Microsoft 365 Copilot for small business: prerequisites

Microsoft 365 Copilot is the AI assistant built into Word, Excel, PowerPoint, Outlook and Teams. In a small business, it can summarize a meeting, write a first draft or find information in company documents. It does not switch itself on: it is a paid add-on license that comes on top of an eligible Microsoft 365 subscription.

Before buying it, the real question is not a technical one: Copilot draws on everything each user can already open. If your access rights and sharing are a mess, it will bring that to light. This guide covers the prerequisites to check and how to run a pilot.

What is Microsoft 365 Copilot for a small business?

Copilot combines a language model with the data in your Microsoft 365 tenant: e-mails, Teams conversations, SharePoint and OneDrive files, calendar. It answers in the context of the signed-in person, with that person's rights. Microsoft states that this data is not used to train its foundation models.

It should not be confused with Copilot Chat, the chat version available to work accounts at no extra license cost, which works mainly from the web and from what the user gives it. The Microsoft 365 Copilot license is assigned person by person: nothing requires you to roll it out to the whole company.

The main risk: data oversharing

Copilot does not bypass permissions. But in many small businesses, permissions are broader than people think: a folder shared with the whole company, an "anyone with the link" link created years ago, a team site open to everyone. Today, these files are mostly protected by the fact that nobody knows where they are. With Copilot, a simple question can bring them to the surface.

The data involved is often sensitive: salaries, personnel files, contracts, customer data. The nFADP requires personal data to be protected by appropriate technical and organizational measures: overly broad access is a problem, with or without AI.

What are the prerequisites before enabling Copilot?

• An eligible Microsoft 365 license for each person involved (for example Business Basic, Standard or Premium) and up-to-date Microsoft 365 apps.
• Accounts protected by multi-factor authentication: a compromised account would also give access to the assistant.
• Reviewed access rights: groups rather than individual permissions, and a named owner for each SharePoint site and each Teams team.
• Reviewed SharePoint and OneDrive sharing: anonymous links, organization-wide links, folders of former employees.
• Sensitivity labels (Microsoft Purview) on sensitive documents, available in Business Premium among other plans.
• Up-to-date content: old drafts and duplicates lower the quality of the answers.

Sensitivity labels: what do they do with Copilot?

A sensitivity label classifies a document (for example Public, Internal, Confidential) and can apply encryption that travels with it, even outside SharePoint. Copilot respects these labels: an encrypted document is only used for people who are allowed to open it, and content created from a labeled document can inherit its label.

For a small business, three or four labels are enough. What matters is to start with the truly sensitive folders rather than trying to classify everything at once.

How to run a Copilot pilot in a small business

Rather than equipping everyone, choose a small group of volunteers with varied work (management, administration, sales) for a few weeks. Before starting, decide what you want to observe: time saved on specific tasks, quality of the results, confidentiality issues encountered.

At the end of the pilot, keep licenses where they are actually used: an unused license is still paid for. SysPros can review the rights and sharing in your tenant, configure the labels and support the pilot; the decision to extend Copilot remains yours.