For many UK SMEs, artificial intelligence still feels like a future project—something that requires budget approval, planning, or a new licence. But Microsoft 365 customers may already have AI capabilities available within familiar applications, without purchasing a separate Copilot subscription. This means AI may already be interacting with company information before leadership has formally approved an AI rollout.
Copilot Chat in Outlook can use a user’s emails and calendar to answer questions and help organise their work. Availability depends on licensing, application version, and administrative settings, but businesses should no longer assume that declining to purchase Copilot prevents its use.
What Is Included, and What Requires a Paid Licence?
Microsoft’s naming is changing. Microsoft 365 Copilot is now described in its documentation as Microsoft Copilot, and Microsoft 365 Copilot Chat as Microsoft Copilot Chat. Customers may still encounter the previous names in applications and licensing screens during the transition. Microsoft’s naming notice
A common misconception is that included Copilot Chat cannot access company data, while paid Copilot can. The actual boundary depends on the application, licence, configuration, and how information is supplied.
In Outlook, Copilot Chat can access emails, calendars, meetings, chats, and a limited set of OneDrive and SharePoint files. These include files shared directly with the user, files they have previously worked with, and files from frequently visited SharePoint sites. The included Outlook experience uses lexical indexing; broader work‑data grounding through semantic indexing requires a paid Copilot licence. Microsoft’s organisational-data boundaries
The paid options include Microsoft Copilot Business, aimed at organisations with up to 300 users, and Microsoft Copilot, which supports a wider range of qualifying subscriptions. Copilot Business supports Microsoft 365 Business Basic, Standard, Premium, and Apps for business. Microsoft Copilot supports plans including Office 365 E3, Microsoft 365 E3, Business subscriptions, and various standalone services.
Office 365 E3 and Microsoft 365 E3 remain different base products. Neither includes the paid Copilot add-on by default. Microsoft’s licensing requirements
Company Information Can Enter Through Other Routes
Outside Outlook, ordinary unpaid chat does not provide the same broad work grounding as paid Copilot. However, users can still supply company information through pasted text, uploaded or selected files, and agents with organisational access.
Open content is another route. Supported Word, Excel, and PowerPoint agents can work with the file currently open. Copilot Chat in Edge can also use an open intranet page when the relevant page-access setting is enabled.
“No paid licence” therefore does not mean “no company data”. Microsoft’s content-access explanation
How Grounding and Indexing Work
“Grounding” means retrieving relevant information to help Copilot answer a question. Microsoft 365 maintains search indexes in the background. When a user submits a prompt, Copilot can retrieve relevant content and supply it as context for generating a response.
Background indexing is different from a language model continuously reading and summarising every document. Semantic indexing improves retrieval by recognising meaning and relationships beyond exact keyword matches. Semantic indexing improves retrieval, but it does not expand what users are allowed to access.
Microsoft states that semantic indexing is automatically enabled and cannot be switched off as a whole. Administrators can control access and exclude certain content from discovery, but there is no simple tenant-wide “disable semantic indexing” switch.
Indexing does not grant new permissions. Retrieval is designed to respect the user’s existing access rights. Microsoft’s semantic indexing documentation
Why Oversharing Deserves Attention
Poorly configured permissions can remain unnoticed because finding the information takes effort. A sensitive folder accessible to an unnecessarily broad group might sit untouched for years.
AI-assisted retrieval reduces that effort, making accessible information easier to discover and combine. Microsoft recommends reviewing permissions and reducing oversharing when preparing for Copilot. Microsoft’s oversharing guidance
For firms handling client funds, matter files, finance, or HR information, the question is straightforward: should everyone who can technically open this information actually have access to it?
The discovery scope differs between included and paid experiences. Businesses should assess the features their staff can use today and review permissions before expanding access to broader capabilities.
What About On-Premises Systems and Shared Mailboxes?
Copilot’s native primary-mailbox integration requires Exchange Online. Assigning a paid licence does not make an on-premises Exchange primary mailbox available for native mailbox grounding.
Shared, delegated, and archive mailboxes should not be assumed to be outside Copilot’s reach. Microsoft’s current application requirements describe support for these mailboxes, although its semantic-index documentation separately lists limitations for user-level indexing. Businesses should verify the particular feature and mailbox scenario rather than treating an indexing limitation as a general access restriction. Microsoft’s mailbox requirements Indexing support table
A Copilot licence also does not automatically connect traditional file servers or external business systems. Supported connectors can bring external information into its searchable scope. Microsoft’s connector explanation
Remote Desktop Services must be considered separately from data location. An application running on an RDS server might use local files, Microsoft 365 services, or another cloud platform. Information may also reach Copilot through the user-driven routes described above.
Practical Governance Controls
Begin with permissions: review sensitive sites and folders, broad access groups, sharing links, and who genuinely needs access.
For SharePoint, the standard “Allow this site to appear in search results” setting provides a discovery control without requiring SharePoint Advanced Management. Setting it to No excludes the site from Microsoft Search and tenant-level semantic-index search together. It also reduces ordinary search usefulness and does not revoke anyone’s permissions. Microsoft’s site-exclusion guidance
Restricted Content Discovery offers a separate temporary control for selected SharePoint sites, subject to the relevant Copilot and SharePoint Advanced Management entitlement. It reduces organisation-wide discovery while permissions are reviewed, but does not prevent direct access or every interaction with already open content. Changes can take time to propagate. Restricted Content Discovery guidance
Data Access Governance reports can help identify overshared sites, with available reporting and remediation capabilities depending on licensing. Copilot-specific Purview DLP policies can restrict supported content from being processed in responses; this is different from removing it from an index. Governance reports Copilot DLP controls
Finally, review Copilot availability settings and provide clear staff guidance. Removing a pinned icon does not itself prevent access to the service. Microsoft’s pinning guidance
Data Protection and Our Recommendation
Microsoft states that commercial Copilot Chat provides enterprise data protection and does not use prompts or responses to train foundation models. Those protections do not correct excessive permissions or replace a business’s own information-handling rules. Microsoft’s privacy commitments
Start by establishing which Copilot features staff can already use. Identify inappropriate access, correct the underlying permissions, and apply temporary discovery restrictions where useful. Introduce broader paid capabilities through a controlled pilot, with guidance on confidential information and checks on generated answers.
Copilot can offer meaningful productivity gains, but readiness involves more than choosing a subscription. For many Microsoft 365 customers, AI is already available inside familiar applications. The practical next step is to understand that access and manage it deliberately.
With the right governance, Copilot can be introduced safely and gradually, without disrupting existing workflows.