The pitch for Microsoft 365 Copilot is easy to like. The part that gets skipped is that it is a search engine over your own files, and it inherits every permission your tenancy already has. Oversharing that nobody noticed for five years becomes a question somebody types into a chat box on day one.
Before a purchase order, five questions are worth more than a demo.
1. Who can already open what?
Run a permissions review across SharePoint, OneDrive and Teams before anything is licensed. The usual findings are sites shared with the whole organisation, files shared by link with anyone who has it, and mailboxes carrying delegate rights granted for a project that ended years ago. Copilot does not create that exposure. It makes it easy to find.
2. Which roles actually change?
Copilot earns its licence where somebody writes, summarises or searches for a living. Finance chasing variances, a sales team rewriting the same proposal, an operations lead reading long threads. It earns very little on a shop floor. Buying for everyone is the most common way to end up with unused licences and a bad internal reputation.
3. What does good look like, in a number?
Decide the measure before the pilot, not after. Hours saved on a named task, or proposal turnaround, or tickets deflected. Without one, the review meeting becomes a discussion of whether people liked it.
4. What must never go into a prompt?
Staff need a short, readable answer, not a policy document. Client identifiers, anything under NDA, credentials, unreleased financials. One page they will actually read beats fifteen they will not.
5. Who owns it in six months?
Licences drift, people change roles, and the person who championed it moves on. Someone needs to own adoption reporting and the quarterly question of whether the spend is still justified.
None of this is an argument against Copilot. It is an argument for doing the boring work first, because the alternative is discovering your permissions model in public.