Which Microsoft Copilot Should Your Business Use?

A business owner says: “We've got Copilot.”

Which one?

It might be a personal Microsoft account using Copilot on the web. It might be a work account using Copilot Chat. It might be the paid Microsoft 365 Copilot add-on, with deeper context across Microsoft 365 apps and business data. It might be Copilot in Word, Excel, PowerPoint, Outlook or Teams. Those experiences can look related, but they are not interchangeable.

For small businesses, the first Copilot question is not “What can it do?” It is:

Which Copilot are we actually using?

One Copilot logo does not mean one Copilot experience. The account, entitlement, features, business controls and available data can all differ.

This guide is for small-business owners, office managers, IT contacts and Microsoft 365 administrators who want a sensible starting point — not another major technology project.

Which account are you using?

The same person may have both a personal Microsoft account and a work or school account. Microsoft’s unified Copilot experience can support both, but the identities remain separate. Signing in with one does not turn it into the other.

Personal Microsoft account

A personal Copilot experience is associated with a personal Microsoft account. It is not inherently unsafe or unsuitable for every question. It may be perfectly reasonable for personal tasks, learning or non-confidential information.

It should not automatically be treated as the company’s approved Copilot. A personal account may not have the same organisational administration, business identity controls, approved data access or contractual context as a work-managed service. Most importantly, the business may have no clear way to establish what information has been entered, what settings apply or who owns the account.

Personal AI and business-managed AI are different governance contexts. That is a useful distinction without turning every personal Copilot question into a security incident.

Work or school Microsoft Entra account

A work Copilot experience uses the organisation’s Microsoft identity — the account staff use for Microsoft 365. Depending on the subscription, Copilot entitlement and administrator configuration, it may provide a business-managed environment with organisational identity controls, approved Microsoft 365 context and settings managed by the tenant.

That does not mean every work user has the full Microsoft 365 Copilot experience. A work account is the identity. The subscription and assigned licence determine which Copilot capabilities the user can use, and permissions determine which organisational information they can access.

For business work, check the account before you check the prompt.

Copilot Chat is not automatically full Microsoft 365 Copilot

This is where many small-business conversations become confused. Microsoft uses several related product names and the visible Copilot app is becoming a simpler place to find them. The app experience may be unified while the underlying entitlements are still different.

Copilot Chat

Copilot Chat can provide an AI chat experience for eligible users signed in with a work or school account. Microsoft says the features available depend on the user’s Microsoft 365 subscription and whether an administrator has assigned a Microsoft 365 Copilot add-on licence. In practical terms, some eligible business users can use Copilot Chat without having the paid add-on.

That does not make Copilot Chat a trial version that every user automatically has, nor does it mean it has exactly the same access and in-app functionality as Microsoft 365 Copilot. Availability, usage limits, connected capabilities and admin controls can change, so check the current Microsoft licence and tenant position rather than relying on the word “Copilot” in an app menu.

Microsoft 365 Copilot

Microsoft 365 Copilot is the paid Copilot add-on that can add deeper functionality across Microsoft 365 apps and work data, subject to the base subscription, assigned entitlement, product availability, configuration and the user’s existing access. It is the experience people often mean when they say “Copilot in Word” or “Copilot in Outlook,” but the exact features still depend on the app and licence.

The safe business explanation is:

Having Copilot Chat does not necessarily mean you have the full Microsoft 365 Copilot experience.

For current product differences and licence-specific availability, use Microsoft’s Copilot Chat licensing guidance, Microsoft 365 Copilot licence options and Microsoft’s comparison of free Copilot and Copilot in Microsoft 365. Product names and availability move quickly; a review should record what is true for your tenant today.

What about Copilot in Word, Excel, Outlook and Teams?

Staff may see Copilot directly inside Word, Excel, PowerPoint, Outlook or Teams. These in-app experiences do not disappear simply because Microsoft is bringing Copilot app experiences together. They can have different capabilities and requirements from a general chat window.

Feature availability depends on the user’s account, Microsoft 365 subscription, assigned Copilot entitlement, administrator configuration, app version and current product availability. The fact that one employee sees a Copilot button does not prove that every employee has the same licence or can use the same business data.

This is why “we have Copilot” is not a useful licensing inventory. It is a starting observation that needs checking.

Licensing: who has what?

A small business does not need a complicated spreadsheet to start. It does need a clear answer for each person who is expected to use Copilot for work.

A quick Microsoft 365 licence review can identify users with a Copilot entitlement, users without it, duplicated or unnecessary licences, and inconsistencies across staff. It can also separate a licensing problem from an account or app problem. “We have Copilot” is not a licensing inventory.

Does Copilot see all our business data?

No. An appropriate work Copilot experience can use organisational information that the user already has permission to access. Depending on the experience and configuration, examples may include content in SharePoint, OneDrive, Outlook, Teams and other Microsoft 365 services.

Copilot does not automatically override Microsoft 365 permissions. It is not a secret administrator account, and giving somebody a Copilot entitlement should not by itself grant access to every document in the tenant.

There is an important practical catch: if permissions are too broad, Copilot may make that information easier to find. A document that was accidentally shared with “everyone” was already exposed to too many people. A useful AI search experience can simply make the consequence more visible and more convenient.

Copilot doesn’t create bad permissions. It can expose the consequences of them.

Microsoft’s Copilot and SharePoint guidance is useful here: Copilot and agents retrieve information through Microsoft Graph and respect existing permissions, sharing settings and policies. That is a reason to review the foundations, not a reason to panic about the tool.

Permissions to review before expanding Copilot use

Before a business gives more people access to Copilot, it is sensible to review the places where business information is already shared:

• SharePoint sites and libraries — who can access them, whether old links remain active and whether broad groups are still appropriate.
• Teams membership — private and shared channels, external guests and people who changed role.
• OneDrive sharing — files shared with individuals, groups or links that no longer have a clear purpose.
• Shared mailboxes — delegated access, forwarding and sensitive conversations that need role-based control.
• Legacy permissions — old groups, inherited access and exceptions that have accumulated over time.
• Admin rights — who can change licences, policies, applications and access, and whether those rights are still justified.

This is ordinary Microsoft 365 administration and security hygiene. It is not a special Copilot problem, but Copilot makes it more important to know what the existing configuration means.

The simple staff rule

Staff do not need a product lecture every time they open an AI tool. Give them a short rule they can remember:

1. Use your work account for business information.
2. Use the approved Copilot experience provided or documented by the business.
3. Check before sharing sensitive information, even when the tool is approved.
4. Do not connect an unknown third-party AI tool to business data.
5. Ask if unsure — a pause is cheaper than an avoidable disclosure.

This is proportionate guidance. It does not claim that staff can never use a personal AI service, and it does not claim that approved Copilot makes every prompt automatically safe. It gives the team a clear default for business work.

The 10-second Copilot Check

It takes about ten seconds and catches a surprising number of avoidable mistakes: the wrong browser profile, a personal sign-in, an unfamiliar agent, or sensitive information being pasted before anybody has considered whether it should be there.

“We already have Microsoft 365 Business Premium”

Business Premium can provide valuable identity, device, security and access-control capabilities. It may be a sensible base subscription for a business considering Microsoft 365 Copilot, subject to Microsoft’s current requirements and licensing terms.

But owning Business Premium does not automatically mean:

• the full Microsoft 365 Copilot add-on is licensed;
• Copilot permissions are correct;
• staff know which AI experience to use;
• personal or shadow AI use is controlled;
• SharePoint and Teams permissions are clean; or
• the tenant’s admin settings match the business’s intended use.

Owning Microsoft 365 is not the same as configuring Copilot governance. Start by checking what is licensed and configured, rather than assuming the product name answers the operational question.

What about personal AI and Shadow AI?

Approving Microsoft Copilot does not mean all AI use is governed. Staff may also use personal ChatGPT, Claude, Gemini, browser AI, meeting AI or tools built into another service.

This article keeps that point deliberately light. The immediate practical response is to make the approved work route clear, explain what information must not be entered into unknown tools, and give people somewhere to ask questions. If the business needs an organisation-wide AI estate review, data-flow mapping, agent governance or wider adoption and governance work, that is a separate conversation with Altitude AI.

Approving Copilot does not mean all AI use is governed. It means one business-managed route has been considered. The rest of the AI estate still needs proportionate attention if it becomes material to the business.

When this is an Altitude IT question

Not every AI question needs an AI transformation project. Sometimes it is simply good Microsoft 365 administration:

• Which Copilot licence does this user need?
• Can this employee use Copilot for their role?
• Is this personal Copilot or work Copilot?
• Why can’t Copilot access a document?
• Should Copilot see this SharePoint site?
• Which account should staff use?
• How do we roll Copilot out safely?

If the question is “Which Copilot have we got and is it configured sensibly?”, that is an Altitude IT conversation. A Microsoft 365 review can cover licences, identities, SharePoint and Teams permissions, approved AI guidance, admin settings and the security controls around them. See Microsoft 365 Support Manchester for the wider support and value-review route, or the Microsoft 365 Security Baseline Review when identity, sharing and security configuration need a more structured assessment.

For a broader technology decision, the Altitude Technology Roadmap can include Microsoft 365 and AI readiness within the wider business, cost, risk and operational picture. That keeps everyday Copilot configuration separate from deeper AI strategy without creating an unnecessary hand-off.

The Altitude IT Copilot Check

Use this as a short readiness conversation. The output should be one of three useful states — not a made-up score:

• GOOD FOUNDATION — the account, licence, access and guidance are understood well enough for the intended use.
• NEEDS REVIEW — the business can see some gaps or inconsistencies and should resolve them before expanding use.
• SIGNIFICANT GAPS — access, identity, licensing or approved-use questions need attention before Copilot is rolled out further.

Copilot needs an Operational Heartbeat

Copilot is not a “switch it on once” decision. Users change roles, licences change, permissions accumulate, Microsoft changes the apps and new capabilities appear. The review does not need to become a monthly committee, but it should become part of normal Microsoft 365 administration.

Copilot needs an Operational Heartbeat: Microsoft is changing the apps, licensing and capabilities quickly, so account, permission and licence reviews should become part of normal Microsoft 365 administration.

Periodically review Copilot licences, users, permissions, admin configuration, new Microsoft Copilot features, departed users and staff guidance. This protects the value of the tool without pretending that any review can freeze a fast-moving product.

The Altitude IT view

Microsoft is making Copilot easier to access. That does not mean every user automatically has the right account, the right licence, the right access or the right guidance.

One Copilot app. Different accounts. Different licences. Different business controls.

For many small businesses, Copilot does not need to begin with a major AI strategy project. Start by understanding which Copilot staff are using, confirm their work identity and licensing, review the Microsoft 365 permissions that determine what they can access, and give users simple guidance about approved business use.

For background on Microsoft combining Copilot app experiences, read The IT Club Briefing’s explanation of what is changing and why personal and work identities still matter. The product experience may become simpler, but the account, licence, data and permissions questions remain useful.

Frequently Asked Questions

Which Microsoft Copilot should my business use?

For company work, staff should normally use the Microsoft Copilot experience approved and managed through their organisation’s work account rather than assuming a personal Copilot account provides the same controls. The capabilities available depend on the Microsoft 365 subscription, Copilot licensing, administrator configuration and the user’s existing permissions.

What is the difference between personal and work Copilot?

Personal Copilot is associated with a personal Microsoft account. Work Copilot is used with an organisational Microsoft Entra identity. They are separate identities and can have different data access, administration, features and business controls. Personal Copilot is not inherently unsafe, but it should not automatically be treated as the company’s approved route for confidential business work.

What is Copilot Chat?

Copilot Chat is an AI chat experience available to eligible users signed in with a qualifying Microsoft 365 business or enterprise account. The available features depend on the subscription, administrator settings and whether the user has a Microsoft 365 Copilot add-on licence. Copilot Chat does not necessarily provide the full Microsoft 365 Copilot experience.

What is Microsoft 365 Copilot?

Microsoft 365 Copilot is the paid Copilot add-on that can add deeper functionality across Microsoft 365 apps and work data, subject to licensing, app availability, configuration and existing user permissions. A visible Copilot button in one app is not proof that the user has every Microsoft 365 Copilot capability.

Does Microsoft 365 Business Premium include Copilot?

Business Premium can be a qualifying base subscription for Microsoft 365 Copilot, but Business Premium does not automatically include the full Microsoft 365 Copilot add-on. Check Microsoft’s current licensing terms and the entitlements assigned to each user. Business Premium also does not automatically make permissions, staff guidance or shadow AI controls correct.

Do I need an additional Copilot licence?

It depends on the Copilot experience and what the user needs to do. Some eligible work users may have access to Copilot Chat without the paid add-on, while deeper Microsoft 365 Copilot functionality requires the relevant entitlement. Review the base Microsoft 365 plan, assigned add-on, intended users and current Microsoft requirements before purchasing.

Can Copilot see SharePoint files?

An appropriate work Copilot experience can use SharePoint information that the user already has permission to access, subject to the product, licensing and configuration. It does not automatically see every file in the tenant. Review SharePoint sharing, group membership, inheritance and old links before expanding Copilot use.

Does Copilot respect Microsoft 365 permissions?

Yes, Copilot uses existing access controls rather than automatically granting the user access to everything. However, if a site, library or file was shared too broadly, Copilot may make that over-sharing easier to discover. Copilot does not create bad permissions, but it can expose their consequences.

Should staff use personal Copilot for work?

For business information, the default should be the organisation’s approved Copilot experience through a work account. Personal Copilot is not inherently unsafe for personal or non-confidential use, but it may not provide the same organisational administration, data controls or ownership context. Staff should ask if they are unsure.

How can I check which Copilot licences we have?

Review the Microsoft 365 admin centre licence assignments and compare them with the users who are expected to use Copilot. Record the base Microsoft 365 plan, any Copilot entitlement, the intended business use and whether the user has approved guidance. A Microsoft 365 value review can identify unused, duplicated or inconsistent licensing.

Can Altitude IT configure Microsoft Copilot?

Altitude IT can help with practical Microsoft 365 questions such as account and licence checks, user access, SharePoint and Teams permissions, admin settings, Copilot setup and basic staff guidance. Wider organisation-wide AI strategy, AI-estate discovery, agent governance and data-flow work may be better suited to Altitude AI.

Should we review SharePoint permissions before using Copilot?

Yes, especially before expanding access to more users or more business data. Review SharePoint sites, OneDrive sharing, Teams membership, external guests, legacy groups and sensitive locations. The objective is not to make every permission restrictive; it is to make sure the access reflects how the business actually works.

Is Copilot an IT issue or an AI issue?

It can be both, but the first questions are often ordinary Microsoft 365 administration: which account, which licence, which data, which permissions and which approved use. Deeper AI strategy, governance, agent controls and organisation-wide transformation are separate questions that can be escalated when the business genuinely needs them.