What Is M365 Copilot? A Guide for UK Businesses

Microsoft 365 Copilot is Microsoft's AI assistant for work. It uses large language models to draft, summarise and answer questions inside the Microsoft 365 apps your staff already use, and it can ground those answers in your own emails, files, meetings and chats through Microsoft Graph. So if you are asking what is M365 Copilot, the short answer is a work assistant that works from your organisation's data, within each person's existing permissions.

That last point matters more than the feature list. Copilot is only as safe as your permissions are tidy. This guide, current as at October 2026, explains what the product does, how it handles your data, how it is licensed and what a UK business should put in place before rollout.

What is M365 Copilot?

Microsoft describes Microsoft 365 Copilot as an AI assistant that combines large language models with web data and, for licensed users, organisational data reached through Microsoft Graph and Work IQ. In practice, a user types or speaks a request and Copilot returns a draft, summary, analysis or answer with references to its sources.

Typical requests include:

• Summarise a long email thread or a missed Teams meeting.
• Draft a proposal in Word using notes from a previous document.
• Build a first-pass presentation in PowerPoint from a Word brief.
• Ask Excel to explain trends in a data set or suggest formulas.
• Find what was agreed with a client across emails, files and chats.

It is a family of experiences rather than a single switch. Microsoft separates the free chat experience, which is grounded in web data, from the licensed experience that reads work data. Knowing which one a user has avoids a lot of confusion.

Which apps does Copilot work in?

Microsoft's overview lists Word, Excel, PowerPoint and OneNote for in-app Copilot, with the depth of access depending on licence. Copilot Chat is available in Teams, Outlook and Edge, and users can also reach it through the Microsoft Copilot app on web, desktop and mobile.

For most SMEs, the daily value comes from three places: Outlook for email, Teams for meetings and Word or PowerPoint for documents. If your team is still deciding how to organise files and conversations, our comparison of Teams and SharePoint is a useful companion, because where content lives affects what Copilot can find.

How Copilot uses Microsoft Graph and your tenant data

Microsoft Graph is the layer that connects the content and activity in your Microsoft 365 tenant: mail, calendar, OneDrive and SharePoint files, Teams chats and meetings. When a licensed user asks a question, Copilot retrieves relevant material the user is allowed to see and uses it to ground the response. Users do not need to upload files by hand.

Three points follow from how this works:

• Permissions decide the answer. Copilot only surfaces organisational data the individual has at least view access to.
• Old content counts. A forgotten SharePoint site shared with everyone is searchable in the same way as a current one.
• Unlicensed users differ. Microsoft states that users on the free tier cannot draw on Graph data automatically, though they can upload files or use content open in Teams or Outlook.

Microsoft documents this behaviour in its Microsoft 365 Copilot overview.

Data protection: what Microsoft says it does with your data

Microsoft's published data protection summary makes several commitments that UK decision makers will want to read in full:

• Prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models behind Copilot.
• Customer content is logically isolated per tenant and encrypted at rest and in transit.
• Where content is protected by Microsoft Purview sensitivity labels, Copilot honours the usage rights granted to the user.
• Prompts and responses are stored as Copilot activity history, which administrators can manage through Microsoft Purview retention policies.
• EU traffic stays within the EU Data Boundary, while worldwide traffic may be processed in other regions.

Administrators also choose whether to enable third-party models and agents, and additional terms may apply. Microsoft notes that models from Anthropic, as a subprocessor, are currently excluded from the EU Data Boundary. Check these settings against your own data residency requirements. The full detail is in Microsoft's Copilot data protection summary.

Licensing requirements and price

Microsoft's documentation sets out three practical tiers as at October 2026:

Users should sign in with a Microsoft Entra work account, and your network, proxy and Conditional Access settings must not block Copilot endpoints. Some advanced features, such as Copilot Cowork, are billed by usage in addition to the per-user licence.

On its UK small business page, Microsoft lists the Copilot add-on at £13.80 per user per month on an annual commitment, or £19.32 per user per month billed monthly, both excluding VAT. Prices and promotions change, so confirm the current figure on Microsoft's page or with your licensing partner before budgeting. Our Microsoft 365 support team can map licences to users.

Readiness steps before you switch Copilot on

Microsoft's own Copilot blueprint treats oversharing as the first pillar to fix, because Copilot grounds responses in data users can already reach. A sensible order of work:

1. Review who can access what

Audit SharePoint sites, OneDrive sharing and Teams membership. Remove "everyone" and broad organisation-wide links on sites holding HR, finance, legal or client material. Retire sites nobody uses.

2. Use the tools Microsoft provides

Microsoft states that SharePoint Advanced Management is included with a Copilot licence, and describes the approach as identifying high-risk sites, applying interim restrictions, fixing access and then enforcing guardrails. See the oversharing blueprint.

3. Label sensitive content

Sensitivity labels in Microsoft Purview let you encrypt and restrict the content that matters most, and Copilot respects those usage rights. Start with a short label set rather than a complex scheme.

4. Check identity and device security

Enforce multi-factor authentication, Conditional Access and managed devices. A security review such as our cyber security audit is a sensible baseline, and Cyber Essentials covers the fundamentals.

Risks to plan for

Copilot does not remove existing risks. It can make them easier to find. Plan for:

• Oversharing exposure: an employee asks a harmless question and receives content they should never have been able to open.
• Accuracy: outputs can be wrong or out of date. Staff must check anything sent to clients or relied on for decisions.
• Personal data: prompts and outputs may include personal data, so your UK GDPR obligations, retention and privacy notices still apply.
• Third-party agents and models: each one has its own permissions and terms that an administrator should review.
• Cost without use: licences bought for everyone and used by few are the usual waste.

An acceptable use policy, short and specific, deals with most of these. It should say which data types must never go into prompts, who approves new agents and how staff report a wrong or sensitive output. Review it after the pilot, when you know how people actually use the tool. Your small business security controls should be in place before the pilot starts.

Adoption: how to roll out Copilot sensibly

Start small and measure. A workable pattern:

• Pick 10 to 25 users across two or three roles with repeatable tasks, such as account managers, finance staff and operations leads.
• Set two or three measures before the pilot, for example time spent on meeting follow-ups or first drafts.
• Give short, role-based training with example prompts drawn from real work.
• Review usage reports after 6 to 8 weeks and reassign unused licences.
• Expand by team once permissions work and the policy has been tested.

Adoption usually stalls when training is generic. Show people how Copilot helps with a task they already dislike, and nominate a champion in each team to share prompts that worked.

A managed provider can run the permissions review, licensing and training together. If you want that support, see our managed IT support service.

Conclusion: is M365 Copilot right for you?

So, what is M365 Copilot worth to your business? It is a capable assistant for drafting, summarising and searching, and it is safe in proportion to the state of your permissions, labels and identity controls. Microsoft's published commitments are clear on training and tenant isolation, but the responsibility for access sits with you.

Fix the data access first, pilot with a small group and measure the result before buying more licences. To discuss readiness for your tenant, contact NetMonkeys.

Frequently Asked Questions (FAQs)