Microsoft 365 Copilot Readiness Checklist for Small Businesses

You're ready if every intended user has an eligible Microsoft 365 plan, an Entra ID account and an Exchange Online mailbox, Office apps are on Current Channel or Monthly Enterprise Channel, and your SharePoint and OneDrive sharing has been tidied so Copilot won't surface files people shouldn't see. That last point usually takes the most work.

Two things have changed recently. Microsoft renamed the Microsoft 365 Copilot app to Microsoft Copilot in August 2026, and Copilot Chat is now Microsoft Copilot Chat, though pricing pages still say Microsoft 365 Copilot Business in places. And Restricted SharePoint Search, the stop-gap many readiness guides still recommend, is retiring: Microsoft blocked new enablement from 31 July 2026 and now points administrators to Restricted Content Discovery instead.

Licences and cost: five checks before you buy a seat

1. Every intended user has an eligible base plan. Why: Copilot is an add-on to a qualifying Microsoft 365 licence. Business Basic, Standard and Premium all qualify, as do Microsoft 365 Apps for Business and Teams Essentials. Verify: in the Microsoft 365 admin centre, go to Reports, then Usage, then Microsoft Copilot; the Readiness tab shows how many users hold a prerequisite licence.
2. You've priced the right option. Why: the bundles are cheaper than buying Copilot separately. Copilot Business is $21 per user per month on annual billing ($25.20 billed monthly), with a promotional $18 on annual billing until 31 December 2026. Business Standard with Copilot is $23.50 annual ($28.20 monthly) and Business Premium with Copilot is $32 ($38.40 monthly). Buying Business Standard at $14 plus Copilot at $21 separately comes to $35, so the bundle saves $11.50 per user. Verify: compare your current licence per user against the bundle price. Copilot pricing for business and enterprise licences covers the options in detail.
3. You understand the commitment. Why: Copilot Business is sold on an annual commitment only, for organisations of up to 300 users, so extra seats are paid for until renewal whether used or not. Verify: note your renewal date before choosing how many seats to buy.
4. You know who needs the paid licence. Why: people who live in Outlook, Teams and Word get the most from it. Verify: once you hold Copilot licences, the readiness report's "Suggested candidate for Copilot" column flags the top 25% of unlicensed users each week, based on their use of Outlook, Teams and Office documents. Before that, look at who sends the most email and attends the most meetings.
5. You've checked what's free. Why: Copilot Chat comes with Microsoft 365 business plans at no extra cost and now works on Outlook mail and open files; the paid licence adds reasoning across emails, meetings and files together. Some staff may need only Chat. Verify: try your five commonest tasks in Copilot Chat first. What Copilot Chat gives you free versus the paid licence sets out the difference.

Accounts, mailboxes and apps Copilot depends on

6. Each user has their own Entra ID account. Why: Copilot works per signed-in person and shows only what that person can access. Shared logins break both. Verify: Users, then Active users, in the admin centre; no "frontdesk" account used by four people.
7. Primary mailboxes are in Exchange Online. Why: Copilot drafts and summarises from mailbox content only when the mailbox is in Exchange Online; on-premises and hybrid mailboxes don't support it. It also works on shared and delegate mailboxes users can access, but not on group mailboxes. Verify: check where each mailbox lives and what type your team inboxes are.
8. Office apps are on an eligible update channel. Why: the readiness report counts users on Current Channel or Monthly Enterprise Channel as ready; Semi-Annual Enterprise Channel isn't. Copilot also isn't available with device-based licensing for Microsoft 365 Apps. Verify: the readiness report's "Uses eligible update channel" column.
9. OneDrive is set up for everyone. Why: some Copilot features, such as file restore, need a OneDrive account. Verify: the OneDrive setup guide in the admin centre.
10. Browsers and devices meet the minimum. Why: Copilot in the Office web apps needs third-party cookies enabled, and mobile use needs iOS or iPadOS 16 or later, or Android 10 or later. Verify: check the browser settings on shared front-desk computers and the phone models staff use.
11. Your network allows Copilot. Why: Microsoft asks organisations to allow the whole *.cloud.microsoft domain; old web filters sometimes block it. Verify: run Microsoft's connectivity test from the office network.
12. Teams meetings can be referenced if you want that. Why: Copilot can only refer back to a meeting after it ends if transcription or recording was on. Verify: decide your meeting policy, including how you'll tell guests and external attendees.

Permissions: what Copilot could surface on day one

Microsoft's documentation is clear that Copilot only surfaces organisational data a user already has at least view permission for. That sounds reassuring, and it is, as long as your permissions are right. In most small businesses they aren't quite: a folder shared with everyone years ago, an "Anyone" link sent to a supplier, a payroll spreadsheet in a site the whole team can open. Nobody found those files before because nobody went looking. Copilot goes looking on every question.

13. Sharing defaults are sensible. Why: Microsoft's first data-readiness step is reducing accidental oversharing through SharePoint sharing settings, and those tenant-level settings also apply to OneDrive. Verify: in the SharePoint admin centre, check external sharing levels and the default link type; "specific people" is the safest default.
14. Every site has a valid owner and unused sites are cleaned up. Why: an ownerless site is one nobody will fix. Verify: list your sites and owners; archive or delete those nobody uses.
15. You've run the data access governance reports. Why: they show which sites are shared most broadly. In the SharePoint admin centre, under Reports, then Data access governance, the site permissions snapshot shows your baseline, and the activity reports show new sharing links and content shared with "Everyone except external users" in the last 28 days. Microsoft suggests snapshot reports quarterly and activity reports monthly. These reports are part of SharePoint Advanced Management, which your administrator gets once at least one user in the organisation has a Copilot licence. Verify: the reports have run and you've listed the top ten broadest sites. See Microsoft's data access governance reports page.
16. The worst exposure is fixed. Why: removing "Everyone except external users" from a finance or HR site closes the biggest gaps at once. Verify: re-run the site permissions report after changes, and use the site access review feature to ask site owners to confirm.
17. Sensitive sites are held back during review. Why: Restricted Content Discovery keeps a site's content out of organisation-wide search and Copilot while you review it, without changing permissions; people can still open files they have access to, and still find content they own or recently used. Turn it on in the SharePoint admin centre under Sites, then Active sites, choosing the site and switching on "Restrict content from Microsoft Copilot" on its Settings tab. It needs a Copilot licence in the organisation, and large sites can take time to update. Verify: search for a known file from that site with a test account. Microsoft's Restricted Content Discovery page has the details.
18. You're not relying on Restricted SharePoint Search. Why: it's retiring, new enablement has been blocked since 31 July 2026, and Microsoft says it was never a security boundary. Verify: if it's already on, plan to fix permissions and switch it off.
19. Your most sensitive files are labelled, if your plan allows. Why: Copilot honours sensitivity labels and encryption. Microsoft 365 Business Premium includes sensitivity labels and data loss prevention. Documents protected with legacy Information Rights Management aren't used when Copilot grounds its answers, so labels are the route Microsoft recommends instead. Verify: check which plan you're on before building a labelling scheme.

For a step-by-step clean-up of SharePoint itself, see cleaning up SharePoint permissions before turning on Copilot.

Rules, training and a pilot group

20. Staff have one page of rules. Why: people need to know what to ask Copilot about guest or customer data, and that its output must be checked before it's sent. Verify: everyone in the pilot has read and acknowledged it.
21. A pilot group of three to five people is named. Why: a small group finds the problems before everyone meets them. Verify: names, roles and the tasks each will try.
22. Success measures are written down. Why: without them, the renewal decision becomes a feeling. Verify: pick two or three, such as minutes per reply, time to prepare a weekly report, meeting follow-ups sent the same day. Measuring whether Copilot pays for itself suggests more.
23. Review dates are in the diary. Why: the admin centre's Copilot usage report shows active users over 7, 28, 90 and 180 days, which tells you who is really using their seat. Verify: day 30 and day 90 reviews booked.

A 22-room boutique hotel runs the checklist

The worked example here is an illustrative 22-room boutique hotel with 14 Microsoft 365 users on Business Standard: general manager, reservations, events, front desk, finance and the head housekeeper. The general manager, who is also the tenant's administrator, worked through the checklist over two weeks. The findings:

Sequence mattered. The data access governance reports come with SharePoint Advanced Management, which the hotel only had once it bought its first Copilot licence. So the general manager licensed one seat first, ran the reports and fixed the permissions, and only then licensed the pilot group.

The pilot group was four people: the general manager, reservations lead, events manager and finance lead. On the bundle, Business Standard with Copilot at $23.50 per user per month, four seats cost $94 a month. Keeping Business Standard at $14 and adding Copilot Business separately would have cost $140 a month, or $128 at the $18 promotional rate. The other ten staff stayed on Copilot Chat, which is included. If the pilot works, the review at day 90 decides who else gets a seat, using the readiness report's suggested candidates alongside what the pilot group learned. For the rollout itself, rolling out Microsoft 365 Copilot to a small team picks up from here.

How long the readiness work took the hotel

Owners tend to underestimate the permissions part and overestimate the technical part. The general manager kept a rough log across the two weeks:

More than a third of the time went on permissions, and that was for a hotel with only nine SharePoint sites. A business with years of accumulated team sites and shared folders should expect that line to grow faster than any other.

Testing for oversharing with a few pointed prompts

Reports show where permissions are broad. A direct test shows what Copilot will actually hand over. Create a test account with the same access as your most junior member of staff, license it for the test, and ask the questions a curious employee might:

What are the salary bands for front desk staff?
Summarise the latest management accounts.
Which guests complained last month and what compensation did we give?
Show me any documents about staff disciplinary cases.
What did we pay for the new booking system?

At the hotel, the first run, before the fixes, was illustrative of what many small businesses would see. The salary question returned a summary of the payroll spreadsheet from the Finance site. The compensation question listed three guests by name with the amounts refunded, from an events-team folder shared with everyone. The disciplinary question found nothing, because HR documents were in the general manager's own OneDrive. After the permission fixes and Restricted Content Discovery on the Finance and HR sites, the same prompts returned "I couldn't find information about that" for the first two, and nothing sensitive for the rest. Run the test again after any big change to sites or teams.

The cost of skipping this is easy to picture. A tour operator licenses Copilot for all staff on the day it's bought. A part-time guide asks it for "this season's pay rates" and gets the owner's payroll spreadsheet, which had sat in a folder shared with the whole company since a previous office manager set it up. Nothing malicious happened; the guide mentioned it to a colleague, who mentioned it to the owner. But everyone's pay was now common knowledge, and the fix that would have taken ten minutes beforehand took an awkward week afterwards.

Ready, nearly ready or not yet: reading your results

• Ready: items 1 to 12 all pass, items 13 to 17 are done for your sensitive sites, and a pilot group with measures is named. License the pilot.
• Nearly ready: the technical items pass but the permission clean-up is half done. License one seat for the administrator to get the reporting tools, finish the clean-up, then license the pilot.
• Not yet: mailboxes aren't in Exchange Online, staff share logins, or nobody can say where the payroll and HR files live. Fix those first and use Copilot Chat meanwhile.

If nobody in the business has the time or the admin confidence for the permissions part, that's the piece most worth outside help. Hiring a Microsoft 365 partner for a Copilot rollout explains what to ask for and what to check in their quote.

Copilot readiness: questions small businesses ask

Can we buy Copilot for just one or two people first?

Yes, and it's a sensible start. Copilot Business is sold per user on an annual commitment, for organisations of up to 300 users, so you can license a small pilot group. Buying the first licence also gives your SharePoint administrator the SharePoint Advanced Management tools, including the data access governance reports, which helps with the permissions clean-up before a wider rollout.

Does Copilot use our files to train Microsoft's models?

Microsoft says it doesn't: its readiness documentation states that it never uses your files or your communications with Copilot to train models, and that Copilot only surfaces data a user already has at least view permission for. The practical risk is the second point: overshared files become easy to find, which is why the permissions checks matter.

What if we're not ready yet?

Use Copilot Chat, which comes with Microsoft 365 business plans at no extra cost and now works on Outlook mail and open files, while you tidy permissions and move devices to a supported update channel. Revisit the paid licence once the SharePoint checks are done and you have a pilot group and success measures agreed.

Is Restricted SharePoint Search still worth setting up?

No. Microsoft is retiring it and has blocked new enablement since 31 July 2026. It was always described as a temporary measure. Microsoft now points administrators to Restricted Content Discovery, a site-level setting that keeps selected sites out of organisation-wide search and Copilot while permissions are reviewed.

Further reads

• Is Microsoft 365 Copilot Worth It for a Small Business? — Whether the paid licence earns its cost for your team.
• Does Microsoft 365 Copilot Keep Your Business Data Private? — How Copilot handles your business data in more depth.
• Microsoft 365 Business Premium vs Standard for AI Security — Whether the security in Business Premium is worth the upgrade.
• How to Write an AI Usage Policy for Your Small Business — Turn the one-page rules into a proper staff policy.
• Copilot in Outlook: How to Triage Email and Draft Replies Faster — The first practical job to give your pilot group.
• ChatGPT or Copilot for a Microsoft 365 Business? — Whether ChatGPT suits a Microsoft 365 business better.
• Do You Need a Copilot+ PC or AI Laptop for Your Business? — What a Copilot+ PC adds, which AI works on any computer, and when it's worth choosing one as you replace old Windows 10 machines.
• AI Consultant vs Your IT Support Company: Who Should Handle AI? — Who should handle which parts of AI: a task-by-task split between your IT provider and a consultant, with a wine merchant's Copilot pilot.
• What Is an AI Readiness Assessment and What Does It Involve? — What an AI readiness assessment examines, how it runs, a scored example for a homeware brand, and what vendor readiness reports leave out.
• AI Audit vs AI Readiness Assessment: What's the Difference? — How an AI audit differs from a readiness assessment, the four things sold as an 'AI audit', worked barber and dry cleaner examples, and a DIY version of each.
• AI Readiness Checklist: Score Your Business in 20 Minutes — Fifteen statements, scored 0 to 2 with evidence, tell you whether to pilot AI now, fix a few gaps first or do groundwork before spending anything.
• 10 AI Implementation Mistakes Small Businesses Make — Ten setup, billing and upkeep mistakes that turn a sensible AI project into a year-long cost, each with how it shows up and the fix.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Microsoft Learn (minimum requirements for Microsoft Copilot; app and network requirements; data and compliance readiness; Copilot readiness report; SharePoint Advanced Management features in Copilot licences; Restricted SharePoint Search; Restricted Content Discovery; data access governance reports; Business Premium information protection); Microsoft 365 Copilot Business pricing (checked September 2026).