Microsoft 365 Copilot is an add-on license that puts a chat assistant inside Word, Excel, Outlook, Teams, and PowerPoint, and lets it read the files, emails, and chats your account already has access to. That last clause is the whole story: Copilot is only as safe as your SharePoint and Teams permissions are tidy, which is why some organizations should clean house before they buy a single seat.
We get asked about Copilot more than any other AI topic, usually in the same shape: “Is it worth it, and what am I signing up for?” Here is the practical version, aimed at organizations in the 25 to 300 employee range across construction, healthcare, legal, hospitality, professional services, and manufacturing.
What Copilot Actually Does (Not the Demo Version)
Strip away the marketing and Copilot does four things reliably well.
It summarizes long things. A 40-page subcontractor agreement, a 90-minute recorded Teams meeting, a mail thread with 22 replies. It produces a readable summary with the action items pulled out. For an office manager reconstructing what was decided in a meeting they missed, this is the single highest-value feature.
It drafts first passes. Proposal boilerplate, client update emails, job descriptions, meeting agendas, policy language. The output is a competent first draft that needs a human edit, not a finished document. Teams who treat it as a starting point get value. Teams who expect finished work get frustrated.
It answers questions across your own content. “What did we quote the Marietta project at last spring?” “Which vendor contracts renew in Q3?” Copilot searches across SharePoint, OneDrive, Outlook, and Teams and answers with citations. This is the feature that makes people say “wow” in demos, and also the feature that surfaces oversharing problems, which we will get to.
It does structured work in Excel and PowerPoint. Turning a table into a chart, explaining a formula, building slide scaffolding from a Word document. Useful, occasionally clumsy, and better in Excel than PowerPoint in our experience.
What It Does Not Do Well
Copilot is not a research tool for things outside your tenant. It does not replace a paralegal reading a contract for risk, a clinician reviewing a chart, or a controller reconciling accounts. It occasionally cites the wrong document or confidently misstates a number, so anything going to a client, a regulator, or a court needs human verification. And it does not fix bad inputs: if your SharePoint is a decade of unlabeled folders named “Final v3,” Copilot’s answers will reflect that.
Licensing Reality
Copilot for Microsoft 365 is a per-user add-on priced at $30 per user per month, billed annually at the standard rate, and it requires an underlying Microsoft 365 Business Standard, Business Premium, or enterprise plan. There is no free tier for the in-app version that reads your company data. The free Copilot chat experience is a different product with no access to your files.
The math matters for SMBs. For a 60-person firm licensing everyone, that is roughly $21,600 per year. Almost no organization we work with needs 60 seats on day one.
A more realistic path:
- Pilot with 5 to 10 seats across different roles. Include at least one skeptic and one power user.
- Run it for 60 to 90 days with a simple log of what each person actually used it for.
- Expand to the roles where it earned its keep. In practice that tends to be operations managers, business development, HR, and executive assistants. It tends to be less compelling for field staff, production floor roles, and anyone who lives in a line-of-business application rather than Office.
Budget internal time too. Expect a few hours of enablement per user over the first month, plus admin time on the permission work described below. Copilot is not a tool people figure out on their own; without prompting guidance, most users try it twice, get a mediocre result, and stop.
The Prerequisite Most SMBs Miss: Permission Hygiene
Here is the part that gets skipped, and it is the reason we sometimes tell a client to wait.
Copilot respects Microsoft 365 permissions exactly. It does not grant new access. But it makes existing over-permissioning visible in a way that browsing SharePoint never did. If a folder containing salary spreadsheets was shared with “Everyone in the organization” three years ago during a reorganization, nobody noticed, because nobody went looking. Copilot goes looking every time someone asks a question.
Common oversharing patterns we find in SMB tenants:
- “Anyone with the link” sharing links from years ago that never expired
- HR, payroll, or legal folders inherited from a parent site with broad access
- Teams created for a project, later filled with sensitive files, membership never pruned
- Departed employees’ OneDrive content re-shared broadly during offboarding
- Executive documents in a personal OneDrive shared to a distribution list
None of these are exotic. All of them will show up in Copilot answers.
The pre-Copilot checklist we run:
- Inventory sharing links and site permissions. Identify everything shared organization-wide or via open links.
- Fix the top offenders first. Payroll, HR files, legal matters, M&A material, credentialing files, and anything with client financial data.
- Set default sharing to “specific people” and put expiration dates on new links.
- Apply sensitivity labels to the categories that matter most, so restricted content stays out of Copilot responses and out of downstream copies.
- Prune stale Teams and group memberships, then set a recurring review.
For a typical 75-person tenant, this is a scoped project measured in days, not months. It is also work worth doing whether or not you ever buy Copilot, because the same oversharing is what turns one compromised mailbox into a company-wide data exposure. We treat it as part of the same discipline covered under /services/cybersecurity/.
Vertical Considerations
Medical and dental. Copilot processes data inside your Microsoft 365 tenant under your existing agreements, and Microsoft’s Business Associate Agreement terms cover the in-scope services. That does not make every use case appropriate. Clinical documentation belongs in your EHR, not in a Word document that Copilot summarizes. Keep PHI out of ad hoc file shares first, then evaluate. See /industries/healthcare/.
Law firms. Privilege and matter-level confidentiality are the constraint. Copilot indexes what the user can see, so a firm-wide-readable matter folder is a real problem. Ethical walls need to exist in permissions, not just in policy. Firms should also confirm what their malpractice carrier and larger clients expect regarding AI disclosure. More at /industries/legal/.
Manufacturing with defense work. If you are pursuing or holding CMMC requirements, controlled unclassified information handling drives everything. Verify your tenant environment and Copilot availability against your CMMC scope before enabling anything, and document the decision.
Construction, hospitality, and professional services. Generally the easiest fit. Proposal drafting, RFI summarization, meeting recaps, and vendor correspondence all map cleanly to Copilot’s strengths. The main risk is subcontractor pricing and employee data sitting in loosely shared project folders.
You Also Need a Short AI Policy
Before seats go live, put a one-page acceptable-use policy in front of staff. It does not need to be a legal document. It needs to answer: which AI tools are approved, what categories of data may never be pasted into a public tool, that AI output must be reviewed by a human before it goes to a client or regulator, and who to ask when unsure.
This matters because the alternative is already happening. Employees at most companies we assess are using free public AI tools on work content, and public tools may retain and use what gets pasted into them. Approving a governed tool like Copilot and pairing it with a clear ai policy is how you pull that activity back into a place where ai data privacy and ai security are actually manageable.
Who Should Wait
Wait if your SharePoint permissions have never been reviewed. Wait if you are mid-migration or mid-tenant-consolidation. Wait if you handle CUI and your CMMC scope is unresolved. Wait if you cannot name three specific workflows you expect it to improve, because seats without use cases become shelfware in one billing cycle.
Everyone else: pilot small, measure honestly, expand where it earned it.
Talk It Through With Century
If you are weighing Copilot for your team, the useful first step is not a licensing quote. It is a look at your tenant to see what a Copilot query would actually be able to reach. Century runs a Microsoft 365 permission and sharing assessment for Atlanta-area SMBs that produces a plain-language report on oversharing, a prioritized remediation list, and an honest read on whether Copilot fits your workflows right now.
Reach out through /contact/ for a 30-minute discovery call. We will tell you if you are ready, and we will tell you if you should spend the next month cleaning up first.