Rolling Out Microsoft 365 Copilot in an SME: Prerequisites, Costs, Data Protection, Pilot Phase

Deciding to buy Microsoft 365 Copilot is usually the quick part; the real work starts afterwards: assigning licences is not enough if SharePoint permissions have grown organically over the years, if technical prerequisites are missing, or if nobody knows what the tool is actually for. This article covers the path from a paid licence to productive use. Whether the purchase makes sense in the first place is covered in a separate article.

Please note: This article is not legal or data protection advice; it is an assessment from an IT perspective. Prices exclude VAT and are subject to change; the official Microsoft offer or your reseller contract always takes precedence. Status: 3 September 2026.

Which licence does an SME need for Microsoft 365 Copilot?

Copilot is an add-on and always requires an eligible Microsoft 365 base licence – for smaller companies that means Microsoft 365 Copilot Business on top of Business Basic, Business Standard, Business Premium or Microsoft 365 Apps for Business.

The larger "Microsoft 365 Copilot" variant accepts a considerably wider list of base plans, including Microsoft 365 E3, E5, F1 and F3 as well as Office 365 E1, E3 and E5. If you are not on Microsoft 365 at all yet, you are buying two things, not one.

One detail that regularly gets overlooked in planning: the Microsoft 365 Business plans are capped at 300 seats per tenant, counted across Business Basic, Standard and Premium combined. Anyone expecting to grow past that number should factor the move to Enterprise plans in now.

Sources: Microsoft 365 Copilot licensing options, Microsoft 365 Business Premium FAQ

What does Microsoft 365 Copilot Business cost according to the Microsoft price list?

Microsoft lists Copilot Business at a promotional €15.60 per user per month on an annual subscription, down from a regular €18.20 – the offer runs from 1 July to 31 December 2026, applies to the first contract year only, and is available only to existing Microsoft 365 customers on an eligible Business plan. The following list prices appear on the official German Microsoft page (retrieved 3 September 2026):

All figures per user per month, excluding VAT. With the standalone add-on the base licence comes on top; with the two bundles it is included.

Not on the invoice, but very much in the budget: cleaning up permissions and training. What you can try beforehand at no cost is web-based Copilot Chat, which is included with eligible Microsoft 365 subscriptions – though it does not work on your company data.

Source: Microsoft 365 Copilot plans and pricing

Which technical prerequisites need to be in place before you start?

Every Copilot user needs a Microsoft Entra ID account and a primary mailbox hosted in Exchange Online – Copilot does not work on archive, group, shared or delegate mailboxes. Further items worth checking in advance:

• Microsoft 365 Apps must be deployed. Copilot is not available where device-based licensing is used for Microsoft 365 Apps for Enterprise.
• OneDrive must be enabled for your users, otherwise individual features are missing.
• Teams: for Copilot to reference meeting content after the meeting ends, transcription or recording has to be switched on.
• Network: the worldwide Microsoft 365 endpoints must be reachable, and WebSocket connections (WSS) to *.cloud.microsoft and *.office.com must not be blocked by a firewall, TLS inspection or a proxy. In practice the most common source of errors.
• Office app privacy settings: if connected experiences that analyse your content are disabled by policy, Copilot features are unavailable in Word, Excel, Outlook, PowerPoint and OneNote.

Source: Microsoft 365 Copilot app and network requirements

Why is permission hygiene the most important step before rollout?

Copilot only surfaces data a given user has at least view permission for – which means it exposes every existing permission mistake in one go. Anything that sat for years in a forgotten SharePoint library will now be delivered on request.

It gets worse: SharePoint defaults to the most permissive sharing option. Before the rollout you should:

1. Dial the sharing settings for SharePoint and OneDrive back to a sensible level and set expiry dates for sharing links.
2. Review what is shared via "Anyone" links or with everyone except external users – those are the classic oversharing candidates.
3. Identify ownerless sites, inactive sites and legacy content, and archive them.
4. Fence off particularly sensitive areas – HR, finance, management – properly via group permissions.

Microsoft provides SharePoint Advanced Management for this, which is unlocked as soon as at least one user in the tenant is assigned a Microsoft 365 Copilot licence. A caveat: according to Microsoft's prerequisites this additionally requires an enterprise base licence (Office 365 E3/E5/A5 or Microsoft 365 E1/E3/E5/A5); the Microsoft 365 Business plans are not on that list. Smaller companies therefore have to do the clean-up with built-in tools – feasible, but manual work.

And if you were counting on the "Restricted SharePoint Search" stopgap: it is being retired, and new activation has been blocked since 31 July 2026. Microsoft points to Restricted Content Discovery and Purview instead.

Sources: Get ready for Copilot with SharePoint Advanced Management, SharePoint Advanced Management prerequisites, Restricted SharePoint Search

What applies to data protection with Microsoft 365 Copilot?

Microsoft commits that prompts, responses and data accessed via Microsoft Graph are not used to train the foundation models, and treats Copilot as an EU Data Boundary service. For users in the EU, traffic stays inside that boundary, and abuse monitoring involving human review of content is switched off for Microsoft 365 Copilot.

Two caveats belong in any honest assessment. Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary – whether they are used is an administrator decision. And the Copilot activity history is retained: prompts and responses sit encrypted in your tenant, can be governed with retention policies via Microsoft Purview, and can be deleted by users in the "My Account" portal.

For your own homework that means: add Copilot to your record of processing activities, write a short internal policy on acceptable use, define how AI-generated content is handled – responses are not guaranteed to be accurate and need reviewing – and, in companies with a works council, put the rollout on the agenda early.

Source: Data, privacy and security for Microsoft 365 Copilot

How do you set up a pilot phase that actually tells you something?

Start with a small, clearly defined group from one area where a lot of writing, summarising and analysing happens – not with one person from every department. A scattered pilot group produces individual opinions, a self-contained one comparable experience and mutual support.

What works in practice: eight to twelve weeks, one named point of contact, a short kick-off introduction instead of a full-day training session, three to five concrete use cases per person – quote drafts, minutes from Teams meetings, analyses in Excel – plus a mid-point and a closing review. Prompt examples that work in your business belong in one central place, otherwise the knowledge evaporates.

How do you measure whether the rollout pays off?

The Microsoft 365 Copilot usage report in the Microsoft 365 admin center supplies the hard numbers: enabled users, active users, the active user rate and the number of prompts submitted. You will find it under Reports > Usage > Microsoft 365 Copilot, filterable over 7, 28, 90 or 180 days and exportable as CSV. A given day's data is typically available within 48 hours. For leadership there is additionally the Copilot Dashboard in Viva Insights.

The decisive metric is not the number of prompts but the active user rate: if you are below half after eight weeks, you do not have a tooling problem, you have a use case or training problem. Add two or three qualitative questions for the pilot group – which task got noticeably faster, where did Copilot contribute nothing. Only then can you decide which licences to renew and which to postpone.

Sources: Microsoft 365 Copilot usage report, Copilot Dashboard in Viva Insights

Conclusion

A successful Copilot rollout consists of a small amount of licence administration and a large amount of preparation: clean up permissions, verify technical prerequisites, document the data protection side, evaluate the pilot group honestly. Follow that order and after three months you have defensible numbers instead of a gut feeling.

Planning the rollout in your business in Recklinghausen or elsewhere in the Ruhr region? In our AI consulting engagement we review your tenant, clean up the permissions and support the pilot phase – a free initial conversation clarifies where you stand.

Publication note: This article was scheduled for 21 July 2026. Because of a technical fault in our publishing automation, it did not go live until 11 August 2026. All information was re-checked for accuracy before publication.