Copilot Chat Is in Your Business Plan. Full Copilot Is Not.

Since 1 July 2026, every Microsoft 365 Business plan carries something called Copilot. A great many firms have concluded from that they now hold the full product. They do not, and the difference decides whether they have a data problem or not.

There are two different things wearing the same name. Knowing which one is on your staff’s desks takes two minutes and changes what you need to do about it.

Which Copilot you actually have

Copilot Chat is included with Microsoft 365 Business plans. It is grounded in web data. It will draft an email, rewrite a clumsy paragraph, summarise a public document or research a supplier. It cannot see your SharePoint, your OneDrive, your Teams meetings or your mailbox.

Microsoft 365 Copilot is a separate paid product, bought either as a per-user add-on or through a with-Copilot version of your plan. This is the one that works across your own files, meetings and email — the one that can summarise Tuesday’s client call or find the figure in last quarter’s spreadsheet.

The useful version is the one you pay extra for. The included version is genuinely handy and carries none of the risk below, because it has no route to your data.

So the honest position for most firms on 1 July was not “AI is now reading our files”. It was “our staff have a capable web assistant, and the version that reads our files is one purchase order away”.

That distinction is worth getting right before anyone acts on it.

What changes the day someone buys the add-on

Full Copilot does not have its own view of your business. It answers using whatever the person asking already has permission to open across SharePoint, OneDrive, Teams and Exchange.

That sounds reasonable until you picture how permissions look inside a ten-year-old tenant: a “Company Shared” library everyone can open, an old HR folder with inherited access nobody reviewed, a director’s OneDrive share from 2021 that was never withdrawn.

Before Copilot, that estate was protected by obscurity. Nobody could find the salary spreadsheet six levels deep in a folder from a previous office move. Full Copilot removes the obscurity. Ask it what people are paid here, and it will search everything the asker technically has access to. The exposure is not a hacker. It is your own tenant, answering accurately a question nobody expected to be asked.

Nothing about that is exotic. It is the ordinary state of a tenant that has been in use for a decade, and it stays harmless right up until the moment search gets good.

The permissions work to do before you buy

The trigger point is the purchase, which makes this straightforward to plan. Work through the following before the first add-on licence is assigned. For a small firm it is roughly a week of part-time work, and all of it is worth doing whether or not Copilot ever arrives.

1. Review who can access what. Start with the obvious blast zones: HR, payroll, board papers, client files, anything confidential sitting in a shared library. Repair inherited permissions and remove stale sharing links.

2. Label what is sensitive. Sensitivity labels tell Copilot, and everything else, what confidential looks like. Even three labels — Public, Internal, Confidential — change the outcome.

3. Retire what you no longer use. Old Teams sites and abandoned SharePoint libraries are permission archaeology. Archive them. Less surface, fewer surprises.

4. Write the policy before your staff write it for you. Which roles get full Copilot first, and what may staff paste into Copilot Chat in the meantime? Two paragraphs of written guidance now is worth more than an investigation later.

5. Then roll it out deliberately. Start with a pilot group, collect the prompts that genuinely worked, and put those in front of everyone else. A licence that nobody was shown how to use is a licence that goes unused.

Our Copilot governance guide sets out the security side in more detail. The work has not become less necessary since July — it has simply moved to a point you now control, because it starts when you decide to buy.

Weigh what the paid version actually returns

None of the above is an argument against buying it. Used properly, full Copilot is the most useful thing to arrive in the small-business Microsoft stack in years:

• Outlook: summarise a fortnight-long email thread before the call about it
• Word: first drafts of proposals from a bullet list and a previous example
• Excel: explain in plain English what is driving the variance in a sheet
• Teams: meeting recaps with action points for the people who did not attend

For a professional firm billing by the hour, thirty minutes saved per person per week covers the cost comfortably. The productivity case is real. It simply arrives after the permissions work rather than instead of it.

What you are paying for

Worth a short conversation with whoever manages your Microsoft 365 setup. Three questions settle it:

• Are you paying for Copilot add-on seats that duplicate something already in your plan?
• Are those seats assigned to people who use them, or issued and forgotten?
• Does a with-Copilot version of your plan cost less than your current base plan plus the standalone add-on?

Plan pricing and bundling both moved this year, so the answer may not be what it was at your last renewal. We break the numbers down plan by plan in our guide to the Microsoft 365 July 2026 price rise, including why the new rate does not reach your bill until your first renewal on or after 1 July.

Our Microsoft 365 support clients get this review as part of the service, along with the tenant tidy-up above. For regulated firms — wealth managers, legal practices — we treat the permissions audit as mandatory before full Copilot goes anywhere near client files.

The bottom line

What landed in your plan in July was Copilot Chat, and it cannot reach your data. The version that can is a deliberate purchase, which means the timing is yours.

Use that. Spend the week on permissions first, then buy the licences knowing exactly what they will be able to see.

Want the tenant review done properly? Get in touch and we will tell you what full Copilot would currently be able to open in your business, before anyone finds out the interesting way.