What it is
An assistant built into Word, Excel, Outlook, Teams and PowerPoint that answers from the files and emails the user already has access to inside your Microsoft 365 environment.
Microsoft 365 Copilot
Microsoft 365 Copilot: what is included, what to fix first
Three different products carry the Copilot name, and a small business that confuses them usually turns on the wrong one. This page explains what each of them does, what a licence adds, which settings must be fixed before employees get access, and what happens to your data.
Copilot does not create data leaks. It makes visible the ones SharePoint sharing was already hiding. That is why a rollout starts with cleaning up access rights, not with training. The gain is time recovered on drafting, meeting summaries and searching through files, for the roles that actually do that work.
At a glance
Copilot in three points, for a small business
Copilot does not create data leaks. It makes visible the ones SharePoint sharing was already hiding. That is why a rollout starts with cleaning up access rights, not with training.
Who it suits
Roles that write, summarize and search: management, administration, sales, purchasing, human resources. Far less useful on a production or shop floor workstation.
What changes
Time recovered on drafting, meeting summaries and searching through files. In exchange, every badly set permission becomes visible right away.
Understanding
Three products are called Copilot
The first one is the Copilot built into Windows and the Edge browser. It answers from the web, not from your company files. Most employees have already seen it, and it is the one that worries management the most, because someone can paste a confidential document into it without thinking twice.
The second one is the assistant that appears inside some Microsoft 365 applications without a dedicated licence. What it can do changes over time and depends on the plan you subscribe to, which is why two neighbouring companies do not see the same screen.
The third one is Microsoft 365 Copilot, the per-user licence that reaches your own data: SharePoint and OneDrive documents, emails, Teams conversations, meetings. It is the only one of the three that reads what lives in your environment, and therefore the only one that requires preparation before it is opened.
Before you turn it on
Six settings to fix before you hand Copilot to your employees
These six points are the ones we check in a Microsoft 365 environment before a single licence is activated. They are all handled in the admin centre, with no project and no change for users.
Sharing in SharePoint and OneDrive
What we look at. Sites and folders shared with the whole organization, sharing links with no expiry date, libraries inherited from an old project, and management documents filed in the wrong place.
Why it matters. Copilot answers from whatever the employee is allowed to open. A payroll folder shared with the Everyone group by mistake was invisible because nobody was looking for it. With Copilot, all it takes is asking.
Sensitivity labels
What we look at. Whether labels exist, whether they are applied automatically to sensitive documents, and whether they actually prevent copying outside the organization.
Why it matters. Labels created when the tenant was set up, never published, and therefore inactive.
Data loss prevention
What we look at. The rules that block personal information, social insurance numbers or banking data from leaving the organization, and what happens when a rule fires.
Why it matters. No rule at all, or a rule left in audit mode that has never blocked anything.
The audit log
What we look at. Whether logging is on, since when, and how long the records are kept.
Why it matters. Without a log, you cannot answer the question of who asked what after an incident. It is also what an insurer will ask for.
Licences and admin roles
What we look at. Who holds global administrator rights, how many people do, and whether multifactor authentication is enforced on those accounts.
Why it matters. Three to six global administrators in a twenty-person company, one of them a former provider.
Web grounding and agents
What we look at. Whether Copilot is allowed to search the Internet to complete an answer, and who is allowed to build agents inside your environment.
Why it matters. Some organizations switch web access off to keep answers inside the perimeter. Others keep it for market watch. That is a management decision, not a technical setting.
How it runs
How a Copilot rollout actually goes
A successful rollout is not buying licences for everyone at once. It is a measured pilot, then an extension to the roles where the gain is real.
- ScopingA meeting to understand what your teams do every day, what is confidential in your business, and what you owe your own clients. That is what decides what stays closed.
- Cleaning up accessFixing sharing, open links and admin rights, publishing labels and turning on the audit log. This step is worth doing even if you then decide not to deploy Copilot at all.
- Pilot on a small groupA small group, chosen because their work is made of writing, summarizing and searching. We time three specific tasks before, then after.
- Measure and decideWe compare. For some roles the honest answer is that the licence does not pay for itself. We say so, and we do not extend.
- Rollout and trainingOpening access to the roles we kept, with short role-specific training rather than a generic demo, and a written rule about what never gets pasted into an assistant.
The limits
What Copilot will not do
Most of the disappointment comes from expectations the tool never promised to meet. Here is what we tell management before anything is signed.
- It will not organize your files for you, and it works poorly in an environment where nothing is filed
- It does not replace human review: anything it writes must be read again, especially a figure or a clause
- It cannot see anything outside Microsoft 365, such as your accounting software or your production system
- It grants no new access rights and bypasses no existing permission
- It will not make a shop floor workstation faster: the gain is in the office, not on the machine
- It does not replace a written policy on how artificial intelligence is used in the company
Your data
Where your data goes, and what Law 25 expects
User prompts and the document excerpts used to build an answer stay inside your Microsoft 365 organization, and are not used to train public models. That is Microsoft’s documented position, and it is what you need to be able to show a client who asks.
On the Quebec side, Law 25 does not forbid you from using an assistant. It asks you to know where personal information sits, who can reach it and why. A Copilot rollout is the opposite of a risky project when it starts with that question, because it forces an answer.
In practice, we document for each client the list of sources the assistant can reach, what happens to the logs, and the procedure to follow when someone requests access to their own information. That documentation is part of the compliance file we keep under our managed IT services, alongside our artificial intelligence guidance.
Further reading: the practical Copilot guide, what changes on July 1, 2026 and Claude and GPT inside Microsoft 365.
Questions and answers
Frequently asked questions about Copilot in a small business
Is Copilot included with Windows 11?
The Copilot built into Windows and Edge is there without an extra licence, but it does not read your company files: it answers from the web. Microsoft 365 Copilot, the one that works on your documents and emails, is a separate per-user licence. The two do not do the same job and do not raise the same security questions.
Do we need to licence everyone?
No, and it is rarely a good idea. The gain concentrates on roles that write, summarize and search. We recommend a pilot on a small group, with three timed tasks before and after, then a decision role by role. For some of your employees the honest answer is that it does not pay off.
Is our data used to train a public model?
No. Prompts and the document excerpts used to build an answer stay inside your Microsoft 365 organization. What we document for you is the precise list of sources the assistant can reach in your environment, because that is the list your clients and your insurer will want to see.
Can an employee see a document they are not entitled to?
Copilot grants no new rights and bypasses no permission. The risk lies elsewhere: it reveals overly broad permissions that already existed and that nobody used, because nobody knew they were there. That is why cleaning up sharing comes before turning anything on.
How long does a rollout take?
It depends mostly on the state of sharing in your environment. A well-kept tenant is quick to prepare; an environment where ten years of files were shared project after project needs a longer cleanup stage. We give you a schedule after looking at your Microsoft 365 organization, not before.
Can we do only the governance part, without the licences?
Yes, and it is a common mandate. Cleaning up access, labels, data loss prevention and the audit log are worth doing on their own. You stay free to decide afterwards whether the licences are justified. See also our cybersecurity services.
Talk about Copilot with people who have already deployed it
We look together at the state of your Microsoft 365 environment, name what has to be fixed first, and tell you honestly which roles would actually gain from it. The first meeting comes with no obligation.