Ask whoever looks after your IT what they think of Microsoft Copilot and you will probably hear something positive. It stays inside your Microsoft environment, it follows the permissions you already have, and nothing new has to be approved. Ask the office manager who has had a license for three months and you may hear something different. It is fine for summarizing a meeting. It doesn’t really know how the business works, and they stopped opening it.
Both of them are right. That split came up in a session I sat in on recently with the AI team at one of the technology distributors I work with, and it matches what I see in small businesses: the people responsible for protecting the company like Copilot, and the people trying to get work done find it too rigid.
The useful question isn’t which side wins. It’s what has to happen for Copilot to earn its license with both of them.
Why the Security Side Likes It
From a risk point of view, Copilot is about the easiest AI tool a business can approve, and there are good reasons for that:
- It stays inside your Microsoft 365 environment. Your documents and email are not being pasted into a website somebody found on their own.
- It respects existing permissions. Copilot can only see what the person using it can already open. It doesn’t hand the receptionist the payroll folder.
- Your business data isn’t used to train Microsoft’s models. That is the single most common concern I hear from owners, and with Copilot it has a clear answer.
- It comes with admin controls. Who gets a license, which features are turned on, which add-ons and agents are allowed. It is managed in the same admin center as the rest of Microsoft 365.
Compare that with the alternative most businesses actually have, which is staff using free AI tools in a browser tab with nobody approving anything. Next to that, Copilot looks like the responsible choice, and it is.
Why the Operations Side Doesn’t
The complaints from the people using it are just as consistent:
- It doesn’t know your business. Out of the box, Copilot knows your files and email. It doesn’t know your pricing rules, your job process, how you quote, or what a good answer looks like for your customers.
- It mostly lives inside Microsoft apps. A lot of the real work in a small business happens somewhere else: the scheduling system, the accounting software, the industry platform everything runs on. If Copilot can’t see into those, it can’t help with the tasks people actually want help with.
- It is only as good as your files. If the shared drive has six versions of the price sheet and nobody knows which is current, Copilot will find all six and pick one with confidence.
- Nobody showed them how to use it. A license turns up, maybe with an email about it. People try a few vague questions, get vague answers, and decide it isn’t for them.
None of that is Copilot failing. It is a general tool sold per person, landing in a business that never told it anything specific.
The Middle Ground Most Businesses Miss
A point from that session stuck with me: there are firms now whose whole business is customizing Copilot for a company and training the people who use it. That tells you where the value actually is. The license is the starting point. The setup and the training are what make it useful.
In practice that usually means some combination of:
- Cleaning up what Copilot reads. One current version of the documents that matter, in a place it can find, with old copies archived. This also fixes a real security issue, because Copilot will happily surface any file somebody shared too broadly years ago.
- Building a few agents for specific jobs. Microsoft’s Copilot Studio lets you set up an assistant for one task, like answering staff questions from the employee handbook, drafting quotes from your actual price list, or pulling information from a system outside Microsoft. Administrators can review and approve these before anyone uses them, which keeps the security side comfortable.
- Training by role, not by feature. Showing the office manager the five things Copilot does well for an office manager beats a general webinar on everything it can do.
- A shared set of prompts that work. When one person finds a way of asking that gets a good result, write it down and share it. That alone moves a lot of people from “it’s useless” to “it saves me an hour a week.”
Don’t Buy Licenses for Everyone
Copilot is licensed per person, as an add-on to the Microsoft 365 plan you already pay for. That makes it tempting to buy it for the whole company and see what happens. Usually what happens is the pattern above: a handful of people use it, most don’t, and the bill stays the same.
A better approach is the same one I wrote about in Start With One AI Use Case, Not Ten. Pick the roles where it is most likely to help, usually the people who spend their day in email, documents, and meetings. License those people, set it up for what they actually do, train them, and give it ninety days with a number you can check. Then decide who else gets one.
It is also worth checking what you already own before buying anything. Business Premium and the enterprise plans include security and management features many small businesses never turn on, and getting those right is part of making Copilot safe to roll out. I covered some of that in the post on Microsoft retiring text message sign-in codes.
Questions to Ask Before You Expand
- Who is actually using the licenses you have? Microsoft’s admin center shows usage. If half the seats are idle, fix that before adding more.
- Is anything shared more widely than it should be? Copilot will find it. Better you find it first.
- Which systems outside Microsoft would people want it to reach? That tells you whether agents are worth building, and which one first.
- Has anyone been trained for their actual job? If the answer is an email and a link, that is probably the whole problem.
- Who owns it? One person who decides what gets turned on, keeps the shared prompts current, and checks whether it is paying off.
How I Fit In
I am a consultant and a partner with OTG Consulting, which is a consultancy that presents the services of other providers. I don’t sell Microsoft licenses and I don’t build Copilot agents myself, so I have no reason to push you toward more seats than you need.
What I do is help you work out whether Copilot is earning its cost, where it is falling short, and what would change that. When the answer is setup, cleanup, or training, I connect you with a provider whose people do that work every day, and they deliver and support it. Sometimes the answer is reassigning the licenses you already have to the people who will use them. That costs nothing.
Get Both Sides on the Same Page
If your security people are happy with Copilot and your staff aren’t using it, you don’t have a technology problem. You have a setup and training problem, and that is usually the cheaper kind to fix.
Schedule a free consultation and we will look at who is using Copilot today, what is holding the rest back, and what is worth fixing first.