Is my business ready for Microsoft Copilot?

Somebody has shown you a demo. Copilot drafted the email, summarised the meeting and pulled the figures out of a spreadsheet in about four seconds, and now you're wondering whether to buy it for everyone. Fair enough. The question worth asking first is a smaller one. What happens on the morning it switches on?

Copilot answers from everything a person can already open in your Microsoft 365 tenant. It doesn't get around your permissions. It follows them faithfully, including the ones somebody set carelessly five years ago. So whether your business is ready for Copilot is mostly a question about file permissions, with a licence check before it and a network check after.

That's also where we think IT support for small firms is going. For twenty years the job was mostly keeping the machines running. Put an assistant in front of every folder a user can reach, and the job becomes knowing who can reach what. Microsoft's own Copilot deployment guidance opens on exactly that point, and it has a word for the problem: oversharing.

Copilot Chat and Copilot are different purchases

Microsoft has renamed both, which hasn't helped anybody. Microsoft 365 Copilot is now just Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat. The Copilot app's main address is moving from m365.cloud.microsoft to copilot.cloud.microsoft as well.

Microsoft's licence options page draws the line that matters. Copilot Chat that answers from the web comes with an eligible Microsoft 365 subscription at no extra cost. Copilot Chat that answers from what your work account can access needs a Microsoft Copilot licence. That paid licence is what connects the assistant to your mailbox, your Teams chats and your documents.

That split changes what "ready" means. Staff using the free chat today aren't reading your SharePoint through it. Assign somebody a paid licence and their Copilot can draw on everything they have permission to open. How Microsoft treats the prompts themselves, and the web searches Copilot sends to Bing, is covered in our piece on staff using AI tools at work. This one is about what's sitting in your tenant.

The licence you already have

Copilot is an add-on. You buy it on top of a qualifying Microsoft 365 plan, not instead of one. For business customers, Microsoft's list includes Business Basic, Business Standard and Business Premium, Microsoft 365 Apps for business and Teams Essentials, and it shows a separate Microsoft Copilot Business option against those same plans. If you're on any of them, the question is how many seats, not whether you can buy one. If you're weighing a plan change at the same time, Standard against Premium is its own decision and worth making first.

The app and network requirements page carries the conditions people trip over:

• Every user needs a Microsoft Entra ID account and a primary mailbox in Exchange Online. Copilot also works on archive mailboxes and on shared and delegate mailboxes the user can open. It doesn't work on group mailboxes.
• The Microsoft 365 apps have to be deployed, and Copilot isn't available where Microsoft 365 Apps for enterprise runs on device-based licensing.
• Some features, file restore among them, need the user to have a OneDrive account.
• Copilot in Word, Excel and PowerPoint on the web needs third-party cookies allowed in the browser.
• In Teams, Copilot can only use a meeting's content after it ends if transcription or recording was switched on.

That last one is a decision about people, not settings. For Copilot on ordinary phone calls through Teams Phone, Microsoft says everyone on the call hears an announcement that it's being recorded. Decide whether your clients should hear that before somebody turns it on for the whole office.

Look at who you're already paying for, too. A Copilot seat added to a licence list that still includes people who left last year is just a more expensive mistake, and the unused-licences article covers how to find them and the short window Microsoft gives you to drop them.

The real question: who can open what

Microsoft's Copilot privacy documentation says it in one sentence. Copilot only surfaces organisational data to which individual users have at least view permissions. The same page says the semantic index, the thing Copilot uses to find relevant content, honours each user's access boundary.

Read that as a customer and it's reassuring. Nobody gets anything they couldn't already open.

Read it as the person who looks after the tenant and it's a warning, because "could already open" is usually a much bigger set than anyone intended. The HR folder shared with the whole company for one afternoon in 2021. The Team where everyone was made a member because it was quicker than working out who needed it. A document library whose permissions were split off from its site years ago and never looked at since. None of that caused trouble while finding it meant knowing where to look. Copilot doesn't need to know where to look. Ask it about pay reviews and it will do its honest best with whatever that person can reach.

Microsoft built a whole deployment blueprint around this. Its pillars, in order, are remediate oversharing, set up guardrails and meet regulations. Fixing access comes first, before anyone talks about prompts.

The group to look for has an unlovely name. Everyone except external users, which SharePoint admins shorten to EEEU, is a built-in group that automatically includes every internal user. Microsoft's data access governance documentation describes anything shared with it, or with the older Everyone group, as effectively public inside the organisation. Give a folder to EEEU and the new starter can open it on their first morning. So can their Copilot.

Sharing links: less alarming than you'd think, with one catch

Most people get this bit wrong in the other direction. Microsoft's page on how sharing links work says that creating an Anyone link or a People in your organisation link doesn't make the file appear in search or make it reachable through Copilot. Somebody has to click the link first, which Microsoft calls redeeming it, and only then does the file become searchable for that person.

The catch sits in the next paragraph. Send the link from the SharePoint or OneDrive web interface, in an Outlook email or in a Teams chat, and it's redeemed automatically for each individual recipient, up to 100 of them. So the company-wide link pasted into a chat with twelve colleagues has been redeemed twelve times before anybody opened it. Specific people links are more direct still: the file shows up in search and in Copilot for everyone added to the link.

Links to people outside the business are a separate job. If you haven't tightened those yet, how to restrict external sharing in OneDrive and SharePoint goes through the settings one by one. Getting ready for Copilot is the inside half of the same clean-up.

Buy one seat before you buy twenty

This is the most useful line in Microsoft's licensing documentation for a small business, and it's buried. According to the SharePoint Advanced Management prerequisites, once at least one user in your organisation has a Copilot licence assigned, your SharePoint administrators automatically get the SharePoint Advanced Management features that support a Copilot deployment. The person holding the licence doesn't even need to be an admin.

SharePoint Advanced Management, SAM for short, is also sold as a separate add-on. The parts that arrive with that first Copilot seat are the ones the clean-up needs. There are data access governance reports, including a snapshot of permissions across every SharePoint and OneDrive site and reports on what was shared with EEEU in the last 28 days. There's the content management assessment, which Microsoft's secure foundation guide uses to find sites with oversized audiences, EEEU use, broken permission inheritance, no owner, or no activity. Site access reviews hand the question "should all these people be here?" to each site's owner. And site ownership and inactive-site policies stop a site sitting ownerless for three years.

So for a ten-person firm the order writes itself. One seat, for whoever is doing the review. Run the reports and fix what they find. Then roll out to everyone else. Twenty seats on day one means twenty people exploring the tenant with a very good search engine before anyone has read the permissions report.

That foundation guide also leans on Microsoft Purview tools, data loss prevention for Copilot among them, and it says its capabilities assume Microsoft 365 E3 or E5 alongside the Copilot licence. Most small businesses are on Business Standard or Premium instead. Don't let that put you off. In a tenant of this size the SharePoint half does most of the work, and it's the half that comes with the seat.

Restricted Content Discovery is a pause button

Sometimes the review turns up a site you can't fix this week. Say the finance site has forty folders with individual permissions and the person who set them up left in 2023. For that, Microsoft offers Restricted Content Discovery. Turn on "Restrict content from Microsoft Copilot" in the site's settings, under Active sites in the SharePoint admin centre, and the site's content stops appearing in organisation-wide search and in Copilot answers. The Copilot button and the AI actions menus disappear from that site as well.

Microsoft is plain about the limits. It doesn't change permissions, so anybody who can open a file can still open it directly, and people still find content they own or recently worked on. It covers SharePoint sites only, not OneDrive. It takes time to spread through the search index, longer on big sites. And Microsoft calls it temporary, with a warning that using it too widely makes search and Copilot answers less complete.

We'd treat it like a padlock on a door that should have been bricked up. Useful for a month. Not the plan.

The network part nobody budgets for

The last check isn't in SharePoint at all. It's the box in your comms cupboard.

Microsoft's requirements page says several Copilot features depend on WebSocket connections to *.office.com, *.cloud.microsoft and copilot.cloud.microsoft. It names three things that break them: a network perimeter that blocks the WebSocket protocol, devices doing TLS inspection on those connections, and proxies with aggressive connection timeouts. It asks you to allow the whole of *.cloud.microsoft and says Microsoft doesn't support allowing only selected addresses inside it.

Small offices rarely run a proxy. They do run routers and firewalls with web-filtering categories, some of them set up years ago and never revisited. If Copilot works at home and falls over in the office, start there. The Office Feature Updates scheduled task has to run and reach the network too, because Microsoft says Word, Excel, PowerPoint and OneNote need it for the core Copilot features. Our firewall and router article covers what else that box should and shouldn't be doing.

Where this goes next

Everything above is about Copilot answering questions. Microsoft's own admin documentation has already moved on to agents, which are built to carry out tasks with your content rather than just summarise it.

You can see it in what has shipped. The SharePoint Advanced Management overview now lists a report on agents created across SharePoint and OneDrive, and an agent access insights report showing how agents interact with your content. Restricted Content Discovery hides the create-an-agent option on the sites it covers. And the Copilot privacy page says admins choose which agents are allowed from the Integrated apps section of the Microsoft 365 admin centre, and that users only get the agents their admin has allowed.

That Integrated apps list is worth opening now, while it's short. Nobody needs to decide their agent strategy this autumn. But the permissions clean-up isn't Copilot-only work. It's groundwork for whatever assistant comes next, and Microsoft is plainly building its admin tools on that assumption. Our view is that a tidy tenant is worth more than the seats. You'll probably want both eventually. In that order.

What we do, and what it costs

Nothing on our price list is called Copilot readiness, and we're not inventing a package for the sake of this article. Here's where the work actually sits.

If you're on a managed plan, the tenant is already ours to look after. Plans are £50, £77 or £108 per user per month. Professional and Complete include a quarterly IT strategy review, which is the right meeting for deciding whether Copilot is worth it and for whom. Reviewing permissions and sharing is part of looking after the tenant. A large remediation, a decade of file-server permissions copied into SharePoint unchanged, say, can run past that, and we'll tell you before it does. Out-of-scope work on a plan is £86 an hour.

If you're not a client, it's hourly: £126 an hour without an agreement, and £167 out of hours with a two-hour minimum. Ask for an estimate first. A five-person tenant with a handful of sites is a short job. Forty personal OneDrives and ten years of Teams sites is not.

Microsoft 365 licences are supplied at list price and managed for you, and we don't mark them up. If the network turns out to be the blocker, firewall and switch management is £34 per device per month. Moving into Microsoft 365 from somewhere else is £77 per mailbox, and our cloud and Microsoft 365 page explains how permissions are mapped first and sharing defaults set during the move rather than bolted on later. All prices exclude VAT.

What we won't do is promise Copilot will never show somebody something it shouldn't. It shows what the permissions allow. Our job is making the permissions say what you meant.

Checking where you stand this week

Open the Microsoft 365 admin centre and look at which plan each person is on, and whether anybody on the list has left. Ask the team who already uses the free Copilot Chat, and for what. Pick your three most sensitive places, usually finance, HR and the directors' own files, and check who can open them, looking specifically for Everyone except external users. Find out whether the office firewall does web filtering or TLS inspection, and who has the password to it.

If the answers are tidy, buy one seat and run the reports. If they aren't, fix them first. Copilot will still be on sale next month.