Rolling out Microsoft Copilot – what to settle before you buy licences

What you already have and what the licence adds

Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot and Microsoft 365 Copilot Chat to Microsoft Copilot Chat; both names still appear. What matters more is what works without an add-on.

For smaller organisations there is also Microsoft Copilot Business: according to Microsoft, the same capabilities as the regular licence, as an add-on to Microsoft 365 Business Basic, Standard or Premium, for organisations with up to 300 users and with an annual commitment. See the Copilot Business FAQ and the licence options.

Copilot Chat is therefore already there; introduce it deliberately. The add-on suits people who handle a lot of email, documents and meetings.

Permissions: Copilot finds what is overshared

Copilot only shows content a person may at least view. That is the risk: in many companies, folders, teams and SharePoint sites have been shared more widely than necessary over the years. Copilot surfaces it with a simple question – say, a payroll spreadsheet in a Teams folder open to the whole company.

Common causes:

• sharing links for anyone or for the whole organisation that were forwarded
• sites where "Everyone except external users", in effect the whole company, has access
• public teams and old project sites without an owner

With at least one Copilot licence assigned, your SharePoint administrators get SharePoint Advanced Management features as part of the licence:

• the Content Management Assessment, a guided check for overshared, ownerless and inactive sites
• data access governance reports, for example on sharing links and organisation-wide access
• site access reviews, in which site owners check their own permissions
• Restricted Access Control, which limits a site to the members of a group
• Restricted Content Discovery, which temporarily hides sensitive sites from Copilot and organisation-wide search without changing permissions

Out of the box, SharePoint's sharing settings use the most permissive option. Change them so that new links work only for specific people by default and links for anyone expire (see Microsoft's SharePoint Advanced Management guide). And because an account with Copilot finds more, faster, multi-factor authentication and Conditional Access – rules on who may sign in under which conditions – are part of the basics.

Protect sensitive content with sensitivity labels

Tidying up does not replace protection for confidential documents such as personnel files or client records. Microsoft Purview offers sensitivity labels for this: tags such as "Internal" or "Confidential" that can also encrypt a document and add headers or footers. Copilot respects them:

• For an encrypted document, Copilot only returns content if the person may extract as well as view it.
• When Copilot in Word, PowerPoint or Outlook creates content from labelled files, the result inherits the label – from several sources, the highest-priority one.
• In its answers, Copilot Chat shows the labels of the sources it used.

Manual labels and data loss prevention (DLP) policies are included in Microsoft 365 Business Premium, for example; check what automation your plan allows. Start with three or four labels and the few genuinely sensitive areas. Depending on your licence, a DLP policy can also stop Copilot processing files with specific labels. See Microsoft's Purview documentation for Copilot.

A pilot group and concrete use cases

A pilot shows whether Copilot helps in daily work and reveals permission problems early. We recommend five to ten people from different areas working on defined tasks for a few weeks:

• Teams meetings: summaries and action items; transcription must be running, or Copilot enabled for the meeting
• Outlook: summarising long email threads and drafting replies
• Word: drafts based on existing documents, such as a quote modelled on earlier ones
• Excel: analysing data and suggesting formulas
• PowerPoint: turning a Word document into a first presentation

For example: in a fiduciary firm, Copilot summarises the email thread on a client mandate and suggests a reply. The person handling the case checks the draft before sending it, as Copilot can be wrong.

Decide beforehand how to measure value, such as time per task or draft quality. The Microsoft Copilot Dashboard in Viva Insights shows readiness, adoption, impact and sentiment and, according to Microsoft, needs no separate Viva Insights licence; add the usage reports in the Microsoft 365 admin centre and feedback rounds.

Rules, training and shadow AI

Many employees already use AI, often via personal accounts in public chat tools. When client data ends up there, the company has neither control nor a contract with the provider. Bans alone will not make this "shadow AI" disappear. What helps:

1. Clear rules: which tools are allowed, what data may go into them, and that results must be checked
2. An approved alternative: with a work account, Copilot Chat is covered by the same contractual commitments as your email and files (enterprise data protection), and Microsoft states that prompts are not used to train its foundation models
3. Technical guardrails: personal Microsoft accounts can be restricted on company devices, and Microsoft Purview can, depending on licence, warn or block when sensitive data is pasted into external AI websites
4. Training: good prompts, checking results, applying labels

On data protection: the FDPIC states that the revised Federal Act on Data Protection (FADP), in force since 1 September 2023, applies directly to AI-supported processing. For Microsoft 365 customers whose sign-up country is in the EU or EFTA, Switzerland included, the EU Data Boundary applies: Microsoft stores and processes customer data within these countries, Copilot included. Exceptions include web searches via Bing and, at present, Anthropic models, which your administrators decide on. Also check whether client contracts or professional obligations add requirements.

Later: your own agents with Copilot Studio

With permissions and rules in place, agents are a sensible next step: assistants for one task, such as questions about the staff handbook. Microsoft Copilot Studio lets you build them without much coding and publish them in Teams or Microsoft Copilot. Agents use the same data, so tidy up first, then extend.

How to get started

1. Define two or three concrete use cases and how you will judge success.
2. Review your Microsoft 365 plans and whether Copilot Business fits.
3. Secure accounts with multi-factor authentication and Conditional Access.
4. Assign a first Copilot licence, review sharing with SharePoint Advanced Management, and clean up or temporarily hide sensitive sites.
5. Introduce sensitivity labels for the most sensitive areas.
6. Write usage rules and promote Copilot Chat as the approved tool.
7. Run the pilot, measure, and only then decide on further licences.

We support you from the initial review to the pilot – see AI & automation and IT security. To find out where your Microsoft 365 environment stands, get in touch.