Sample · Practical guide

Purpose and structure

This guide is addressed to owners, managing directors and office managers of small and medium-sized businesses that already use Microsoft 365 — for e-mail, for files, for Teams — and now face the question of whether and how to add Copilot. They have no IT department and nobody in-house who sees an admin center every day. They want to know where to click, and above all: what is different afterwards.

The most important thing first, because everything else depends on it: Copilot is not a new place where data is kept. It is a new way of reaching the data that is already there. It reads the mailbox, the files and the Teams messages of the person using it — precisely those the person can access anyway. Not more, but not less either. That sounds reassuring, and it is the actual task: in most businesses, people have access to more than anyone ever decided. A folder that was shared "with everyone" three years ago. A link that went "to everyone in the business" because that was the default. Until now nobody noticed, because nobody looked. Copilot looks. It answers the question "What do my colleagues earn?" from a file that has been lying open for years — and it has done nothing wrong.

That is why setting up Copilot is, to a small extent, assigning a licence, and to a large extent, tidying up the shares. This guide is built accordingly.

Two things are called Copilot

The provider uses the name for two different things. Copilot Chat is a chat with web search that comes with every business account and needs no licence of its own; it works on what you write to it and on the web, not on your files. The licensed Copilot — called "Microsoft 365 Copilot", "Microsoft Copilot" or "Copilot Business" in the admin center, depending on the date of purchase — is the assistant in Word, Outlook, Excel and Teams that reaches mailbox, filing and conversations through the business's own services. This guide is about the licensed Copilot; the chat appears where it is controlled in the same administration interface.

How this guide came about, and what that means for you

This guide describes the administration interfaces as they stood on 15 September 2026. Interfaces age; menus get renamed, switches move. That is why every operating path states where it leads and what must be visible afterwards — if your screen shows something else, your screen is right, and the path here is the clue for what to look for.

The statements about the provider — what happens to inputs, where data is processed, how long it is kept — come exclusively from the provider's own pages, with the date of access and the address under every statement. What is not there is not here either; what could only be verified with an excerpt of the page is marked as a search excerpt and listed in the appendix under "Uncertainties". A gap is a result. A guess would be a harm, because you act on this guide.

What this guide is not

Not legal advice. Whether your business may use Copilot on customer data, whether your contract with the provider covers processing on your behalf, whether a data protection impact assessment is needed — that is decided by your business and by what applies to you. Volume 1 of this series, "AI in the Company", answers these questions in Section 2.4 (the contractual checkpoints) and Section 11 (data protection). Wherever a legal question arises here, the reference is given, not an answer.

Not a usage policy. Who in the business may use Copilot for what is a separate document. Section 7 gives four rules for a start; the complete set of rules with approval procedure and records is Volume 2, "AI Policies for the Workforce", and the AI evidence kit of the same series.

Not purchasing advice and no price. Whether Copilot fits your business as an add-on licence to your existing plan or as a bundle is a question for your invoice, not for this guide. Prices are not stated here because they go out of date.

Not a guide to Excel, PowerPoint, agents or Copilot Studio. The subject is Word, Outlook and Teams — the three places where a small business meets Copilot first. Other providers, such as Google Workspace, are not covered.

Structure

Part I is one page with five decisions to be made before the first click. Part II sets up: Section 2 the licence and the roles, Section 3 the switches on the Copilot page of the admin center, Section 4 filing and sharing — the section this is all about. Part III uses and keeps track: a first working run in Outlook and Word (5), the exclusion list (6), the rules for staff (7), the monthly check (8), the checklist (9). Part IV is the appendix with uncertainties, glossary and sources.

Whoever reads only one section reads Section 4.