Microsoft 365 Copilot for Small Business: An Honest Buyer's Guide

Before you buy a single Copilot licence, run this test. Sign in to SharePoint as an ordinary member of staff — not as an administrator — and search for the word “salary”. Then try “disciplinary”, then “settlement”. Whatever comes back is what Copilot will cheerfully find and summarise for that person on their first morning with it.

That test is the part most Copilot guides leave out, and it is the part that decides whether your rollout goes well or badly.

Copilot inherits your permissions — all of them

Copilot has no view of your business of its own. It has the view of whoever is typing. It answers using the files, emails, chats and calendars that person’s account can already reach, and nothing beyond. On paper that sounds reassuring, and it is why Microsoft can sell it to regulated businesses at all.

In practice it is the problem. Very few small businesses have clean permissions. Somebody shared an HR folder with “Everyone” in 2021 to get a form to a colleague quickly. A departed director’s files were reshared to the whole team rather than tidied away. A payroll workbook sits in a general site because that is where it landed. None of it ever surfaces, because finding it takes a human who guesses the file exists, guesses roughly what it is called, and goes looking.

Copilot removes that friction entirely. Ask it what was agreed about pay reviews this year and it reads everything it is allowed to read, in seconds, then writes a tidy summary with citations. It is the most effective permissions audit tool ever sold, and it runs the audit in public.

So the honest first step isn’t Copilot at all

It is a tidy-up. Before licences go anywhere near people, work through the dull list: which SharePoint sites exist, who has access to each, what has been shared with “Everyone”, which sharing links are still live, and where anything sensitive actually lives. HR, payroll, board papers, legal correspondence and client contracts belong in sites with a short, deliberate membership list.

This is ordinary SharePoint work. It is just work most businesses have deferred for years. If your structure grew organically out of an old shared-drive migration, expect a project rather than an afternoon. While you are in there, settle where files are meant to live in the first place — the SharePoint, OneDrive and Teams question usually needs answering before anything else improves.

There is a second reason to do this first. Copilot’s answers are only as good as the material it reads. Feed it eleven versions of the same policy scattered across four sites and it will confidently summarise the wrong one.

What it is genuinely good at

Once the foundations are sound, the value is real — and narrower than the marketing suggests.

• First drafts. A proposal outline, a policy, a client update, a job advert. It gets you to something you can edit, which is a far easier job than starting at a blank page.
• Summarising a long thread or a meeting. Come back from leave to a forty-message chain and ask what was decided and what is outstanding. This alone earns a licence for some people.
• Finding things. “Which document has our cancellation terms?” It beats search here, because it understands the question rather than matching words.
• Rough spreadsheet work. Give it a table and ask for a formula, a pivot, or a summary of what changed. Treat the answer as a starting point and check it.

Where it disappoints

It knows nothing you have not given it access to, so it cannot answer questions about your practice management system, your accounts package or anything living outside Microsoft 365. Its writing has a recognisable house style you will spend time editing out. It occasionally cites a document that does not quite say what it claims. And it is very sensitive to how you ask, which is why the teams who get nothing from it are usually the teams nobody trained.

Anyone expecting it to replace a member of staff will be disappointed. Anyone expecting to save twenty minutes here and forty minutes there, several times a day, usually is not.

Licensing, and who should actually get one

Copilot is a paid per-user add-on that sits on top of your existing Microsoft 365 subscription rather than replacing part of it. Packaging and prices change, so check the current figure in the admin centre or with your provider — but budget for it as a real monthly cost per head, not a rounding error.

Because it is per user, you need not buy for everyone. In a team of twenty, the people who read and write for a living will get value; the people who spend the day inside one application generally will not. Assigning licences deliberately is the same discipline that keeps the rest of your Microsoft 365 subscription matched to what people really do.

Pilot it properly, and pay for the pilot

Pick four or five people across different roles. Give them licences for a couple of months. Spend an hour showing them how to prompt it, because that hour changes the outcome completely. Ask each of them to jot down what worked and what wasted their time.

At the end you will have something better than a vendor case study: your own answer, from your own business. Some teams keep every licence. Some keep two. Both are legitimate results, and either beats buying twenty on a hunch.

If you want the permissions groundwork done before you start — or an honest read on whether Copilot suits your team at all — we are happy to review your Microsoft 365 setup and tell you plainly what we would fix first.