has the larger share of their confidential data in the cloud without that obligation.

One addendum for Azure and Microsoft 365

The “Datengeheimnis-Zusatzvereinbarung für Deutschland”, listed in Partner Center as the “Professional Secrecy Amendment for Germany”, supplements the Microsoft Customer Agreement (MCA). It is not service-specific; it covers the online services you procure under the MCA. Microsoft 365 licenses that you buy in the CSP model run under the MCA. Exchange Online, Teams, SharePoint and OneDrive therefore fall under the same contractual framework as an Azure subscription.

The document is a Microsoft standard. It is neither negotiated nor amended. As a customer you do not download it yourself; you receive it through your CSP partner. That is exactly the role innFactory takes on: we procure your licenses as an indirect CSP reseller through the distributor TD SYNNEX and send you the addendum unchanged. The contract for the services continues to exist between Microsoft and you.

Which licenses you can procure through us

All common Microsoft 365 plans in the New Commerce Experience (NCE), Microsoft’s current licensing model in CSP. The typical candidates for law firms, practices and clinics:

On top of that come standalone products such as Exchange Online and add-ons such as Microsoft Copilot (formerly Microsoft 365 Copilot). For the enterprise suites, check in the quote whether Teams is included or added as a separate license.

A practical note: for professional-secrecy holders, Business Premium is usually the better choice than Business Standard. Intune and Conditional Access secure the devices on which patient and client data end up, and that is as much part of protecting the data as the contract. You or your IT service provider choose the plans.

The process: identical to the Azure path

1. Quote: you receive a quote for the desired licenses at Microsoft list prices with no markup, no setup fee and no ongoing management fees. Our terms and conditions (German AGB) apply to the reselling.
2. Confirm the partner, grant GDAP, set up the mandate: you confirm innFactory as your partner in the Microsoft 365 Admin Center, grant the minimal GDAP permission and a B2B SEPA direct debit mandate. Which roles those are and why they give us no access to your content is explained in the article on the Azure path.
3. Verify the MCA: in Partner Center we check whether your acceptance of the Microsoft Customer Agreement is on file. With a new tenant you accept the MCA in the Microsoft 365 Admin Center.
4. Order the licenses: we order the licenses through the indirect CSP model with TD SYNNEX as distributor. They appear in your admin center, and you assign them to your users yourself.
5. Accept the addendum: we send you the addendum from Partner Center unchanged. You accept it and attach it to your MCA. Only then does client or patient data belong in the tenant.

If you already procure Azure through us, the licenses go into the same partner relationship, and steps two and three are usually already done. Setup, configuration and administration of your tenant remain with you or your IT service provider. License procurement does not include administration.

What is different from Azure in license procurement

Microsoft’s NCE rules apply unchanged

Azure bills by consumption, licenses by term. In NCE you choose a monthly or annual term per subscription. Microsoft charges around 20 percent more for monthly terms than for annual terms. That is Microsoft’s pricing, not a markup from us.

The cancellation rule matters more: a subscription can only be cancelled or reduced with a prorated refund within seven calendar days of purchase or renewal (Microsoft documentation on the new commerce cancellation policy). After that, the license count is fixed until the end of the term, so for a full year with annual terms. You can increase at any time. Microsoft sets these rules; we can neither relax them nor agree on anything different. Plan the license quantity before you order.

Replacing existing licenses

If you have so far procured your licenses directly from Microsoft or through another partner, it is best to switch to the CSP licenses through us at the end of the current term. Mailboxes, files and Teams data stay in the tenant; only the license changes. Assign the new licenses before you let the old ones expire, and there is no interruption.

Copilot: no Modified Abuse Monitoring application required

With Azure OpenAI, Modified Abuse Monitoring is a separate application. For Microsoft Copilot (formerly Microsoft 365 Copilot) this step is not needed: according to Microsoft’s documentation, the Copilot services have opted out of the abuse monitoring with human review that Azure OpenAI provides by default. Prompts and responses are processed and stored like your other Microsoft 365 content and are not used to train the foundation models (Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot).

One point you should still check: Microsoft also uses Anthropic models as a subprocessor in Copilot, and according to the same documentation these are currently excluded from the EU Data Boundary. As an administrator, you decide whether these models are used in your tenant. For professional-secrecy holders, clarify this with your legal counsel before enabling the option.

Deadlines and evidence remain your responsibility

The addendum expires no later than 36 full calendar months after your acceptance, even if your licenses keep running. Document the expiry date on the day of acceptance and file the evidence: the MCA acceptance, the accepted version of the addendum with its version date, and your orders. The details are in the section “The deadline trap” of the Azure article.

What we offer and what we do not

• Adequate liability required: we offer license procurement with the addendum to companies with adequate liability, such as a GmbH or AG. We do not serve a UG (haftungsbeschränkt), the German mini-GmbH, in this model.
• No markups: you pay Microsoft list prices, with no setup fee and no ongoing fees.
• No deviations: we do not deviate from our standard process. Our terms and conditions apply to the reselling, and you receive the addendum unchanged, exactly as Microsoft provides it. There are no additional clauses, side agreements, individual confirmation letters or contract drafts of our own.
• No administration: license procurement includes neither setup nor operation of your tenant.
• Google Workspace and AWS: we offer the § 203 process for Google and AWS only to clients of our software development whose volume is high enough. It is considerably more time-consuming than the Microsoft path.
• Response times: due to the volume of enquiries, responses may take some time.

Conclusion

For Microsoft 365, professional-secrecy holders need the same as for Azure: the addendum to the MCA, accepted before the first confidential data lands in the tenant. As a company with adequate liability you get both through us: the licenses at Microsoft list prices with no markup and the addendum through our indirect CSP model. The process is standardized and identical for Azure and Microsoft 365.

If you also want to use AI with this data, you will find the path via Azure OpenAI, Modified Abuse Monitoring and CompanyGPT in the article § 203 StGB in the public cloud.

Important note: This article is not legal advice and does not replace it. It describes license procurement to the best of our knowledge as of October 2026. NCE rules, license contents, Copilot features and the version of the addendum change regularly. Check the current status, and have the assessment of your specific case under professional law carried out by your legal counsel.

Are you subject to professional secrecy, is your company a GmbH, AG or comparable company with adequate liability, and do you want to procure Microsoft 365 licenses with the addendum? Send us the plans and license counts you need, and we will prepare a quote at Microsoft list prices with no markup. Get in touch. Due to the volume of enquiries, responses may take some time.