Microsoft 365 Copilot for business: what to check before buying

Short answer: Microsoft 365 Copilot is worth evaluating if your team already works in Word, Excel, Outlook and Teams daily. It costs US$18 per user per month as an add-on to a qualifying Microsoft 365 licence, with no minimum seats. Before buying, audit your SharePoint permissions: Copilot surfaces anything a user can access, including files they should not see.

Microsoft recently renamed "Microsoft 365 Copilot" to "Microsoft Copilot", but the licensing, features and prerequisite plans are unchanged⁶. This post uses the name most Australian businesses still search for. If the name shifts again, the checklist stays the same.

Who should buy it (and who should not)

Copilot earns its licence fee fastest in teams that spend most of their day inside Microsoft 365: writing documents in Word, clearing an inbox in Outlook, summarising meetings in Teams or building decks in PowerPoint. If your team does that work for two or more hours a day per person, the arithmetic on US$18 per seat is straightforward.

It is harder to justify if your team primarily uses Google Workspace (Gemini is already included in your subscription), if you rarely open the desktop Office apps, or if your Microsoft 365 plan is Basic and your work is mostly email and calendar. Copilot does not make sense as a purchase purely for access to a general-purpose chatbot: for that, standalone tools like Claude or ChatGPT are cheaper and more capable outside the Office apps.

If your team handles sensitive client data and your organisation is in a regulated industry, read the data residency section below before you sign. The commitments are real, but they come with qualifications that matter.

Product names and what you actually get

Microsoft now offers three tiers of Copilot for business. The naming changed in 2026, and the documentation still mixes old and new terms, which makes the purchase decision harder than it should be⁶.

The Premium add-on is what most businesses mean when they say "buy Copilot". The included Basic tiers exist, but they are limited enough that many teams will not notice the difference from not having Copilot at all⁶.

Prerequisite licences

You cannot buy the Copilot add-on without a qualifying Microsoft 365 plan underneath it². For small and mid-sized Australian businesses, the qualifying plans are:

• Microsoft 365 Business Basic, Business Standard or Business Premium
• Microsoft 365 Apps for Business
• Microsoft Teams Essentials

Enterprise plans E3, E5, F1 and F3 also qualify, along with the older Office 365 E1, E3 and E5 plans². Microsoft 365 E7 includes Copilot without a separate add-on. There is no minimum seat count on any plan.

If your team is on Business Basic (the cheapest qualifying plan at roughly US$6 per user per month), adding Copilot triples the per-seat cost. Check whether the workflows below actually apply to how your team uses Microsoft 365 before committing.

Plans and pricing

All prices are in US dollars. Microsoft does not publish AUD pricing for the Copilot add-on; your invoice converts at the prevailing exchange rate. Prices were verified against Microsoft's pricing page on 30 September 2026¹.

If your team does not already have a qualifying Microsoft 365 plan, the Business Standard bundle at US$23.50 per seat is the most practical entry point: it includes the Office apps and Copilot together¹. For a broader look at how Copilot's cost compares to standalone AI tools, our ChatGPT alternatives comparison covers Claude, Gemini, Perplexity and self-hosted options side by side.

What Copilot does in each app

The capabilities below apply to the Premium (paid) Copilot licence. Each comes with a limitation worth knowing before you commit⁵⁶.

Email (Outlook)

Copilot summarises long email threads into a few paragraphs, drafts replies that match the tone of the conversation, and applies coaching tips that flag unclear phrasing or overly direct language. For a team that processes dozens of emails a day, this is where the time savings are most visible.

Limitation: Copilot drafts occasionally pull details from other threads in your inbox, because it has access to your full mailbox through Microsoft Graph. Review every draft before sending, particularly to external recipients.

Meetings (Teams)

Copilot summarises Teams meetings (including ones you join late or miss entirely) and captures action items. It can draw on up to 30 days of meeting history⁶. For teams that run four or more meetings a day, this replaces manual note-taking.

Limitation: meeting summaries require transcription to be enabled. If your organisation's compliance policy restricts recording or transcription (common in legal and financial services), Copilot in Teams is effectively unavailable for those meetings.

Spreadsheets (Excel)

Copilot in Excel analyses data tables, suggests formulas, creates pivot tables and generates charts from natural-language prompts. If someone asks "show me revenue by quarter as a bar chart", Copilot can produce it without the person knowing how to build a pivot table.

Limitation: Excel Copilot works best with clean, structured data in Excel tables. The typical business spreadsheet (merged cells, mixed data types, multiple header rows, formulas referencing other sheets) causes Copilot to struggle or fail silently. Clean your data first.

Documents (Word)

Copilot in Word drafts documents from a prompt or an existing file, rewrites sections for a different audience and summarises long documents. For policy documents, proposals and reports, it produces a reasonable first draft that a human can edit into shape.

Limitation: when drafting from your organisational data (pulling from SharePoint or OneDrive), Copilot may include content from files the user has permission to access but should not have seen. This is the oversharing problem described below, and it is a permissions issue, not a Copilot bug.

Presentations (PowerPoint)

Copilot creates slide decks from a prompt, an existing Word document or an outline. It applies your organisation's slide templates and suggests speaker notes. For a team that builds internal decks weekly, this turns an hour of formatting into ten minutes of editing.

Limitation: generated slides default to generic layouts. If your organisation has strict brand guidelines, the output still needs manual adjustment. Copilot also cannot access images stored locally: only images in OneDrive or SharePoint.

Permissions and oversharing: check before you enable

This is the section most vendors skip and the one that matters most. Copilot respects your existing Microsoft 365 permissions: it will never show a user data they cannot already access³. But in most organisations, the permissions model is far more permissive than anyone realises.

SharePoint sites created with "Everyone except external users" sharing (the default in many tenants) give every employee access to every file in that site. Before Copilot, nobody noticed because nobody searched for it. With Copilot, a user asking "what are the latest salary figures" might get an answer drawn from an HR spreadsheet they technically have access to but were never meant to read.

Microsoft's own setup documentation recommends these checks before enabling Copilot⁵:

• Run the SharePoint Advanced Management permission state report on your top 100 most-used sites
• Disable "Everyone except external users" sharing at the tenant level
• Apply sensitivity labels to confidential documents using Microsoft Purview
• Enable audit logging to monitor Copilot interactions
• Review conditional access policies

If your organisation has never audited SharePoint permissions, doing so before enabling Copilot is not optional. It is the difference between a useful tool and a data leak that surfaces in AI-generated summaries. An AI acceptable-use policy that names the permissions review as a prerequisite catches this before it becomes a problem. The AI governance framework covers how to build the review process around it.

Data training, retention and Australian data residency

Three questions every Australian business should ask before signing.

Does Copilot train on my data?

No. Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation large language models³. Optional customer feedback may be used to improve the service, but that is separate from model training and can be disabled by the admin.

How long is my data retained?

Copilot stores the user's prompt, the response and citations to the information used to ground the response. This data follows your existing Microsoft 365 retention policies. Admins can manage it through Content Search and Microsoft Purview, and users can delete their own Copilot activity history through the My Account portal³.

Where is my data processed?

This is where the detail matters. If your Microsoft 365 tenant is provisioned in Australia, customer data at rest for core services (Exchange Online, SharePoint, OneDrive, Teams and Copilot) stays in Australian data centres in Melbourne and Sydney. This is a durable commitment under the Microsoft Product Terms, and it has applied to Copilot since March 2024⁴.

However, the LLM inference (the actual processing of your prompts) is different. Microsoft routes Copilot calls to the nearest data centre with capacity, but during high utilisation periods, calls may be routed to data centres in other regions. For customers outside the EU, queries may be processed in the US, EU or other regions³.

In plain terms: your files and Copilot history stay in Australia, but the prompt itself may travel to a US or EU data centre for processing. For most businesses, this is acceptable. For organisations subject to strict data sovereignty requirements (financial services under APRA CPS 234, government agencies with onshore-only mandates), the distinction between data at rest and inference processing matters and should be reviewed with a privacy adviser.

Running a pilot

Do not roll Copilot out to every seat on day one. Microsoft's own adoption documentation recommends a phased approach⁵, and the oversharing risk makes this more important than it is with most software purchases.

An illustrative pilot for a 20-to-50 person Australian business:

1. Scope: five to ten users across two departments (one administrative, one technical), 30 days, Premium licences only
2. Prerequisite: complete the SharePoint permissions audit and sensitivity labelling before the first licence is assigned
3. Measure: self-reported time saved per week, number of Copilot interactions per user (available in the admin centre usage report⁶), and whether any oversharing incidents appear in the audit log
4. Go/no-go after 30 days: at least 60 per cent of pilot users used Copilot in the final week; average self-reported time saving exceeds 30 minutes per week; zero oversharing incidents that exposed data to the wrong audience

If the pilot fails the go/no-go criteria, the answer is usually not to cancel Copilot. It is to fix the underlying problem (permissions, training, data quality) and run the pilot again. The tool is only as good as the data it accesses, and most Australian businesses have never cleaned their SharePoint because nothing forced them to. Copilot forces the question, which is honestly one of its most useful side effects.

If you are starting from scratch with AI, the pilot checklist above works for any tool, not just Copilot. The Bulletproof approach is always to measure the workflow before changing it.

Frequently asked questions

Does Microsoft 365 Copilot use my business data for training?

No. Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation large language models. This applies to all Copilot licence tiers. Optional customer feedback may be used to improve the service, but it does not train the underlying models³.

How much does Microsoft 365 Copilot cost per user?

The Copilot add-on costs US$18 per user per month on annual billing through December 2026, discounted from the standard US$21. Monthly billing is US$25.20. You also need a qualifying Microsoft 365 licence underneath, so the true cost is the base plan plus the add-on. There is no minimum seat count¹.

Do I need a specific Microsoft 365 plan for Copilot?

Yes. The Copilot add-on requires a qualifying Microsoft 365 licence. For small businesses, that means Business Basic, Standard, Premium or Apps for Business. Enterprise plans E3, E5, F1 and F3 also qualify. Microsoft 365 E7 includes Copilot without a separate add-on².

Is my data kept in Australia with Microsoft 365 Copilot?

If your Microsoft 365 tenant is provisioned in Australia, customer data at rest for core services including Copilot stays in Australian data centres in Melbourne and Sydney. However, LLM inference calls may be processed in other regions during high utilisation. Data at rest and inference processing are separate commitments³⁴.

What is the difference between Copilot Chat and the paid Copilot licence?

Copilot Chat is included with eligible Microsoft 365 subscriptions at no extra cost and uses web data only. The paid Copilot licence adds deep integration inside Word, Excel, PowerPoint, Outlook and Teams, with automatic grounding in your organisational data through Microsoft Graph. The paid licence also includes priority access⁶.