AI & Automation
Microsoft 365 Copilot Deployment
Permissions first, licences second.
Microsoft 365 Copilot is a paid add-on that puts an AI assistant inside Word, Excel, PowerPoint, Outlook and Teams and lets it answer using your own files, email and chats. Deploying it well is mostly a permissions job, not a licensing one. happier IT handles the readiness, the clean-up, the pilot and the training for Canadian organizations of roughly 15 to 200 people.
Who it's for
The demonstration was good. The question is whether it works here.
It answers using whatever the person asking can already open. So the honest answer depends entirely on how tidy that is.
A licence quote has arrived and nobody can judge it. Reasonable. The price is per user, per month on an annual commitment, and it is not a small line across a whole team, which is exactly why a pilot before a full roll-out is worth the delay.
Your files came off an old server. Migrated by copying everything, permissions inherited from folders nobody has looked at since. This is the single most common reason a Copilot roll-out becomes uncomfortable in week one.
You already have Copilot Chat and want to know what the paid one adds. A fair question with a specific answer, and one many organizations have not been given.
Some people love it and some never open it again. Usually a training gap rather than a product problem. The people who get value have been shown three specific things it is good at in their own job.
What Copilot does not do
Microsoft states that Copilot only surfaces organizational data a user already has at least view permission to. It grants nobody new access.
What it removes is obscurity. A folder of salary information that was technically open to all staff but buried five levels deep was protected by the fact that nobody looked. Copilot will find it when somebody asks a perfectly reasonable question.
What's included
What deployment actually involves.
Six of the eight items below happen before a single licence is assigned. That order is the whole job.
-
A prerequisites check against Microsoft’s own list
Users need an eligible base plan, Microsoft 365 Business Basic, Standard or Premium, E3, E5, F1 or F3, or an eligible Office 365 plan among others, plus the paid Copilot licence. Their primary mailbox must be in Exchange Online rather than on-premises, and they need a Microsoft Entra ID account to sign in.
-
A permissions and oversharing review
Broadly shared sites, "anyone with the link" sharing, permissions inherited from a file-server migration, and sensitive material sitting where it should not. This is the work, and it is worth doing whether or not you ever buy a licence.
-
The clean-up, in a sensible order
Stale sites archived, inheritance fixed, sensitive content moved somewhere restricted, and site ownership reassigned where the owner has left. Weeks rather than months for most organizations of this size.
-
Honest advice on temporary containment
Restricted SharePoint Search let admins limit Copilot to an allow list of up to 100 sites while permissions were fixed. Microsoft is retiring it and blocks new enablement from 31 July 2026, so it is no longer a plan. The permissions work is now the only route, and Microsoft points at SharePoint Advanced Management and Purview for the long term.
-
Sensitivity labelling where it earns its place
Labels in Microsoft Purview mark documents as confidential and can restrict what happens to them. Genuinely useful for a defined set, contracts, HR files, client records, and counterproductive when applied to everything, because people stop reading them.
-
Licensing worked out before you commit
What you already own, what Copilot Chat gives you at no additional cost, what the paid add-on adds, and whether the newer bundles of Microsoft 365 Business Standard or Premium with Copilot are cheaper for you than a separate add-on.
-
A measured pilot with a decision date
Ten or fifteen people across different roles, eight weeks, an agreed measure, and a date you decide. Some teams get real hours back and some do not. We report both, including when the answer is not to proceed.
-
Training that is three examples, not a course
The difference between people who keep using it and people who do not is whether someone showed them three specific things it does well in their actual job. Half an hour per team, repeated after a month.
How it works
Look, tidy, pilot. In that order, every time.
Buying licences first does not create a permissions problem. It makes an existing one visible to everybody at once.
-
Report on how content is shared today
A read-only review of your Microsoft 365 tenancy: sites with broad access, external sharing links, files reachable by everyone, orphaned sites, and where sensitive material actually sits. You get the report regardless of what you decide next.
-
Fix what the review found
Permissions corrected, stale sites archived, ownership reassigned, labels applied where they matter. This is the step people want to skip, and skipping it is what turns Copilot from useful into uncomfortable within a fortnight.
-
Pilot, train, then decide on evidence
A mixed group gets licences and a short session on what it is genuinely good at. Eight weeks later you make the licensing decision on your own numbers rather than a vendor’s slide.
What it costs
Licences from Microsoft, the work from us.
The licence price is published. The clean-up is where the variability lives, and it is the part that decides whether the licence was worth buying.
Microsoft 365 Copilot Chat is included at no additional cost with eligible Microsoft 365 subscriptions. It is web-grounded, it answers from internet content rather than your own files, and agents used within it are billed on a metered basis.
Microsoft 365 Copilot, the paid version, adds Copilot inside Word, Excel, PowerPoint, Outlook and Teams and answers grounded in your own organizational data. It is a per-user, per-month add-on, cheaper on an annual commitment than monthly, and Microsoft also now sells Business Standard and Business Premium bundles that include it.
The readiness and clean-up work Three things move it: how many SharePoint sites exist, how much content arrived from an old file server, and whether you hold regulated information.
Ongoing management sits inside managed IT
Do not buy for everybody
Value varies enormously by role. People who live in Outlook and Teams meetings tend to get real time back. People who spend the day in a line-of-business system Copilot cannot see often get very little.
Assign licences by role on the evidence from your own pilot, not by headcount. That single decision usually saves more than the clean-up costs.
Why us for this
We would rather be the ones who say "not yet".
If your permissions are untidy, we will tell you to fix that before buying a single licence, advice that delays our own invoice. The reason is practical: a Copilot roll-out onto messy permissions produces one memorable, uncomfortable moment in the first fortnight, and after that nobody trusts it.
Two facts worth knowing, both from Microsoft’s own documentation. Prompts, responses and data retrieved through Microsoft Graph are not used to train the underlying foundation models. And on residency: Copilot is covered by Microsoft’s Advanced Data Residency and Multi-Geo offerings, but Microsoft states that customers outside the EU may have their queries processed in the US, the EU or other regions. If where processing happens matters to you contractually, that is the sentence to take to your lawyer, see AI governance and policy.
Our Microsoft certifications are listed in full on our awards and certifications page.
Go deeper
- AI readiness assessment The wider version of this question.
- Microsoft 365 security Where the permissions work happens.
- Microsoft 365 services The platform underneath.
Questions
What people ask before they sign anything.
Are we ready for Microsoft 365 Copilot?
That depends almost entirely on your SharePoint and OneDrive permissions. Microsoft states that Copilot only surfaces organizational data the person asking already has at least view permission to, so if a folder of salary information is open to all staff, Copilot will surface it in answer to a reasonable question. It grants no new access; it removes the obscurity that was doing the work. Check three things: whether you can say who has access to each area of sensitive material, whether any sites are shared with "anyone with the link", and whether permissions were inherited from an old file server.
What is the difference between Copilot Chat and Microsoft 365 Copilot?
Copilot Chat is web-grounded and included at no additional cost with eligible Microsoft 365 subscriptions, it answers from internet content, not your files. Microsoft 365 Copilot is a paid per-user add-on that adds Copilot inside Word, Excel, PowerPoint, Outlook and Teams and grounds its answers in your own organizational data. The paid version is the one that needs your permissions to be tidy, because it is the one that reads your material. Agents used inside Copilot Chat are billed on a metered basis.
What do we need before we can use Microsoft 365 Copilot?
Per Microsoft’s published minimum requirements: an eligible base subscription, Microsoft 365 Business Basic, Standard or Premium, E3, E5, F1 or F3, or an eligible Office 365 plan among others, plus a purchased Copilot licence. Each user needs a Microsoft Entra ID account, and their primary mailbox must be in Exchange Online rather than on-premises or hybrid. Microsoft also strongly recommends SharePoint governance, Purview labelling and a phased rollout, which is the permissions work described on this page.
What does Microsoft 365 Copilot cost?
It is a per-user, per-month add-on, priced lower on an annual commitment than month to month, and Microsoft also sells Business Standard and Business Premium bundles that include it. Add the readiness and clean-up work, which is a separate fixed price. The saving worth chasing is not the licence discount, it is not buying licences for roles that will not use them.
Can we limit which files Copilot can see?
Not as a long-term plan any more. Restricted SharePoint Search let administrators hold Copilot to an allow list of up to 100 sites while permissions were being fixed, but Microsoft is retiring it and blocks new enablement from 31 July 2026. It was never a security boundary in any case, it still honoured underlying permissions. Microsoft’s stated path is now to fix the permissions and use SharePoint Advanced Management and Purview for ongoing governance, which is the honest answer and also the one that leaves you better off.
Is our data used to train Microsoft’s AI models?
Microsoft states that prompts, responses, and data accessed through Microsoft Graph are not used to train the foundation large language models behind Copilot. Microsoft also states that Copilot presents only data each individual can already access, using the same access controls as other Microsoft 365 services. On where that processing happens, Microsoft is clear that customers outside the EU may have queries processed in the US, EU or other regions, which is a separate question from training and is the one to raise if you have contractual commitments about data location.
How many licences should we start with?
Ten or fifteen, across genuinely different roles, for eight weeks. Value varies a lot by job: people who live in Outlook and Teams meetings usually get real time back, while people who spend the day inside a line-of-business system Copilot cannot see often get very little. A mixed pilot gives you your own evidence for which roles to license, and that decision typically saves more than the readiness work costs.
Related
Where to go next.
Want to know what this would look like for you?
A 30-minute call. No slides, no audit fee, no obligation. We ask what is breaking and tell you honestly whether we are the right fit.