Copilot is Microsoft's artificial intelligence assistant built into Word, Excel, PowerPoint, Outlook and Teams. For a company, the question is not whether it works, but whether the licence pays off, what needs preparing beforehand and how to stop it from showing each user information they should not see. This guide summarises it using Microsoft's official documentation, consulted on 23 October 2026.
A note on naming: Microsoft has renamed Microsoft 365 Copilot as Microsoft Copilot and Microsoft 365 Copilot Chat as Microsoft Copilot Chat. We use both names because they still coexist in portals, invoices and documentation.
Copilot Chat and Microsoft Copilot: what each one includes
Microsoft offers two tiers that are easy to confuse:
| Copilot Chat | Microsoft Copilot (licence) | |
|---|---|---|
| Cost | Included with eligible Microsoft 365 licences | Additional per-user licence |
| Sources | The web and, in specific contexts, organisational content | Work data via Microsoft Graph, Work IQ and semantic indexing |
| Reasoning over company data | Limited | Over the email, files, meetings and chats the user has access to |
| Typical use | Drafting, summarising and looking up general information with enterprise data protection | Preparing a meeting with the user's own emails and documents, summarising threads, analysing their own Excel sheets |
Many companies can start with Copilot Chat at no extra cost, see which uses make sense and buy licences only for the roles that will get real value from access to internal data.
Licensing: what you need to buy it
According to Microsoft's licensing documentation, Copilot is added on top of an eligible base licence. For SMEs, the Microsoft Copilot Business add-on is designed for organisations with up to 300 users and can be added to Microsoft 365 Business Basic, Business Standard, Business Premium, Microsoft 365 Apps for Business or Teams Essentials, with an annual commitment. Organisations with more than 300 users must use the enterprise licensing options (E3, E5 and equivalents).
Prices change and depend on the channel and the commitment, so we do not reproduce them here: check Microsoft's official pricing page or ask us for a proposal. If you are still choosing a base plan (Business Basic, Standard or Premium), we review it with you as part of our cloud and Microsoft 365 service.
Technical requirements
- Work accounts in Microsoft Entra ID.
- Primary mailboxes in Exchange Online; Copilot is not available in group mailboxes.
- OneDrive for some features.
- Supported versions of Outlook (classic or new) and Teams; to get the most out of Copilot in meetings, transcription or recording must be configured.
- Microsoft 365 apps deployed with per-user (not per-device) licensing and network access to the Microsoft 365 domains.
If your company still runs on-premises email or shared folders on a server, the first step is not Copilot but migration, which we explain in our guide to cloud migration services.
Permissions and data: the part that needs the most preparation
Microsoft documents that Copilot only shows organisational data that each user has at least read permission for, using the same access controls as the rest of Microsoft 365. That is good news and, at the same time, the biggest practical risk: if a payroll folder has been shared with "the whole company" by mistake, until now nobody would stumble across it; with Copilot, a well-worded question can bring it to the surface.
Before assigning licences, you should:
- Review SharePoint sites and Teams teams with broad access or "anyone" links.
- Apply sensitivity labels to sensitive information (HR, finance, management, customer data).
- Clean up accounts belonging to former employees, guests and groups that are no longer used.
- Enable MFA for all users and review access from unmanaged devices.
Much of this overlaps with a healthy Microsoft 365 security configuration, and it belongs in the company's IT security plan.
What Microsoft does with your data
According to Microsoft's privacy documentation, prompts, responses and data accessed through Microsoft Graph are not used to train the foundation language models. For customers in the European Union, Copilot is an EU Data Boundary service, although Microsoft states that the Anthropic models it uses as a subprocessor currently fall outside that boundary. If your sector has strict data residency requirements, review this with your data protection officer before the rollout.
Where it adds the most value in an SME
The uses that work best in the services, manufacturing and distribution companies we work with are specific and repetitive:
- Email and meetings: summarising long threads, preparing a meeting with the related emails and documents, producing minutes and action items from the Teams transcript.
- Documents: first drafts of proposals, reports and procedures based on existing documents.
- Excel: explaining formulas, spotting trends and building tables from your own data.
- Internal search: finding "the latest version of the quote for that customer" without digging through folders.
What it does not replace is judgement: Copilot suggests and a person reviews. It is worth making this clear in an internal AI usage policy (what information can be used, what must always be reviewed and who is accountable) before each user sets their own rules.
How we roll out Copilot in phases
- Assessment: current licences, the state of Exchange, OneDrive and SharePoint, and permission risks.
- Preparation: fixing excessive permissions, sensitivity labels, MFA and account clean-up.
- Pilot: licences for a small group of users with measurable tasks, with training and defined use cases.
- Measurement: actual usage, time saved as reported by the users themselves, and issues detected.
- Expansion: more licences only where the pilot proves its value, with the AI usage policy published.
The whole process can be done remotely, with in-person training sessions in Madrid if you prefer. If we already manage your Microsoft 365, the Copilot rollout becomes part of the regular maintenance of the environment.
Common mistakes when rolling out Copilot
Rollouts that do not deliver tend to fail for the same reasons, and hardly any of them are technical: they come down to how the company is organised.
- Buying licences for the whole workforce at once. Without a pilot you do not know which roles benefit, and you end up paying for licences nobody opens after the first month.
- Skipping the permissions review. This is the mistake with the biggest consequences: Copilot does not create new access, but it makes it very easy to find whatever was overshared.
- Not training users. People who do not know how to ask get generic answers and conclude the tool is useless. A hands-on session with examples from their own role makes a big difference to the outcome.
- Accepting answers without checking them. Copilot can summarise badly, mix up versions of a document or rely on outdated data. Anything that leaves the company (quotes, reports, customer emails) needs human review.
- Not measuring. Without criteria agreed before the pilot (tasks, time, user feedback), the annual renewal is decided on gut feeling. Something simple is enough, such as the minutes it takes to prepare meeting minutes or a sales proposal before and after the pilot.
- Forgetting data that lives outside Microsoft 365. If key information sits on an on-premises server, in another cloud or in the ERP, Copilot will not see it by default, and expectations need to be set accordingly.
- Not appointing an owner. Someone has to collect questions, update the use cases and decide which licences to reassign when a user is not making use of theirs; if it is everyone's job, nobody does it.
That is why the initial assessment spends as much time on permissions, use cases and measurement as on licence configuration. If you have already bought licences and usage is low, the path is the same: review permissions, train with real use cases and reassign the licences you do not need.
Before buying licences, ask yourself
- Which three specific tasks do we want Copilot to do better or faster?
- Who in the company works mainly with email, meetings and documents?
- Do we know who has access to what in SharePoint, OneDrive and Teams?
- Do we have an internal rule on what information can be used with AI tools?
- How will we measure whether the licence is used and pays off?
If any answer is "we don't know", that is where the rollout should start. We can help you work it out in the initial assessment.
Request a consultation: we review your licences, permissions and use cases before you buy more Copilot licences than you need.