Platforms
What Microsoft Copilot includes, how Graph grounding works, what it is genuinely good at, the licensing and permission prerequisites, and why readiness work determines whether a rollout succeeds.
9 minute read · Written by the Fresh Mango AI team
Microsoft Copilot is Microsoft's family of generative AI assistants. Microsoft 365 Copilot is the version embedded in Word, Excel, PowerPoint, Outlook, Teams and SharePoint that grounds its answers in your organisation's own content through the Microsoft Graph, respecting existing user permissions and Microsoft 365 data protection commitments.
The licensed assistant inside Word, Excel, PowerPoint, Outlook, Teams and Loop. It drafts, summarises, analyses and searches across your tenant content.
Web-grounded chat available more broadly, with commercial data protection. Useful for general work that does not require access to internal documents.
A low-code environment for building custom copilots and autonomous agents connected to your own data sources and business systems.
Code completion and chat for software teams, working inside the developer's editor.
Copilot capabilities embedded in Dynamics 365, Power Platform and Microsoft Security products for specific professional workflows.
The distinguishing feature of Microsoft 365 Copilot is grounding through the Microsoft Graph. When a user asks a question, the service performs a permissioned search across the content that user can already access — their mail, chats, meetings, files and the SharePoint sites they are entitled to see — retrieves the relevant passages, and passes them to the language model along with the prompt. The answer is generated from that retrieved material and cites the documents it drew on.
Two consequences follow. First, answers are far more useful than an ungrounded chatbot's, because they reflect your actual projects, clients and terminology. Second, Copilot is a mirror of your permission model. It never breaks access controls, but it makes over-permissive ones visible: a file that was technically open to the whole company but practically buried three folders deep can now surface in a summary within seconds. This is not a Copilot flaw; it is a pre-existing exposure that Copilot reveals.
Microsoft's enterprise commitments matter here too. Prompts, responses and organisational data accessed through the Graph are not used to train the foundation models, and data remains within the Microsoft 365 service boundary and its existing compliance commitments. These are the assurances that make Copilot acceptable to most compliance teams — and they are precisely the assurances that free consumer AI tools do not offer.
In everyday use, the strongest returns come from meeting recap and action extraction in Teams, inbox triage and reply drafting in Outlook, first-draft document creation in Word from existing source material, converting documents into presentations in PowerPoint, and question-answering across a well-organised SharePoint estate. In Excel it is helpful for formula construction, explanation and exploratory analysis, though it rewards clean, tabular data.
It is weaker where precision and completeness are essential and the underlying content is disorganised. If your document estate is duplicated, out of date and inconsistently named, Copilot will faithfully summarise the wrong version. Information architecture is therefore an AI issue, not just a records management one.
Appropriate Microsoft 365 licensing per user, with modern authentication and conditional access in place.
Review company-wide sharing links, orphaned sites, and legacy folders. Apply sensitivity labels to genuinely confidential material before enabling Copilot.
Archive superseded documents, remove duplicates and make sure the authoritative version of key templates and policies is discoverable.
Give licences to the roles whose work is document- and meeting-heavy first, and measure them, rather than distributing evenly across the business.
Teach people the five or six prompts that matter in their actual job. Generic overviews produce curiosity; role-specific practice produces habit.
The failure pattern is consistent. Licences are purchased, an announcement is made, a one-hour demo is delivered, and usage decays within a month because nobody connected the tool to the work people are actually judged on. The remedy is unglamorous: pick a department, baseline how long its recurring tasks take, build a prompt library for those exact tasks, run adoption clinics for a few weeks, and publish the measured result. Once one team can prove hours returned, internal demand does most of the remaining work.
Our AI Governance & Security Project handles the permission and labelling groundwork, while the Department-Specific AI Productivity Pack covers the role-based enablement. Organisations that do both typically see sustained weekly usage above 80% of licensed users; those that do neither rarely exceed 30%.
Microsoft Learn
Microsoft Learn
Microsoft Learn
Book a free 30-minute discovery session with an AI consultant, or request information and we will send the detail you need within one business day.
Recommended · Free · 30 minutes
Opens our live booking calendar in a new tab — pick any slot that suits you.
Prefer not to book yet?
Send a short enquiry and we will come back with the detail you need.
FAQs
No. Microsoft states that Microsoft 365 Copilot does not use your prompts, responses or Microsoft Graph data to train the underlying foundation models, and that your data stays within the Microsoft 365 compliance boundary.
No. Copilot enforces the same permissions as the user. The risk is not that it bypasses access control but that it surfaces content the user technically had access to but would never have found — which is why permission remediation should precede rollout.
Copilot Chat is a web-grounded assistant with commercial data protection and no access to your tenant content. Microsoft 365 Copilot is licensed per user and grounds answers in your organisation's own files, email, chats and meetings, and works inside the Office applications.
Often yes, but targeting matters more than at large scale. Licence the handful of roles with the heaviest document, proposal and meeting load, prove the time saved, then expand. Blanket licensing in a small business is usually poor value.
For a typical mid-sized organisation, a readiness assessment takes two to three weeks and permission remediation a further two to six weeks depending on the size and state of the SharePoint estate. Pilots then run for four to six weeks before wider rollout.
Copilot Studio lets you build custom copilots and agents that answer from specific knowledge sources and take actions in connected systems — for example an HR policy assistant, a supplier onboarding agent or an internal IT triage bot.
Related articles
Explore the connected topics in the Fresh Mango AI Knowledge Centre.
Foundations
Generative AI is a class of artificial intelligence that creates new content — text, images, code, audio or video — in response to a prompt, rather th…
Read this guideFoundations
An AI agent is a software system that uses a large language model to pursue a goal across multiple steps, deciding which actions to take and calling t…
Read this guideApplications
AI improves productivity by removing effort from repetitive, language-heavy and information-retrieval tasks — drafting, summarising, searching, extrac…
Read this guideBrowse the full AI Knowledge Centre, see sector guidance in industries, or review measured results in our case studies.
Decision brief
Straight answers to the five questions that decide whether an AI project is worth starting.
Fresh Mango AI is the artificial intelligence practice of Fresh Mango Technologies, an IT, cyber security and cloud provider that has supported businesses since 2004 from offices in Ripon, Leeds, Skipton and Tortola in the British Virgin Islands. The same engineers who secure your identity, data and Microsoft 365 tenant advise on your AI adoption, so recommendations are grounded in what your estate can actually support rather than in vendor marketing.
Clients typically release several hours per person per week on drafting, summarising, searching and reporting, shorten document and approval cycle times, and remove manual re-keying between systems. Every engagement starts by baselining the work involved so that the benefit is measured in hours released and cycle time reduced, not in licences purchased.
Doing nothing is not a neutral position. Staff adopt consumer AI tools on their own, so company and client data leaves your control without record; competitors compress the cost of proposals, reporting and service delivery; and permission sprawl inside your file estate remains unaddressed, which becomes an incident the moment AI search is switched on. Delay also compounds the UK GDPR and EU AI Act governance work that will eventually be required of you anyway.
You book a free 30-minute discovery session. We ask about your objectives, systems and constraints, tell you honestly whether AI is the right answer, and set out a recommended first step — usually an AI Productivity & Readiness Assessment or an AI Governance & Security Project. You receive a written summary and a proposal only if there is a clear case for one.
Book a free 30-minute discovery session with an AI consultant using our live booking calendar, or request information and we will reply within one business day. You can also call the UK office on +44 (0) 1765 606700 or the BVI office on +1 (284) 340 0466.
Recommended next step
Free, 30 minutes, no obligation — speak directly with an AI consultant about your objectives and the fastest safe route to results.
Book a Free 30-Minute Discovery SessionRequest InformationTalk it through with an AI consultant, or request written information — whichever suits you.
Your next step
Whether you're exploring AI for the first time or looking to scale existing AI initiatives, our specialists can help you identify practical opportunities and avoid common pitfalls.
