Copilot for Microsoft 365 went GA on November 1 with an enterprise-only posture: E3 or E5, 300-seat minimum, annual commitment. We have had it running in production tenants for about ten weeks now, across a few hundred seats in three organizations. Yesterday Microsoft changed the rules: the 300-seat minimum is gone, Office 365 E3/E5 and Business Standard/Premium tenants can buy in, and a consumer Copilot Pro appeared at 20 dollars a month. The gate just opened for every mid-market shop that was priced out in November.
The calls we are getting this week all sound the same: we can finally buy 25 seats, where do we start? The honest answer disappoints people. You do not start with prompt training, a center of excellence, or a slide about the future of work. You start with SharePoint permissions, and you should budget more time for that than for everything else combined.
Ten weeks is not long, but production compresses lessons. Here is what held up.
What January 15 changed, and what it did not
The licensing move matters more than the price. At 30 dollars per user per month on an annual term, a 100-seat deployment is 36,000 dollars a year — real money, and now a decision a 150-person company is allowed to make. Business Premium shops get the same Copilot the Fortune 500 got in November, which means they inherit the same prerequisites with a fraction of the IT staff to meet them.
What did not change: the readiness work. If anything the problem is worse downmarket, because smaller tenants tend toward flatter permission models, more org-wide sharing, and no information architecture to speak of. The 300-seat minimum was, accidentally, a governance filter. It is gone now.
Copilot Pro is the wildcard. It is a personal subscription against a personal Microsoft account — it does not touch tenant data and it is not an enterprise product. But your users will buy it on their own cards, run it against documents they copied out of the tenant, and then try to expense it. Decide this month what your acceptable-use policy says about that, because it is already happening whether you decided or not.
The finding is always oversharing
Copilot does not bypass permissions. It honors them with total fidelity, and that is exactly the problem: most tenants have spent a decade accumulating permissions nobody understands. Search made this survivable, because finding the overshared file required knowing it existed and guessing the right keywords. Copilot removes the obscurity. Ask a natural question, get back a file you were never supposed to see but were always technically able to open.
A 6,000-seat insurer we work with started a 300-seat pilot in mid-November. Within two weeks the pilot channel logged three incidents worth the name. A compensation review spreadsheet surfaced in a drafting session because it lived on a site carrying an org-wide "Everyone except external users" grant from 2019. A draft board deck showed up as a cited source for a strategy question. And a due-diligence folder from an acquisition that closed years ago appeared in results because the site was still live and its sharing default had been "Anyone with the link" since the 2020 scramble into Teams.
None of these were breaches. Every one of those users already had access on paper. The line we now deliver in the first workshop: Copilot did not create your oversharing problem, it shipped a conversational interface for it.
Permissions hygiene is the real prework
The prework is unglamorous and it is the whole game. The sequence we run:
First, measure the blast radius. Pull sharing posture across the tenant: sharing capability per site, active "Anyone" links, org-wide grants, sites untouched for two years. The SharePoint admin center reports get you started; SharePoint Advanced Management adds data access governance reports and site access reviews if the licensing is there. Even a crude export is enough to rank the worst offenders:
Connect-SPOService -Url https://tenantname-admin.sharepoint.com
Get-SPOSite -Limit All -IncludePersonalSite $false |
Select-Object Url, SharingCapability, LastContentModifiedDate, Owner |
Export-Csv .\site-sharing-posture.csv -NoTypeInformation
# Anonymous-capable sites are the first hunt
Get-SPOSite -Limit All |
Where-Object SharingCapability -eq "ExternalUserAndGuestSharing" |
Select-Object Url, Title
Second, fix defaults before instances. Move the tenant default off "Anyone," disable anonymous links wherever no business case survives contact with a direct question, and set the default link type to people with existing access. Every day a permissive default stays in place, the remediation pile grows behind you.
Third, remediate by sensitivity, not by count. You do not need to fix four thousand sites before piloting; you need to fix the fifty that hold compensation, legal, M&A, security, and executive content. Label those with sensitivity labels, apply encryption where warranted, and wire Purview DLP and auto-labeling to catch new material. A labeled, encrypted file that Copilot cannot open into a summary is a control that keeps working even when a site permission is wrong.
Fourth, deal with the graveyard. Stale sites with live grants are pure downside: nobody reads them, Copilot will. Archive or delete on a schedule, and give every surviving site a named owner, because a site nobody owns is a site nobody will ever clean.
Pick a pilot cohort that can produce a decision
The default pilot cohort — executives, their assistants, and IT enthusiasts — produces anecdotes, not decisions. Executives do not do the repetitive work Copilot is best at, and enthusiasts rate everything five stars. You end the pilot with warm feelings and no renewal case.
The insurer's second tranche worked better: a hundred seats spread across claims supervisors, underwriting support, project managers, and one field sales team, with a handful of loud skeptics included on purpose. Heavy-meeting and heavy-document roles, real deadlines, people with no stake in the project succeeding. We instrumented from day one: the Copilot Dashboard in Viva Insights for per-app usage, a five-question weekly pulse, and two running logs in the pilot channel — "saved me real time this week" and "confidently wrong," both with screenshots required. The second log is the one executives actually read, and maintaining it honestly bought the project more credibility than any adoption number.
Give the pilot an end date and a decision it must produce: expand, hold, or hand seats back. A pilot without a kill criterion is just a purchase with extra steps.
The 30-dollar math, done honestly
At 360 dollars per user per year, someone at a 55-dollar loaded hourly rate breaks even at roughly seven hours saved annually — call it 35 minutes a month. That bar is so low it creates its own trap: every user will clear it in a self-reported survey, which is why self-reported time savings are worthless as a renewal case. Watch behavior instead. Usage in week six matters more than week one; novelty decays hard, and a seat that goes quiet by week four was never going to earn its renewal no matter what the survey said.
Where value concentrated for us: meeting recap — which requires transcription on, which forces the transcript retention policy conversation you have been deferring — summarizing long mail threads with open questions extracted, and first drafts generated from an existing document instead of a blank page. Where it consistently underdelivered: Excel, still the weakest app in the suite and effectively preview-grade; anything involving arithmetic; and cross-document questions where the grounding was not obvious from the prompt.
Budget note: buy seats in tranches tied to observed usage, not org charts. Nothing in the license terms rewards buying 500 on day one, and the January changes make small increments respectable.
Training that helps, training to skip
Skip the generic prompt-engineering course. Nobody in claims needs a taxonomy of personas. What moved our numbers was a library of about a dozen recipes tied to the tenant's own work: recap this meeting and list decisions with owners; draft a status update from this document in my voice; what did I miss in the last three days; rewrite this paragraph for a customer audience. Fifteen-minute sessions, one recipe at a time, run by a peer rather than a trainer, in a channel where people paste both wins and faceplants.
Set expectations about the ceiling in the same breath. It does not reliably chain multi-step work across apps. Extensibility through Graph connectors and plugins is early days. It will state wrong things fluently, so verification is part of the recipe, not a disclaimer at the end of the deck. Users forgive a tool that is honestly framed; they do not forgive one that was oversold to them by their own IT department.
What the helpdesk actually fields
Plan the support model around what the tickets actually are, because they are not what the vendor deck implies. In the first two weeks the queue is dominated by two things, and neither is a defect. The first is "Copilot doesn't appear," which is almost always license assignment lag, a client that has not updated, or a user on the wrong channel — mundane provisioning work that swamps the desk if nobody warned them it was coming. The second, and the more delicate, is "Copilot showed me something it shouldn't have," which is not a Copilot bug at all but the oversharing finding arriving one user at a time. Route that second category straight to whoever owns the sharing remediation, and give the frontline a script that does not blame the user or the tool, because the honest answer — you always had access, we are cleaning that up — is not one a Tier 1 agent can improvise gracefully under pressure. Standing up that triage path before go-live, rather than discovering it in the queue, is the difference between a rollout that feels controlled and one that feels like a leak.
If you're facing this
We have run this cycle — sharing posture triage, labeling, pilot design, honest measurement — enough times now to know where the calendar time actually goes. If seats just became affordable for your tenant and the readiness list suddenly looks longer than the rollout plan, that instinct is correct, and it is cheaper to act on it before the licenses land. Get in touch and we will compare notes against your estate.