Microsoft 365 Copilot is easy to switch on: assign a licence and it appears in Word, Outlook and Teams. The harder question is what it finds once it is running, and that depends on how your tenant has grown over the years. (Microsoft has renamed the licensed product Microsoft Copilot, so you will see both names.)
Copilot sees what your staff can see
Microsoft is clear on the point that matters most: Copilot only surfaces organisational data that the individual user has at least view permission for. It does not get around your permissions. It does make them visible. A salary spreadsheet in a SharePoint site shared with the whole organisation was always open to every staff member; it was just hard to find. Copilot makes it easy to find.
So the first job is an oversharing review:
- Sites and Teams open to the whole organisation that should not be.
- "Anyone" links and old sharing links on sensitive files.
- Sites with no current owner, or with broken permission inheritance.
- Old content nobody needs, which can be archived or deleted so it stops turning up in answers.
Microsoft's guidance on a secure and governed foundation for Copilot covers the tools for this, including SharePoint Advanced Management reports that flag overshared, ownerless and inactive sites, and restricted content discovery, which keeps chosen sites out of Copilot while you fix them. If you are not sure how tidy your tenant is, a Microsoft 365 environment review is a sensible first look.
Sensitivity labels and data loss prevention
Permissions decide who can open a file. Sensitivity labels record how sensitive it is. Where a label encrypts content, Copilot honours the usage rights granted to the user, and Microsoft notes that content Copilot generates picks up matching labels from the material it drew on. Labels only help once they are applied, so agree a short label set and sensible defaults before you rely on them.
Microsoft Purview data loss prevention (DLP) can go further. A DLP policy for Copilot can stop it processing files and emails with particular labels, or stop it responding to prompts that contain sensitive information types. Check licensing before you plan around this: the Purview service description lists the file and email restriction under E5-level plans, not Business Premium, while DLP for prompts is available to all Copilot users.
Licensing prerequisites
Copilot is an add-on to an eligible Microsoft 365 or Office 365 plan. For smaller organisations, Microsoft Copilot Business is an add-on for up to 300 users on eligible Microsoft 365 Business plans, including Business Basic, Standard and Premium, with an annual commitment. Each user also needs a Microsoft Entra ID account, and an Exchange Online mailbox for the email-based features. Microsoft notes that licensing terms change, so confirm eligibility when you buy.
The Copilot readiness report in the Microsoft 365 admin center shows who holds a prerequisite licence and whether their Microsoft 365 apps are on an eligible update channel (Current Channel or Monthly Enterprise Channel).
Start with a pilot group
Rather than licensing everyone at once, start with a small pilot from a few teams with different kinds of work. The readiness report can help: it flags suggested candidates based on how heavily people already use Outlook, Teams and Office documents.
Give each pilot user a few real tasks, such as summarising a long email thread or drafting from an existing document, and ask them to report two things: what saved time, and anything Copilot showed them that they should not have been able to see. Treat the second as a permissions problem to fix before you go wider.
Measure use
The Copilot usage report shows enabled users, active users and adoption by app over 7, 28, 90 or 180 days. That shows whether licences are used, not whether the work is better, so pair it with a short check-in: which tasks worked, which answers needed heavy correction, and what training would help. Decide on a wider rollout from both.
Where to start
Our Microsoft 365 Copilot service covers the readiness review, a controlled pilot and rollout, and training staff to use Copilot on appropriate tasks.