Let your IT support company handle the plumbing: licences, accounts, permissions, security settings and device rollout. Bring in an AI consultant, or an IT firm that has proven process skills, to decide which jobs AI should do and to redesign those workflows. For a Copilot or Gemini rollout, use both, because permission clean-up has to come first.
The reason is one plain fact about how these assistants work. Microsoft's documentation says Copilot only surfaces company data that each user already has at least view permission for, and Google says Gemini in Workspace only retrieves content the user has access to. That sounds reassuring, but it means anything over-shared becomes easy to find by simply asking. Fixing that is IT work, and it has to happen before anyone starts asking questions.
Split the work by layer, not by supplier
"Who should handle AI?" is really a dozen smaller questions. Most of them have a clear owner:
| Task | Usually best placed | Why |
|---|---|---|
| Buying and assigning AI licences | IT provider | They run your admin centre and often your billing |
| Sign-in, single sign-on, two-factor | IT provider | Identity is core IT work |
| Permissions and oversharing clean-up | IT provider, with the business deciding who should see what | The tools are admin tools; the decisions are business ones |
| Data-loss rules and sensitivity labels | IT provider | Security configuration |
| Installing apps and add-ins on devices | IT provider | Device management |
| Choosing which jobs AI should do | Consultant or owner | Needs process knowledge, not admin rights |
| Mapping and redesigning workflows | Consultant | Business analysis |
| Prompts, templates and assistant instructions for each role | Consultant, handed to an internal owner | Depends on how each job is done |
| Automations between business apps, such as the online shop and the accounts | Either, depending on skills | Some IT firms build these well; many don't |
| AI use policy and staff guidance | Both | IT writes the security rules; the consultant writes the how-to |
| Measuring whether it's working | Consultant or owner, using IT's usage reports | Usage isn't the same as value |
| Day-to-day support tickets for AI tools | IT provider | Part of normal support |
The pattern is simple: IT owns anything that needs admin rights or touches security; a consultant owns anything that needs someone to understand how the work is done. The contested middle, building automations, depends on the people involved rather than their job title.
Why permissions come before prompts
Microsoft's data, privacy and security documentation for Copilot makes the point directly: Copilot shows each person only what they already have permission to view, and Microsoft tells customers to use the permission models in services such as SharePoint so the right people have access to the right content. Google's privacy hub for Workspace says the same of Gemini, and adds that restrictions such as information rights management can stop Gemini retrieving sensitive files.
The risk isn't that the assistant breaks your permissions. It's that it makes existing mistakes visible. A folder shared with "everyone" years ago used to be safe through obscurity, because nobody went looking. Now anyone can ask. Picture an illustrative wine merchant where the office's shared folder, open to all 22 staff, contains payroll exports. A shop assistant who asks the assistant "what was agreed about this year's pay rise?" could be shown the payroll spreadsheet in the answer. Nothing was hacked; the file was always visible to them.
Microsoft gives admins tools for exactly this. If an organisation assigns at least one Microsoft Copilot licence, its SharePoint admins get the SharePoint Advanced Management features included with Copilot licences, including reports on sites shared with "everyone except external users", sharing-link reports, permission state reports, site access reviews that ask site owners to confirm who should have access, and restricted content discovery, which keeps chosen sites out of Copilot's answers unless a user has recently worked with them. Running those reports is squarely IT work. Deciding that the finance folder should be visible to three people rather than twenty-two is a business decision, which is why the table above gives this task to both. The Microsoft 365 Copilot readiness checklist covers the full list of pre-rollout checks.
What IT support companies are well placed to do
A competent IT provider can take a small business from "we'd like Copilot" to a safe, working set-up quickly, because most of the preparation is administration they already do. For the wine merchant, that means running the oversharing reports and fixing the three sites they flag; confirming two-factor authentication is on for everyone; switching on restricted content discovery for the finance site; assigning licences to a pilot group; making sure the Copilot app, which Microsoft renamed from Microsoft 365 Copilot to Microsoft Copilot in August 2026, is installed and signed in on the right devices; and setting up the data-loss rules the business asks for.
After rollout, IT is also the natural owner of the numbers that show adoption. The Microsoft 365 admin centre has a Copilot usage report showing active users over the last 7, 28, 90 or 180 days, which is the first thing to check before buying more seats. And when a staff member's assistant can't see a file it should, or can see one it shouldn't, that's a support ticket for IT, not a question for a consultant. Setting up single sign-on for your team's AI tools is another job that sits naturally with them.
Where IT support often runs out of road
The same strengths explain the typical gaps. IT firms are built to keep systems running securely; they aren't usually built to sit with a shop manager, watch how supplier price lists are handled, and decide which of the steps AI should do. Common gaps:
- Choosing the jobs. Licences get assigned, a short "how to use Copilot" session runs, and nobody decides what the tool is for in each role.
- Redesigning the process. AI gets bolted onto the current way of working, including its wasted steps.
- Tools outside the main suite. Automation platforms such as Zapier or Make, the online shop, the CRM's own AI features and the accounting package often fall outside the IT contract.
- Measuring value. Usage reports show who opened the tool, not whether it saved an hour.
Partner badges don't settle the question either way. Microsoft's Solutions Partner for Modern Work designation requires a score of at least 70 out of 100 across three areas: performance (growth in the number of customers using Microsoft's modern work products), skilling (staff holding intermediate and advanced certifications) and customer success (growth in active users and deployments). It's a real signal that a firm deploys Microsoft 365 competently and at scale. It isn't a test of whether they can redesign a butcher's order process. One certification now on Microsoft's list, Microsoft 365 Certified: Copilot and Agent Administration Fundamentals, is worth asking about specifically, because it covers administering Copilot rather than using it. Choosing a managed IT provider that can support AI tools goes further into judging an IT firm's AI claims.
The licence question: pilot before you buy for everyone
If your IT provider resells your Microsoft or Google licences, it earns on each seat. That's a normal business model and doesn't make their advice wrong, but it's a good reason to insist on a pilot before a full rollout.
The numbers make the case. Microsoft 365 Copilot Business costs $21 a user a month on an annual plan ($25.20 billed monthly), with a promotional $18 on annual billing until 31 December 2026. It's sold on annual commitment only, so even pilot seats are a year's spend. For the wine merchant's 22 staff at $21, licensing everyone is $5,544 a year; a pilot of six seats is $1,512, or $1,296 at the promotional price. Microsoft 365 business plans already include Copilot Chat, now called Microsoft Copilot Chat, at no extra cost, and for some roles that will be enough. The paid licence adds the ability to reason across a person's emails, meetings and files together; the pilot is how you find out which roles actually need that. Whether Microsoft 365 Copilot is worth it for a small business works through that choice role by role.
A three-shop wine merchant's rollout, split two ways
Here's how the illustrative wine merchant, on Microsoft 365 Business Standard with 22 staff, might divide a Copilot rollout between its IT provider and an outside consultant:
| Weeks | IT provider | Consultant | Merchant |
|---|---|---|---|
| 1 to 2 | Runs the oversharing reports; fixes three over-shared sites; restricts discovery of the finance site; checks two-factor for all users | Maps three candidate jobs with the office and shop managers | Decides who should see finance and payroll files |
| 3 | Assigns six pilot Copilot Business seats; installs the app on pilot devices | Writes prompt cards for the three jobs: supplier price-list comparison in Excel, trade order replies in Outlook, the monthly trade sales summary | Names the six pilot users and an internal owner |
| 4 to 9 | Handles tickets; watches for access problems | Two check-ins with pilot users; refines prompts; records time taken before and after for each job | Pilot users log time saved each week |
| 10 | Pulls the Copilot usage report for the pilot group | Compares time saved with the baseline; recommends which roles get seats | Decides whether to add seats, and for whom |
The costs, illustratively: the six pilot seats at $1,512 for the year; the IT provider's permission work quoted as a fixed job, which is worth asking for; and about 16 hours of consultant time, which at goLance's published senior band of $120 to $200 an hour comes to $1,920 to $3,200. Suppose the pilot shows that the office manager and the two trade account managers save real time, while the shop staff mostly use the Copilot Chat already included in their plan. The merchant then adds licences only where they paid off, rather than buying 22 seats on day one, and the saving on unused seats covers much of the consultant's fee.
The consultant's prompt cards are the part IT wouldn't normally produce. One of the wine merchant's, for trade order replies in Outlook, might read:
TRADE ORDER REPLY (Outlook, Copilot)
When: a trade customer emails an order or a stock question.
Prompt: "Draft a reply to this email. Confirm each wine they
asked for with vintage and quantity, using only the attached
stock list. If a wine isn't on the list or has two vintages,
say we'll confirm by phone. Delivery day for their account is
[day]. Keep it under 120 words, friendly, no promotions."
Check before sending: every vintage and quantity against the
stock list; the delivery day.In the pilot, an illustrative first draft from this card confirmed "6 x house white" correctly but offered a "10% trade discount on your next order", which nobody had mentioned. The fix went onto the card as a line, "never offer discounts or promotions", and the check step caught the one time it happened again. That's the kind of detail that only turns up when someone is watching how the tool is used in a specific job, which is the consultant's side of the split.
If you run Google Workspace instead, the split is the same with different tools. IT reviews sharing on shared drives and folders, uses information rights management to stop Gemini retrieving the files that must stay restricted, and sets data-loss rules; Google says existing data-loss rules also apply to Gemini's output when it's inserted into Workspace files. The consultant's side, choosing jobs and writing prompt cards for Gemini in Gmail, Sheets and Docs, doesn't change at all.
A realistic version of the same rollout without the split: the IT provider assigns 22 licences in week one, runs a lunchtime session on "getting started with Copilot", and moves on. Two months later, the usage report shows a handful of regular users. Nobody chose what the tool was for, the permissions review was skipped to hit the go-live date, and a shop assistant has found last year's pay review in a search. None of this is the IT provider being careless; it's the IT provider being asked to do a consultant's job as well as its own.
Getting the two to work together
Two outside parties on one project can produce finger-pointing, or they can cover each other's blind spots. Four habits make it the second:
- One kick-off meeting with both. Thirty minutes where the consultant explains the chosen jobs and the IT provider explains what has to be fixed first. Each learns what the other needs.
- One shared plan. A single document listing each task, who owns it and when it's due. The wine merchant's table above is enough.
- Licences follow the jobs, not the other way round. The consultant's list of jobs and roles goes to IT before any licence decision is made.
- A named owner inside your business. Someone who can make the calls neither outsider should: who sees which files, which jobs matter most, and when the pilot has proved its point.
If your IT provider has genuine process skills, you may not need a separate consultant at all. Test them the same way you'd test a consultant: ask them to map one of your jobs and say what AI should and shouldn't do in it. A good answer is specific to your work; a weak one is a list of Copilot features.
Questions for your IT provider before you hand over the AI brief
- Who on your team has rolled out Copilot or Gemini for a business our size, and what did the permissions review find there?
- Will you run the oversharing reports and fix what they find before any licences are assigned?
- How do you earn from the licences you recommend?
- Will you support a pilot group before a full rollout, and pull the usage report at the end?
- Who decides which jobs the AI is used for: you, us, or someone we bring in?
- Which tools outside the main suite, such as automation platforms and our online shop, can you support?
- What does our current contract cover for AI-related tickets, and what's extra?
- What will you report to us each month once it's live?
Their answers usually make the split obvious. An IT provider that answers the first four well and says "you decide" to the fifth is telling you, helpfully, where its job ends. Hiring a Microsoft 365 partner for a Copilot rollout covers what to put in the IT side of the brief if you're choosing a provider from scratch.
Further reads
- AI Consultant vs Agency vs Freelancer: Which Should You Hire? — The other outside options, if IT isn't the right fit.
- How to Set Up Company AI Accounts Instead of Personal Logins — Moving staff onto company AI accounts, an early IT job.
- How to Choose an AI Consultant: 20 Questions to Ask First — Twenty questions that work on IT firms offering AI too.
- Microsoft 365 Business Premium vs Standard for AI Security — Which Microsoft plan gives IT the security controls it needs.
- Gemini or ChatGPT for a Google Workspace Business? — The equivalent decision for Google Workspace businesses.
- AI Consultant vs In-House Hire: Which Costs a Small Team Less? — When the AI work justifies someone on staff.
- Do I Need an AI Consultant? 8 Signs It's Time to Get Help — Eight signs a small business needs outside AI help, each with a test you can run this week, plus the signs that it doesn't need a consultant yet.
- What Does an AI Implementation Consultant Actually Do? — The six stages of an AI implementation consultant's work, the evidence each stage should leave behind, and how the role differs from strategy or IT help.
- Is AI Ticket Automation Worth It for a Small IT Support Shop? — When AI ticket automation pays for a small IT support shop, when it quietly cuts your revenue, and a 30-day test to find out.
- Do Small Medical Practices Need an AI Consultant? — When a small medical practice can handle AI itself, the signs outside help will pay for itself, what a consultant shouldn't do, and a scoped brief to adapt.
- AI Strategy vs AI Implementation Consultant: Which Do You Need? — What an AI strategy consultant and an implementation consultant each hand you, a decision table for eight common situations, and a worked garden centre example.
- What Is the Cheapest Way to Get Expert AI Advice? — Free help pages, forums, adoption kits and discovery calls answer most AI questions. When paid advice is worth it, and how to compare quotes.
- How to Implement AI in a Small Business With No Tech Team — Running AI with no IT staff: who covers the technical jobs, which tools need no code, how to secure logins, and what to do when something breaks.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: Microsoft Learn, 'Data, privacy and security for Microsoft Copilot' and the page on SharePoint Advanced Management features included with Copilot licences; Microsoft partner documentation, 'Solutions Partner for Modern Work'; Google Workspace, 'Generative AI in Google Workspace Privacy Hub'; Microsoft 365 Copilot Business pricing (checked September 2026); goLance AI consultant rate guide (2026).