Module 1 of StartCloud's Copilot Essentials learning pathway, in six short units with a knowledge check: the Copilot family untangled, what the paid licence buys (grounding in your business data via Microsoft Graph), how data protection works, what Copilot is not, and whether your business needs the licence.
What Microsoft Copilot actually is (and what it is not)
One name, several products
Microsoft has a naming habit. Somewhere along the way, nearly every AI feature it ships got called Copilot, and small business owners have been squinting at licence quotes ever since. The good news is that once you separate three things, the whole picture snaps into focus.
There is the paid add-on that works inside your Office apps using your business data, the included chat that comes free with your Microsoft 365 business plan, and the consumer versions baked into Windows and Edge. Same name, very different animals.
Microsoft 365 Copilot
The one people usually mean when they say "we're getting Copilot". A paid add-on licence, per user, that puts AI inside Word, Excel, Outlook, Teams, PowerPoint and friends, grounded in your business data. Draft a document in Word, summarise a meeting in Teams, catch up on an email thread in Outlook.
- Lives inside the Microsoft 365 apps you already use
- Grounded in your emails, files, meetings and chats
- Only surfaces what you already have permission to open
- Needs an eligible Microsoft 365 base plan first
Microsoft 365 Copilot Chat
A secure AI chat that comes with eligible Microsoft 365 business plans at no extra cost. It answers from the web rather than your files, but it runs with enterprise data protection, so your prompts stay private and are not used to train the models. You can paste in or upload a document when you want it to work on something specific.
- Included with Microsoft 365 business plans, no add-on needed
- Answers grounded in the web, not your tenant data
- Enterprise data protection on every prompt and response
- A good free starting point before buying anything
Copilot in Windows, Edge, and the consumer app
The Copilot button on a Windows keyboard, the sidebar in Edge, and the free Microsoft Copilot app people use with a personal account. Handy for personal life, but these are consumer products. Signed in with a personal account, they carry none of your business protections, which is exactly the same problem as staff pasting work data into any public chatbot.
- Personal-account Copilot is a consumer product
- No connection to your business data or its protections
- Fine at home, not the place for client information
- Work AI belongs behind a work sign-in
Under the bonnet they are close cousins, built on the same kind of large language models. The difference is where they live and what they can see. A consumer chatbot knows nothing about your business unless someone pastes it in, at which point it has left the building. Microsoft 365 Copilot works inside your tenant, with your permissions, under your existing Microsoft 365 privacy commitments.
What the paid licence actually buys
So what does the paid licence buy that the free chat does not? One word: grounding. Before your prompt reaches the language model, Copilot gathers relevant context from your work life through something called Microsoft Graph, the layer that already connects your email, calendar, files, meetings and chats.
That is why the paid version can answer "what did I miss while I was on leave?" and the free one cannot. It is not smarter. It just knows where you left your homework.
"Draft a follow-up email to Sarah covering what we agreed in yesterday's project meeting."
Yesterday's meeting transcript, the email thread with Sarah, the project file on SharePoint. Only content you already have permission to open.
Prompt plus context go to the language model together, inside the Microsoft 365 service boundary, then the response is checked before it comes back to you.
A draft that names the real Sarah, the real project, and the real action items, ready for you to review in Outlook. Not a generic template with blanks to fill in.
The same grounding follows you across the apps. In Teams it can summarise a meeting you missed, in Word it can draft from a document on your SharePoint, in Excel it can suggest formulas for the data in front of you. The licence is not buying a better chatbot. It is buying a chatbot that has read your homework, with permission.
Where your data goes (and does not go)
This is the question every business owner asks first, and fair enough: if Copilot can read my email, where does it all go? It stays where your Microsoft 365 data already lives, inside your tenant, under the same contractual commitments you already have with Microsoft.
Two rules do most of the heavy lifting. First, Copilot respects your existing permissions. It can only surface content a user could already open themselves. Second, your prompts and responses are not used to train the foundation models. What your team types in does not make anyone else's AI smarter.
- Prompts and responses are processed inside the Microsoft 365 service boundary
- Copilot only surfaces content each user already has at least view access to
- Interactions are logged and can be audited or searched by your admins
- The same GDPR-grade privacy commitments as the rest of Microsoft 365 apply
- Your prompts and responses are not used to train the foundation models
- Your business data is not shared with the model providers
- One staff member cannot use Copilot to peek at files they could not open anyway
- Nothing is shipped off to improve someone else's chatbot
"Respects existing permissions" is a promise about Copilot, not about your permissions. If your file sharing has been a bit loose over the years (and whose has not), Copilot will cheerfully surface things people technically could always open but never knew existed. That is why tidying up sharing comes before a rollout, and it is exactly what Module 4 of this pathway covers.
What Copilot is not
Now for the part the sales material skips. Copilot is useful, and we deploy it happily, but it is a power tool, not a magic wand. Knowing its limits on day one saves a lot of awkward conversations on day thirty.
Language models generate plausible text, and plausible is not the same as true. Copilot can misread a spreadsheet, invent a detail, or state a wrong date with total confidence. Its citations help, but the person who clicks send owns the result.
Vague prompt in, vague answer out. "Write a proposal" gets you fluff. Telling it the client, the goal, the source document, and the tone gets you something useful. Module 2 of this pathway is entirely about this.
Copilot is brilliant at drafts, summaries and first passes. It has no idea which client relationship is delicate, what was promised on a call last month, or what your gut says about a deal. Judgement stays your job.
Grounding cuts both ways. If your files are six versions deep and your permissions are chaos, Copilot inherits the chaos. It amplifies whatever state your data is in, tidy or otherwise.
Treat every Copilot output like a draft from a keen new hire: fast, tireless, occasionally wrong in ways a new hire would never dare. Read it, check the numbers and names against the source, then send it. Teams that build this habit early get the productivity gain without the cleanup jobs. Teams that do not, well, we have met some of them.
Do you need the licence?
Microsoft 365 Copilot is sold as a paid add-on, priced per user per month, on top of an eligible Microsoft 365 base plan. For small businesses that means plans like Business Basic, Business Standard or Business Premium; the enterprise E3 and E5 plans qualify too. Each user also needs a Microsoft Entra ID account, and their mailbox needs to live in Exchange Online for the email features to ground properly.
The useful reframe: it is not all or nothing. Licences are per user, so you can buy three for the people who live in Outlook and Teams all day and skip the workshop PC that mostly prints invoices.
Strong candidates. People drowning in email and meetings: owners, managers, anyone client-facing. Meeting recaps and drafted replies alone usually justify the spend here.
Worth a trial. Heavy document producers: proposals, reports, tenders. Run a month or two on real work and let the results decide.
Start with the free Copilot Chat. Everyone else. It is already included with your Microsoft 365 business plan, carries enterprise data protection, and tells you who would actually use the paid version.
The businesses that get real value from Copilot are the ones that pick their users deliberately, tidy their data first, and teach the verify-before-sending habit. The ones that buy a licence for everyone and hope for magic mostly get an expensive meeting summariser. The rest of this pathway is about ending up in the first group.
- Microsoft Learn: Microsoft 365 Copilot overview
- Microsoft Learn: Data, Privacy, and Security for Microsoft 365 Copilot
- Microsoft Learn: Enterprise data protection in Microsoft 365 Copilot and Copilot Chat
- Microsoft Learn: Overview of Microsoft 365 Copilot Chat
- Microsoft Learn: License options for Microsoft 365 Copilot
Details were current at the time of writing (July 2026). Microsoft adjusts Copilot naming, licensing and eligibility fairly often, so check the links above for the latest.
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. Which Copilot is the paid add-on that works inside Word, Excel, Outlook and Teams using your business data?
2. What does the paid licence add that the included Copilot Chat does not have?
3. Can a staff member use Copilot to read a file they do not have permission to open?
4. Are your team's prompts and responses used to train the underlying AI models?
5. Copilot drafts a client proposal that includes a very confident delivery date you never mentioned. What now?