In brief: Copilot sees no more than the person using it already sees. The problem is that in most companies users see more than they should, it is just that until now nobody was looking. Copilot looks on everyone’s behalf, instantly. Preparing for it is not about artificial intelligence technology, it is about tidying up access rights.
What it is called now
Microsoft has renamed the product: Microsoft 365 Copilot has become Microsoft Copilot, and Microsoft 365 Copilot Chat has become Microsoft Copilot Chat. Licences and some screens still carry the old names during the transition, so do not be surprised to see both.
A version for small companies has also appeared, Microsoft Copilot Business, and the old requirement of a 300-licence minimum is gone. A single licence can now be bought.
The line between free and paid
Copilot Chat is included at no extra cost with eligible Microsoft 365 subscriptions, but only in the form that works with information from the web. Chat grounded in company data, meaning your e-mails, documents and meetings, requires a Copilot licence.
This is the distinction that matters in budget discussions. People compare what they used for free with what they are being asked to buy, without realising these are two different things. The direct editing features in Word, Excel and PowerPoint also come with the licence.
The technical conditions, before anything else
- A work account in Entra ID. Personal Microsoft accounts do not work.
- A mailbox in Exchange Online. Without it nothing tied to mail, calendar or meetings exists. Group mailboxes are not covered.
- An active OneDrive for the user, because some features depend on it.
- Up-to-date Microsoft 365 apps, with the update process working and able to reach the network resources it needs.
- A permissive network on the required domains. Microsoft requires access to the whole cloud.microsoft domain and does not support allowing only selected addresses within it. Aggressive TLS inspection and short proxy timeouts break it.
- Third-party cookies allowed for Copilot in the web versions of the applications.
- The right administrative role. Microsoft recommends the dedicated artificial intelligence administrator role rather than global administrator.
One quiet trap: if the tenant has connected experiences that analyse content switched off, Copilot features simply disappear from Word, Excel, OneNote, Outlook and PowerPoint. Many administrators turned that setting off years ago out of caution and forgot about it.
The part that really matters: who sees what
Microsoft is explicit: Copilot surfaces only the data the user already has at least view rights to, and responsibility for those rights being correct is yours. That sounds reassuring until you look at what has accumulated in SharePoint and OneDrive over the past ten years.
- Libraries opened to the whole organisation, because it was simpler at the time of creation.
- Links of the “anyone with the link” kind, sent outside once and never expired.
- Broken permission inheritance on folders, with exceptions nobody remembers.
- Sites with no owner, left over from finished projects or from people who have gone.
- Company-wide groups used as a sharing shortcut.
- Payroll documents, contracts or personnel files that ended up in a general folder.
None of this is new. What is new is that until now you had to know what you were looking for and where. Now it is enough to ask in ordinary language, and the answer arrives in two seconds with the source attached.
What Microsoft recommends, in their order
Microsoft publishes a three-stage plan: remediate oversharing, set durable guardrails, meet regulatory requirements. The tools they name are Purview and SharePoint Advanced Management, the latter being included with the Copilot licence.
- Identify. The data risk assessments in Purview and the content assessment in SharePoint Advanced Management show sites with oversized audiences, broken inheritance, and inactive or ownerless sites.
- Contain temporarily. Restricted content discovery takes sensitive sites out of Copilot’s reach while you clean up, without blocking the people who work in them.
- Remediate. Sensitivity labels on sites, removal of anonymous access and excessive sharing, access reviews, repairing broken inheritance, assigning owners.
- Set guardrails that stay. Disable “anyone” links and the use of company-wide groups at tenant level, and require a sensitivity label whenever a new site is created.
- Cover the regulations. Audit log retention, retention policies for Copilot interactions, and the ability to search them in response to a formal request.
The warning you need to hear
Microsoft’s full data-readiness guidance is written for the E3 and E5 enterprise plans. A company on Business Premium cannot carry out everything in it without additional licences.
That does not mean you cannot use Copilot on Business Premium. It means the clean-up has to be done with more manual work and more care about what you expose, because the automated discovery and classification tooling is not all available to you. Anyone selling you Copilot without telling you this is selling you only the licence.
Where the data goes
For customers in the European Union, Copilot is a service covered by the EU Data Boundary, and traffic from the Union stays within it. Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models. We wrote about the wider framework in the article on private and public cloud.
One exception worth knowing: models provided by Anthropic as a subprocessor are currently outside the EU Data Boundary. Enabling third-party models is an administrator’s decision and carries additional terms. If you have strict data location requirements, check this setting beforehand rather than afterwards.
The practical order of a rollout
- An exposure inventory, before any licence is bought.
- Containment of sensitive areas and clean-up of the obvious sharing.
- A pilot with a small group, ten to twenty-five people from different teams rather than only from management.
- Written internal rules about what may and may not be asked, especially for personal data.
- Measuring what actually changed in how people work.
- Expansion, if the pilot showed a real gain.
For companies under 300 employees there is a thirty-day trial for twenty-five users, run through a partner, which fits stage three exactly.
What we do and what stays with you
PRO IT checks that the technical conditions are met, inventories the exposure in SharePoint and OneDrive, configures restriction of sensitive content, labels and policies, licenses through the Cloud Solution Provider programme and prepares the pilot. The service is described on the Microsoft 365 and cloud page, and if you want the overall picture first, the IT audit includes the state of access rights.
The content decisions stay with you: who may see what, which documents have no business being in a shared folder, and what internal rules you set for using the tool. These are organisational decisions, and an IT provider cannot take them for you.
