Copilot Is Now in Microsoft 365 Business Plans: Read This First

As of 1 July 2026, Microsoft folded Copilot into Microsoft 365 Business Standard and Business Premium. If your firm is on either plan, AI assistance is no longer a purchasing decision you were putting off — it is a capability your staff may already be using, whether or not anyone planned for it.

For most small firms this is genuinely good news. Copilot in Word, Outlook, Excel and Teams saves real time on real work. But there is one thing to understand before you celebrate, and it is the thing Microsoft’s announcement understandably does not lead with.

Copilot Can See Everything Your Staff Can See

Copilot does not have its own view of your business. It answers questions using whatever the person asking has permission to access across SharePoint, OneDrive, Teams and Exchange.

That sounds reasonable until you remember how permissions actually look inside a typical ten-year-old Microsoft 365 tenant: a “Company Shared” library everyone can open, an old HR folder with inherited access nobody reviewed, a director’s OneDrive share from 2021 that was never unshared.

Before Copilot, that mess was protected by obscurity — nobody could find the salary spreadsheet six levels deep in a folder from a previous office move. Copilot removes the obscurity. Ask it “what do people get paid here?” and it will cheerfully search everything you technically have access to. The risk is not a hacker. It is your own tenant, honestly answering questions you never expected anyone to ask.

This is not hypothetical: across businesses adopting Copilot, data governance is consistently reported as the number-one barrier — ahead of cost or training. The firms that get value from day one are the ones that tidied up first.

The Pre-Flight Checklist

Before encouraging (or even permitting) broad Copilot use, run through these — roughly a week of part-time work for a small firm, and all of it worth doing even without AI:

1. Review who can access what. Start with the obvious blast zones: HR, payroll, board papers, client files, anything marked confidential that lives in a shared library. Fix inherited permissions and kill stale sharing links.

2. Label what’s sensitive. Sensitivity labels in Microsoft 365 tell Copilot (and everything else) what confidential looks like. Even three labels — Public, Internal, Confidential — change the game.

3. Switch off what you don’t use. Old Teams sites and abandoned SharePoint libraries are permission archaeology. Archive them. Less surface, fewer surprises.

4. Decide your policy before your staff decide it for you. Which roles get Copilot first? What may staff paste into it? Two paragraphs of written guidance now beats an awkward investigation later.

5. Then roll it out deliberately. Start with a pilot group, collect the genuinely useful prompts they discover, and share those with everyone else. Adoption data across the market shows most licensed users barely touch Copilot without this kind of nudge — the licence being “free” in your plan does not make the value automatic.

We wrote a deeper dive on the security side in our Copilot governance guide; the July change makes that advice urgent rather than optional.

The Upside, Once You’ve Done the Homework

We are not AI sceptics — quite the opposite. Used well, Copilot is the most useful thing to land in the small-business Microsoft stack in years:

• Outlook: summarise a fortnight-long email thread before the call about it
• Word: first drafts of proposals from a bullet list and a previous example
• Excel: “explain what’s driving the variance in this sheet” — in plain English
• Teams: meeting recaps with action points for the people who didn’t attend

For a professional firm billing by the hour, even thirty minutes saved per person per week pays for the entire Microsoft plan. The productivity claim is real. It just arrives after the permissions work, not instead of it.

What This Means for Your Licensing

Worth a quick check with whoever manages your Microsoft 365 setup: if you were paying for Copilot seats as a separate add-on, the July change may mean you are now paying twice. And if you are on plans that don’t include it, this is a sensible moment to review whether your current mix still makes sense — plan pricing and bundling have both moved this year.

Our Microsoft 365 support clients get this review as part of the service, along with the tenant tidy-up above. For regulated firms — wealth managers, legal practices — we treat the permissions audit as mandatory before Copilot goes anywhere near client files.

The Bottom Line

Microsoft just made the Copilot decision for you: it is in the plan. The only decision left is whether it meets a tidy tenant or a messy one on its first day.

Spend the week on permissions. Then enjoy the robot.

Want the tenant review done properly? Book a free 30-minute chat and we will tell you exactly what Copilot would currently be able to see in your business — before one of your staff finds out the interesting way.