What is Microsoft 365 Copilot?

Microsoft 365 Copilot is Microsoft's generative-AI assistant embedded across the Microsoft 365 apps. It drafts documents, summarises mail threads and meetings, analyses Excel tables, builds slides, and answers questions grounded in your own tenant's content — your files, your emails, your chats. It is also a per-user paid add-on with real prerequisites, so the practical questions are what it genuinely does well, how it gets at your data, and what has to be true of your tenant before you switch it on.

The per-app guides show what Copilot actually does day to day — Copilot in Word, Copilot in Excel, Copilot in PowerPoint, Copilot in Outlook, Copilot in Teams, and Copilot in OneNote — while Copilot Notebooks, Copilot Pages and Loop components, and the Prompt Gallery cover the newer surfaces. For extending it, see Copilot agents and the Agent Store, Copilot Studio, extensions and plugins, and the role add-ons Copilot for Sales and Copilot for Service. To switch it on for a first cohort, follow how to enable Copilot for a pilot group.

Where it shows up

• Word — drafting from prompts, rewriting passages, summarising long documents. See Copilot in Word.
• Excel — explaining formulas, analysing tables, generating charts and pivots from plain-English questions (Copilot in Excel).
• PowerPoint — generating decks from a Word document or prompt, restyling, speaker notes (Copilot in PowerPoint).
• Outlook — drafting replies, summarising threads, coaching tone (Copilot in Outlook).
• Teams — live meeting recap, action items, "catch me up" on chats and channels (Copilot in Teams); the meeting features are the most consistently praised part of the whole product.
• Microsoft 365 Copilot Chat — the standalone chat surface (in Teams, the Microsoft 365 app, and the browser) that answers questions across everything you can access in the tenant, or against the web.
• Plus Copilot experiences in SharePoint, OneNote, Loop, Planner, Forms, and Stream, with the list growing every quarter.

Beyond the built-in experiences, agents extend Copilot with custom behaviour and external data — built declaratively or in Copilot Studio.

How it works: grounding is the whole trick

Copilot uses frontier large language models, but the models aren't the differentiator — access is. When you prompt Copilot, it first retrieves relevant content from your tenant through the Microsoft Graph: files, mail, chats, meetings, people, and their relationships. That retrieved context is fed to the model alongside your prompt, and the response cites its sources. This is retrieval-augmented generation applied to your working life, and it's why Copilot can answer "what did we decide about the Q3 pricing change?" while a consumer chatbot can't.

Three properties follow from the architecture, and they're the ones that matter in governance conversations:

• Copilot respects existing permissions. It retrieves only what the signed-in user can already open. It never grants access.
• But it makes existing access discoverable. Files a user could always open but would never have found are now one question away. Copilot doesn't create oversharing; it puts a searchlight on it.
• Prompts and responses stay in the tenant's compliance boundary. They aren't used to train the foundation models, and they're subject to retention, eDiscovery, and audit like other Microsoft 365 content. The detail lives in Microsoft 365 Copilot data security.

Licensing

Microsoft 365 Copilot is a per-user add-on (list price around $30/user/month, annual commitment) on top of a qualifying base licence — Business Standard, Business Premium, E3, or E5 among others. There's no E5-style bundle that includes it; everyone pays the add-on. The maths, the qualifying SKUs, and the "who actually needs a licence" question are covered in Microsoft 365 Copilot licensing.

The free tier muddies naming: Microsoft 365 Copilot Chat (no add-on licence) gives signed-in users web-grounded chat with enterprise data protection, plus pay-as-you-go agent options — useful, but it does not touch your tenant content. The paid licence is what buys tenant grounding and the in-app experiences, and that's where the real value sits.

What to fix before rollout

The technical enablement is a licence assignment; the project is everything around it:

1. Permissions hygiene first. Overshared SharePoint sites, "Everyone" links, and ancient open Teams become visible fast. SharePoint permissions, external sharing, and the reports in SharePoint Advanced Management are the pre-work — the full checklist is in Copilot rollout prerequisites.
2. Baseline sensitivity labels. Copilot honours encryption and label-based restrictions, making labels one of the few sensitivity-aware controls over what it retrieves.
3. Pilot with intent. Pick users with real use cases, measure, and expand on evidence — see pilot best practices.
4. Invest in adoption. Usage drops off after week two unless people learn where Copilot is genuinely good (meetings, summarisation, first drafts) versus merely present. The adoption playbook and prompt engineering guide cover this.

An honest assessment

Where Copilot earns its price today: meeting recap and catch-up, summarising long threads and documents, first drafts of routine writing, and finding things you didn't know existed. Where it still underwhelms: complex Excel work on messy real-world workbooks, polished decks straight from a prompt, and anything requiring judgement about which the tenant holds no written context. Licence the people whose weeks are made of meetings and correspondence first; be more sceptical about blanket enterprise-wide assignment until your own pilot data argues for it.

The one-line summary: Copilot is a permissions-respecting retrieval layer over your tenant with a language model on top. Get the permissions and labels right and it's the most useful thing Microsoft has shipped in years; skip that work and it's a very efficient oversharing detector.

A worked example: 500-user pilot to enterprise rollout

A 500-seat professional services firm on Microsoft 365 E3 with permissions in reasonable shape:

• Month 0. Buy 50 add-on licences ($1,500/mo). Pick 25 partners/senior consultants (meeting-heavy, correspondence-heavy) and 25 back-office (finance, HR, ops) to compare real usage patterns across two very different work profiles. Run the readiness checklist, turn on the Copilot Adoption Score, and baseline current meeting hours and email volume.
• Month 1–2. Two 45-minute prompt-craft sessions per cohort. Add "how did you use Copilot this week?" as one line in the weekly team check-in. Flag any oversharing surprises to a small tiger team; do not stop the pilot to fix them all.
• Month 3. Review usage reports. Users who touched Copilot fewer than 3 days a week for 3 weeks in a row are moved off the licence; the seat goes to someone on the waitlist. This is the single most-skipped step and the one that keeps the value/seat honest.
• Month 4–6. Expand in cohorts of ~50 based on measured value, prioritising roles the pilot proved out. Skip roles where Copilot obviously fits poorly today (heavy Excel modellers on messy real-world workbooks, most developers).

The one number worth reporting to the sponsor: percentage of licensed users who used Copilot at least three days last week. Everything else — hours saved, tokens processed, sentiment survey — is downstream of that.

Decision matrix: who gets a licence first

| User profile | Value | Priority | | --- | --- | --- | | Senior leaders drowning in meetings | Very high | 1 | | Client-facing consultants, sales, CSMs | High | 1 | | Middle managers with heavy correspondence | High | 2 | | Marketing, comms, content teams | High | 2 | | HR, People Ops (long-form policy work) | Medium | 3 | | Finance and analysts (mostly Excel) | Medium | 3 | | Frontline and shift workers | Low today | Defer | | Software engineers | Low (use GitHub Copilot instead) | Defer | | Highly regulated roles (legal review, clinical) | Case-by-case | Pilot separately |

When Copilot is the wrong tool

• Codebase work. GitHub Copilot and Copilot in VS Code are the right products, not Microsoft 365 Copilot.
• Numerical accuracy at stake. Copilot in Excel is improving fast, but do not use it as the final answer on regulated financial calculations without a human check. Treat it as a first-pass assistant.
• Sensitive customer-support scripts. For contact-centre work with strict compliance scripting, Copilot for Service or a purpose-built agent in Copilot Studio beats general-purpose Copilot.
• Highly siloed information stores. If most of the useful context lives in a bespoke system that isn't connected to Graph, Copilot has nothing to ground on. Build Graph connectors first, then licence.
• Pre-labels, pre-permissions tenants. If SharePoint has "Everyone except external users" on the tenant root and no sensitivity labels, deploying Copilot before fixing that is not a Copilot rollout — it's a data-leak accelerator with a $30/user price tag.

MSP checklist

For MSPs running Copilot rollouts across many client tenants:

• Tenant health baseline first. Run the readiness prerequisites and a permissions audit before licensing anyone. Charge for the audit whether or not the client goes ahead with Copilot.
• Consistent adoption package per tier. SMB tier = self-serve videos + one live session; mid-market = tiger team + weekly office hours for 8 weeks. Same template, different depths.
• Per-tenant usage report on a monthly cadence, keyed to seats assigned vs seats active. Underused seats are the client's biggest waste — flag them explicitly instead of quietly renewing.
• Governance defaults. Restricted SharePoint search, sensitivity-label baseline, and Restrict Search by Site (where useful) shipped as the same template across tenants.
• Renewal review at month 10 of a 12-month term, not month 12. Give the client evidence-based room to right-size seats.