Everything Microsoft makes is called Copilot now
When a reseller offers to get you "set up on Copilot," that sentence carries almost no information. It could mean a free chat box already in your Edge browser, a $30-per-seat add-on that reads your inbox and your SharePoint, a coding tool only developers would open, a low-code agent builder billed by consumption, or a security product billed by the hour. Separate products, separate licences, separate bills.
The confusion is not your fault. Microsoft's own pages disagree. The shopping pages call the paid add-on Microsoft 365 Copilot; the Microsoft Learn licensing documentation calls the same thing Microsoft Copilot; the admin docs split the experience into three labelled tiers — Copilot Chat (Basic), Microsoft 365 Copilot (Basic) and Microsoft 365 Copilot (Premium). One independent count in March 2026 found more than 80 Microsoft products and features carrying the Copilot name.
Everything below was checked against Microsoft's own documentation and pricing pages in September 2026. Microsoft renames and re-prices these things often — treat every figure as a snapshot.
The Copilot products, sorted by what they actually are
Two questions separate them: who is it for, and can it see your files?
Microsoft Copilot Chat — the free one already in your subscription
Copilot Chat is included at no extra cost with eligible Microsoft 365 subscriptions; the admin docs label it Copilot Chat (Basic). You reach it at m365copilot.com, via the Copilot icon in Edge, and inside Outlook and Teams. Sign in with a Microsoft Entra work account and prompts and responses fall under Enterprise Data Protection, the same contractual commitments Microsoft applies to your Exchange mail and SharePoint files.
The critical limit: it is grounded in web data, not your tenant, and cannot reach your files through Microsoft Graph. You hand content over explicitly, by pasting, uploading, or working with a document already open in Teams or Outlook. Agents grounded in your own instructions and public websites are included; anything touching work data is pay-as-you-go. Before buying anything, run your team on this for a month and see who actually opens it.
Microsoft 365 Copilot — the paid add-on that sees your data
This is what people mean when they say "we bought Copilot." Microsoft's docs call the licensed tier Microsoft 365 Copilot (Premium). It sits on top of a qualifying Microsoft 365 or Office 365 subscription and replaces nothing you already pay for.
What the licence buys is grounding: Copilot pulls from your emails, files, meetings, calendars and org relationships automatically through Microsoft Graph, a semantic index and Microsoft's newer Work IQ layer, with nothing uploaded. It also buys priority access — unlicensed users get "standard access" subject to service capacity that varies through the day. Users on an eligible plan without the add-on still get limited in-app features in Word, Excel, PowerPoint and OneNote, a middle state labelled Microsoft 365 Copilot (Basic) that cannot read your tenant.
Microsoft Copilot Business — the same thing, priced under 300 seats
In December 2025 Microsoft added an SMB-priced version. Learn calls it Microsoft Copilot Business; the shopping pages call it Microsoft 365 Copilot Business. Microsoft's FAQ states the add-on "delivers the same capabilities as the Microsoft Copilot offering" — the difference is price and eligibility, not features.
As of September 2026 it requires a Microsoft 365 Business Basic, Standard or Premium plan, caps at 300 seats per tenant, and is sold on an annual commitment — no month-to-month. Two traps: if you already bought the enterprise add-on you cannot switch those licences mid-term, and on Business Standard or Premium with Copilot Business you cannot move to an Enterprise plan until your commitment ends.
Copilot Studio — the agent builder, billed by consumption
Copilot Studio is a low-code studio for building agents, workflows and agent flows and publishing them into Teams, Copilot, websites or mobile apps. It is not billed per seat. Its currency is Copilot Credits, bought through pay-as-you-go Azure meters, prepaid packs or a one-year prepurchase pool — Microsoft switched the unit from "messages" to Copilot Credits in September 2025.
Credits are consumed according to how hard an agent works: retrieval, reasoning, tool calls. Purchased capacity is enforced monthly and unused credits do not roll over. You also pick a *harness* — the engine the agent runs on — which changes both capability and billing.
GitHub Copilot and Security Copilot — different buyers entirely
GitHub Copilot is an AI coding assistant licensed and billed through GitHub, not your Microsoft 365 tenant. As of September 2026 the organisation plans list at $19 per seat/month for Copilot Business and $39 for Copilot Enterprise, alongside individual Free, Pro ($10), Pro+ ($39) and Max ($100) tiers. Neither licence includes the other. We compared the developer tools in Claude Code vs Codex vs Cursor.
Security Copilot targets incident response and threat hunting, and its unit is the Security Compute Unit. Microsoft's pricing page lists $4 per provisioned SCU and $6 per overage SCU, minimum one provisioned SCU, billed hourly, with eligible E5 and E7 customers getting an included allocation. Provisioned capacity runs whether you use it or not, so a single SCU held open continuously is a four-figure monthly line item. This is built for organisations with a security operations function.
The consumer Copilots, and the role-based ones
The assistant at copilot.microsoft.com signed into a personal Microsoft account is a consumer product with no tenant grounding and no Enterprise Data Protection. Copilot Pro, the old standalone consumer subscription, is no longer sold; Microsoft says existing subscribers can continue until 1 August 2026 and points them at Microsoft 365 Premium. The real risk is staff signing in with a personal account out of habit and pasting work content into it, so instruct people to use their Entra work account.
Microsoft also sells role-based Copilot experiences for sales and customer service that surface CRM context inside Outlook and Teams. They have been renamed more than once and are licensed separately from both the Microsoft 365 add-on and Dynamics, so get the exact SKU in writing.
What the add-on actually does in each app, honestly
Outlook is where the add-on earns its keep. Summarising a 40-message thread you were CC'd into halfway through is a genuine time saver, and draft-and-tone coaching is competent. This is the feature that changes someone's Monday morning.
Teams is second-strongest: transcription, meeting summaries and captured action items, with the ability to summarise meeting content going back up to 30 days. If your company runs on Teams calls, that alone justifies licensing the people in the most meetings.
Word is good at rewriting, summarising and restructuring content that already exists, and mediocre at producing a document worth sending from a one-line prompt. Treat it as an editor, not an author. PowerPoint generates decks from prompts or existing documents and applies deck-wide formatting; the output is a starting structure, not a client-ready deck.
Excel is where expectations most often break. Copilot in Excel runs in chat, edit and plan modes on Windows, Mac and web (chat only on iPhone and Android), and it is genuinely handy for explaining or generating a formula and summarising a clean structured range. It is far weaker against the thing most small businesses actually own: a sprawling multi-tab workbook with merged cells, hand-built formulas and inconsistent headers.
What Copilot costs, and whether it is worth it per seat
As of September 2026, Microsoft lists the enterprise Microsoft 365 Copilot add-on at $30 per user per month paid yearly, on top of a qualifying base licence. The SMB Copilot Business add-on lists at $21 with a discounted $18 shown on the page, up to 300 seats; monthly billing costs more, at $25.20 for the same seat. Microsoft also sells bundles that fold Copilot into the base plan, such as Business Premium with Copilot at $32.00, so price the bundle against add-on-plus-base.
Now the part that matters. Do not license everyone. At $18 to $30 a seat, a 40-person company faces roughly $8,600 to $14,400 a year for full coverage, and in most organisations a large share of those seats will open Copilot twice and never again. License the people whose week is genuinely made of email, meetings and documents, run them for a quarter, then use the Copilot usage reports in the admin centre to decide whether to expand.
One line item people miss: agents. Agents touching work data are pay-as-you-go for unlicensed users, Copilot Studio consumption is billed in Copilot Credits, and Microsoft Copilot Cowork — where Copilot carries out tasks across your environment on your behalf — is reached through usage-based billing rather than included flat. A per-seat licence is a floor, not a ceiling.
How Copilot grounds answers in your company data
The licensed tier's entire value proposition is grounding, so understand the mechanism rather than the marketing. Copilot retrieves organisational context — emails, documents, meetings, calendars, org relationships — through Microsoft Graph, enhanced by a semantic index that improves relevance beyond keyword matching, and increasingly through Work IQ, Microsoft's layer that lets agents reason over organisational content and tools. That context is added to the prompt, and the model answers from it.
Two properties matter enormously. Retrieval is scoped by the asking user's existing permissions, so Copilot returns only content that person could already have opened. And retrieval quality is bounded by what is indexed — if the authoritative version of your pricing lives on someone's laptop, Copilot will answer from the outdated copy in SharePoint instead.
Admins can switch Work IQ off, at which point responses stop being enriched with work context at all. Microsoft's documentation also notes Anthropic operates as a subprocessor for some licensed Microsoft 365 experiences. For what a model-agnostic setup looks like when you control the routing yourself, see our guide to bring-your-own-key AI.
Why a messy SharePoint produces bad Copilot answers
This is the single biggest reason Copilot rollouts disappoint, and it has nothing to do with the model. Copilot respects existing permissions, sharing settings and policies. It does not create access — it reveals access that was already there.
Most tenants running five or ten years have accumulated sediment nobody has looked at: sites shared with "Everyone except external users," "Anyone" links handed to a contractor in 2021 and never expired, broken permission inheritance, and hundreds of ownerless sites. Microsoft notes SharePoint's sharing settings default to the most permissive option.
Nobody noticed, because finding an overshared file used to require knowing it existed and searching for it by name. Copilot removes that friction. An employee types "what are the new salary bands" and gets an answer, because a draft compensation model has been sitting in an organisation-wide site for two years. The permission was always wrong. Copilot just made it reachable in one sentence.
The second failure is staleness. When five versions of the same policy exist across three sites, Copilot has no reliable way to tell which is authoritative. Microsoft's own readiness guidance frames archiving inactive content as a way to "declutter Copilot's data sources and improve the quality of the responses" — the vendor saying the quality ceiling is set by your content hygiene.
The permissions audit to run before you turn Copilot on
Microsoft ships the tooling under SharePoint Advanced Management, included with the Microsoft 365 Copilot licence. A concrete sequence:
Run the Content Management Assessment in the SharePoint admin centre under Advanced Management. It runs a suite of reports flagging potentially overshared content, inactive and ownerless sites, and returns recommended remediations. Rerun every 30 days.
Pull the data access governance reports. Start with the site permissions baseline report for overall exposure, then the site permissions for users report to see everything one person can reach. Then the activity reports: the "Everyone except external users" report shows the top 100 sites shared with your whole organisation in the last 28 days, and the sharing links activity reports rank sites by "Anyone," "People in the organization" and "Specific people" links.
Tighten the defaults and lock down the sensitive sites. Under Policies then Sharing, pull SharePoint and OneDrive down from the permissive defaults and set link expiration. Restricted Access Control then limits a site to members of a named Entra security group; Restricted Content Discovery hides a site from organisation-wide search and Copilot while leaving permissions untouched — the pressure valve for HR, legal and finance content during a rollout.
Clear the dead sites and classify the rest. Site lifecycle management gives you ownership, inactive site and attestation policies that make owners confirm members, permissions and sharing settings are still correct; Microsoft 365 Archive takes dead content out of active storage and out of Copilot. Microsoft Purview applies sensitivity labels and can review Copilot prompts and responses, and the AI Administrator role gives least-privilege control through the Copilot Control System. This is a week or two of admin work, and it is the difference between useful answers and an HR problem.
Copilot Studio, and where a purpose-built automation wins
Copilot Studio is where Copilot stops being an assistant and becomes infrastructure. You describe an agent in plain language, connect knowledge sources and tools through prebuilt or custom connectors, test, and publish to Teams, Copilot, a website or a mobile app. Workflows and agent flows cover the deterministic side with human-in-the-loop review steps, and there is a management layer with analytics, evaluations against test sets, and an agent inventory for admins.
It is the right tool in one case: the process lives inside Microsoft 365 and Power Platform, the maintainers are already Microsoft admins, and the value is answering questions from your own documents. An HR policy agent grounded in your SharePoint handbook, published into Teams, is a good Copilot Studio project.
It stops being right when the process crosses systems Microsoft does not own, or when consumption billing turns against you. Credits scale with how hard the agent works, capacity is enforced monthly, and unused credits expire — an agent running a hundred times a day across four external APIs is a very different bill from one answering ten policy questions. It is also a platform you rent: leave the Microsoft stack and the agent does not come with you. The alternative is a purpose-built automation doing one job reliably against whatever systems that job touches, on infrastructure you control. We laid out the categories in AI agents vs chatbots vs RPA.
Copilot vs a general assistant vs a custom automation
Copilot's advantage is location. It sits inside the app where the work already happens, grounded in your tenant with nothing uploaded, under the same enterprise data commitments as your Exchange and SharePoint. For a company fully committed to Microsoft 365 that is a real advantage no external tool can replicate. The Outlook thread summary that appears without leaving Outlook gets used; the one requiring a copy-paste into a browser tab does not.
A general assistant like Claude or ChatGPT is usually the better raw tool. For long-form reasoning, analysis, drafting from scratch and open-ended research, a frontier assistant will typically outperform Copilot on the same task and cost less per seat. What it lacks is automatic sight of your files — you paste in the context. We compared them head to head in Claude vs ChatGPT for business.
A custom automation is a different category. Copilot and general assistants both wait for a human to ask. A custom build does a specific job on a trigger, every time, unprompted — the quote lands, the intake form gets parsed, the record gets created, the follow-up goes out. It earns its keep where a process is repetitive and spans systems Microsoft does not own. Our guide to AI agents covers what they can and cannot do today.
Who should buy Copilot, and who should not
Buy it if you are already fully on Microsoft 365, your work genuinely happens in Outlook and Teams, your SharePoint is tidy or you have budgeted to make it tidy, and you can name the roles that will use it daily. Meeting-heavy leadership, sales teams living in Outlook, and operations people inside documents all day are the reliable wins.
Do not buy it if you are mostly on Google Workspace, if your critical data sits in a line-of-business system Copilot cannot see, if nobody has looked at your SharePoint permissions in years, or if what you actually want is a process automated rather than a person assisted. Copilot does not automate a process — it assists a human doing one, and that gap is where most disappointment comes from. And do not buy for everyone at once: license a pilot group, watch the usage reports for a quarter, and remember the annual commitment is not something you quietly reverse next month.
If you are unsure which workflows want an assistant and which need an automation built, our free automation audit is a self-serve questionnaire that takes about three minutes and returns an automation health score, the annual cost of the manual work you describe, and a ranked list of quick wins. No call, no cost. AutomateNexus builds start at $7,500, typically ship in about 30 days, and run on your own API keys — model costs of roughly $30 to $150 a month paid directly to the provider.
Frequently asked questions
Is Microsoft Copilot free for business use?
Partly. Copilot Chat is included at no additional cost with eligible Microsoft 365 subscriptions and is covered by Enterprise Data Protection when users sign in with a work account. It is grounded in web data and cannot read your files through Microsoft Graph unless you upload or paste them. The paid add-on is what buys automatic grounding in your company data and the deeper in-app experience.
How much does Microsoft 365 Copilot cost per user?
As of September 2026, Microsoft lists the enterprise add-on at $30 per user per month paid yearly, and the SMB Microsoft 365 Copilot Business add-on at $21 list with $18 shown as the discounted annual rate, capped at 300 seats. Monthly billing costs more, and both require a qualifying base Microsoft 365 licence underneath. Check Microsoft's pricing page before you buy.
What is the difference between Copilot and Microsoft 365 Copilot?
"Copilot" alone is a brand covering more than 80 Microsoft products, including a free consumer assistant. "Microsoft 365 Copilot" is the paid commercial add-on that integrates with Word, Excel, PowerPoint, Outlook and Teams and grounds answers in your tenant through Microsoft Graph. Confusingly, Microsoft's Learn documentation now often calls that same add-on simply "Microsoft Copilot." Ignore the marketing name and confirm the SKU and base licence.
Can Copilot see files I do not have access to?
No. Copilot retrieves through Microsoft Graph scoped to the asking user's existing permissions, so it surfaces only what that person could already open. The real risk is the reverse — it surfaces files people technically had access to but nobody realised were shared that widely. Run the SharePoint data access governance reports before rollout, particularly the "Everyone except external users" report.
Is GitHub Copilot included with Microsoft 365 Copilot?
No. GitHub Copilot is a separate product licensed and billed through GitHub for developers writing code, and neither licence includes the other. As of September 2026 GitHub's organisation plans list at $19 per seat/month for Copilot Business and $39 for Copilot Enterprise. Copilot Studio now offers a "GitHub Copilot harness" as a reasoning engine for agents — a naming overlap, not the same purchase.
Is Copilot better than ChatGPT or Claude for a small business?
Different jobs. Copilot's edge is that it lives inside the apps your team already has open and can see tenant content without anyone uploading it. A general assistant is usually stronger on open-ended reasoning, analysis and drafting from scratch and costs less per seat, but you feed it the context. Many small teams do best with free Copilot Chat plus a general assistant.
Does Copilot train on my company data?
Microsoft's position is that prompts and responses in Copilot Chat and the licensed tiers are protected by Enterprise Data Protection when users sign in with Microsoft Entra accounts, under the same contractual commitments Microsoft applies to Exchange mail and SharePoint files. EU traffic is handled under the EU Data Boundary, though Microsoft notes worldwide traffic can be routed across regions for model processing at times of high demand. If data residency is a hard requirement in your industry, read Microsoft's current documentation directly rather than any summary, including this one.