Copilot: What you do &
don't know:
What the Copilot is going on?

Hi guys, welcome to one of eight maybe even more mini episodes around Copilot. This is kind of a miniseries focused kind of around the Copilot delivery best practices, how things are functioning and we're going to take you guys through a short 25m minute kind of process over these next eight episodes talking around what Copilot is doing, how it really fits in with day-to-day running, what we're going to kind of cover and deliveries and best practices.

The first episode is what the Copilot is going on. We're going to be today kind of focusing through the cut going through the hype and the noise that gets crystal clear what Microsoft Code Pilot actually is, what it isn't, and what it really means for the Microsoft 365 customer. There's a lot of misinformation out there. I think that's ev evident wherever you look. So this episode sets that kind of foundation for the entire series, or at least that's what I'm going with and hoping for.

So, talking through what we're going to cover. What Copilot actually is and isn't. So what it's currently doing daytoday, how it works inside Microsoft 365, what data it's actually using and accesses, why it's secure by design, customer prerequisites for enablement, the kind of MSP preparation strategies. And then I want to talk about why this matters. So our AI adoption is accelerating rapidly. You know, we've had 40 41 42 months now where AI is becoming more and more relevant outside of automation to generative AI.

Customers are misunderstanding the capabilities. MSPs need to guide Defend, Govern & Prove that strategy. So what that looks like and we have another series we'll be focusing on which is around Defend, Govern & Prove. Focusing on the foundations and the layers that MSPs need to build in order to become better at what they are achieving and how they're working. So outside of those things as well as the AI readiness drive sorry I want to kind of start focusing on what Copilot actually is and that starts with identifying what it also isn't.

So Copilot itself is an AI assistant. It's built into the Microsoft 365 apps. You'll notice in recent weeks courtesy of Microsoft Ignite that we now got a new Copilot for business SKU which is for those foundational licenses. And I do I'm a bit wary of them. I think they're things that we should be focusing on and I will try and do a couple of episodes over the end of this series to focus on what the new features offer.

We also know that Microsoft 365 E5 comes with Copilot for Studio now for security sorry security for Copilot. That's a big hot topic. But going back to kind of the foundations of Copilot, it's powered by the GPT4 and 4.0 mini version. And you can enable GPT5. Now probably by the time this goes live it's going to be GPT5 by default. It's connected to Microsoft Graph. So I find this well actually it's using work IQ now.

But the principles are very much the same. The idea is it's connected to the backbone of how we look at things in the UI and how our processes run and manage. So Work IQ is that new generative AI backbone for Copilot itself. I apologize. I've got a graph in there at the moment. It uses your organization's data securely. And I think most people don't always realize this. It's actually working on secure data. And that's based on the permissions that user has.

And I do want to talk and cover how those kind of prompt processes work at a later series. I'm not going to talk about them now, but please feel free to kind of tune in for the next episode that comes out. It's also context aware and tenant specific. When I talk about this, it's aware of what you're looking for. It's learning your behaviors as an individual when you're using Copilot and it's specifically around the tenant and the permissions and management within our own organization.

And I think that really resonates when we talk about using it. Our safe is AI. Copilot is designed to be built in, secure, and protected within that Microsoft 365 tenant, which is why MSPs alike often recommend Copilot over other products. Or other vendors and AI solutions is because it's built in to be tightknit secure and relevant to the Microsoft 365 environment. And I guess talking about what Copilot isn't, and I think I've said this already on the screen for you, it's not a ChatGPT.

It's not internet trained on your tenant. It doesn't kind of look through additional information.

It might look at sources outside to provide you feedback, but it doesn't store or use that trainable information outside of the environment. It is it's in place at the moment. It's also not a staff replacement. And I think most people that look to not adopt AI use this as a if I start using it, my job's redundant. And that's not the case. It's there to complement the services you're doing. It's there to help you as an individual and your customers more importantly be more efficient in what they're doing.

Maybe that's helping you rewrite an email, writing out a PowerPoint presentation to present on what co what a Copilot's going on as an example. It's there to make you more efficient, be that kind of proactive sideline for you. And the other thing to be aware of, it doesn't fix poor data hygiene. And I think this also is relevant to kind of more of your departmental areas, finance, HR departments. When we talk about poor data hygiene, it's all about keeping things up to date and relevant to today's world.

This doesn't sit right like Copilot doesn't sort data hygiene. It identifies it. It picks it up and the responsibility at the end of the day sits with us to kind of remediate that hygiene, clear up the data that's not required. And there are products in Microsoft that offer that. It's a conversation for another day, not for now. So talking about how Copilot works, I think it's really relevant to understand the layers that kind of are focused around Copilot.

It's a user prompt to begin with. When you look at Copilot chat or Copilot 365 and you're in Word or in Excel and you click the little Copilot button, which you can see the logo on the right for you start to summarize or make a request for Copilot to do something. So in this prompt you see in front of you, it's summarizing that document. When you request that, it's going to go back through Microsoft Graph.

It's going to search for the information you requested. So perhaps it's not necessarily the document that you see in front of you. It's going to look for an email or another file in re in reference. It goes into Microsoft Graph or Work IQ. Now, and it goes through those layers and identifies any information that could be relevant or helpful for what you're working to achieve. It uses a grounding layer. And this is something that I think is really useful.

It identifies the relevant data. It filters by your permissions and it follows a zero trust model. And that's why it's safe and secure within a 365 tenant. It has a whole bunch of security layers and foundations it has to meet in order to produce a response. And then it uses the large language model response. So it generates a contextual response based on your request. So summarize this document. It's going to look through your permissions, look through the document itself and summarize through the LLM which is locked down and secure within your 365 tenant.

And then the last thing before it outputs a return is it looks through policy applications. And I think this is really relevant when we talk about sensitivity and data management tenant policies applied is completely applied to Copilot. So recent delivery with Microsoft Ignite. Again, they've just deployed the data loss prevention policies around AI delivery protecting kind of sensitive data using Copilot and prompt engineing prompt injection. It's looking it's identifying and saying actually I can't produce this information because of a DLP policy.

So it uses these kind of five output layers or individual architecture should we say and then before you get your response it follows this methodology. And I think this really helps for us to identify how that process works. And I just want to add a note. Opiate only sees what the user can see. And I think this is really important. It will never ever go past the permissions that are done within that user's environment, what they have access to originally.

And this is why oversharing permissions or oversharing on permission management is critical.

It's so important that us as an MSP or MSPs, including customers generally, we need to make sure that our permissions that we set for our customers are accurate relevant for the roles that they're in and securing the data that's in place in that environment. So that might include utilizing sensitivity labeling on a manual level for key critical data, restricting for file repositories, document libraries. It doesn't use elevated access and as I've put in point number two, it doesn't bypass permissions.

So it'll only ever use what controls you put in place in the first place and that's really critical to note. So talking about the sources used by Copilot again I'm using graph but it is Work IQ as of Microsoft Ignite.

So you can tell I put these slides together before then. It's a core connectivity layer across all the services. Graph is used not just for what Copilot uses but it's for us as MSPs when we start filtering it's what inforcer uses when we start to push out policies we connect to the graph API and then we make changes to that environment it also has access to sharepoint on one drive so it's that documents file collaborative content it has the ability to view those sources utilizing the graph it's connected to your own outlook and teams so your ability to communicate it can see your chats your messages, your meetings, your communication.

So, it really allows us to kind of start asking questions directly at chat Copilot, sorry, not ChatGPT, but allows us to start looking at Copilot and we're making requests for things that perhaps we can't see. And you'll see my last point on number four, it's extended apps. So, it's also linked to other products within Microsoft that perhaps we don't use day-to-day. And one of the things I'm a big lover of is Microsoft Loop. So whenever I'm looking for a document or information, I would normally just search and it will pull up loads of links and requests, points, point of confirmation, areas I'm looking at.

When you do a search, it will search everything, not just the foundational name, document title, or the subject line of an email. It actually looks at all the internal data across those files or within that email. So it can start to produce true information it's looking for. And I guess it's important to understand what it doesn't use. So it doesn't use private inboxes without permission. So unless it's you as an individual or permissions of folders you already have access to, it can't access anything more.

Other user files, unless you have direct access to it, maybe it's through a shared link for example, it's out of bounds. It's not accessible. The other thing is data outside of the Microsoft 365 tenant. So unless we've got specific connectors in place, elements that we've configured, perhaps it's a Copilot agent with a workflow, it doesn't connect to outside data without those configurations in place. And it doesn't do random internet sources unless it's specifically enabled and configured to do so.

We can really lock down Copilot to just internal data management. And that really helps when we talk about using it for the better good for using it for our best practices using it internally to be more efficient. So I want to talk about why Copilot is deemed as safe. I know I've spoken about this previously but these are kind of the key areas to think about. It's zero trust access. So no permission elevation as I've said before.

There's no bypassing existing security controls. And it's identity-driven access every time.

Every time there's a request, every time you create a prompt, there's always identity driven access. It will review what the permissions are based on your access using those five foundations I mentioned earlier. It's tenant boundary data never moves outside of your tenant. It's enterprise grade identity via entry ID ensures that isolation, ensures that lock down and configuration. And that's why I think Copilot for business is an interesting topic to discuss further. That's not one for now, but that is allowed it's allowing us to use Copilot for business or Copilot in other SKUs that perhaps don't have that enterprisegrade identity protection using business standard as an example.

It uses security defaults, but it doesn't have those additional layers of best practice security improvements around conditional access. The other area is compliance by design. It's fully audited in the 365 environment. We all as all know that there's Microsoft purview. The integration there is available. It works towards governance and compliance. Anything that Copilot is doing from prompt requests from what it's searching for. All of that is audited. It's logged within purview, it's available for us to look at and review and manipulate the data.

Well, not manipulate but look at the data, do e discoveries and identify more information. Microsoft more recently have got data security posture management. It's also got DMPS for AI. These are things that allow us to kind of really go to town and do those auditing audits andformational pieces. The other area is training separation. Your data is not used to train foundational models like ChatGPT as an example. If you purchase any version, even the free, it's by default turned on to do training separation.

And so it will take information from the data you're processing and take snippets and retrain the foundations of the models so that it could become more fluid better practice really focusing on those that kind of growth model and it's a safety systems first process content filter through the Microsoft safety system. It's focused on those filters I demonstrated earlier. Zero trust access, identity protection, don't bypass the security or permission elevation that's in place. You are stuck with or Copilot is stuck with permissions that you've granted it specifically.

Common misconceptions I think is a really important topic.

Copilot can access everything. It's not true. It can only access what the user can access. Permissions are strictly enforced. Copilot is ChatGPT enterprise data is separated and I think this is really important to note ChatGPT is internet model based it's available on the web open AI although the model that's used for Copilot is also part of open AI GPT4 5 for example it's enterprise restrictive it's stuck within the tenant you're looking at Copilot uses Microsoft graph not the public internet when it's searching for data that's in there like I said we can outsource that information elsewhere, but it's focused on internal data management.

Pop- pilot will leak sensitive information. Reality is, yes, it can. And it and it will do if you haven't got the right permissions in place, but you don't put the right security and policies in place to protect sensitive information. And that's where the reality sensitivity labeling, data loss prevention, and permissions prevent the exposure. There is a possibility when someone starts a free trial of Copilot that they have access to things they shouldn't have access to and that's so important for us as MSPs and for customers globally we need to focus on what we can implement for that protective measure oversharing permissions is a long conversation of best practice it takes time for us to resolve permissions and make sure they're up to date we can get a point in time screenshot of a permissions matrix of what's going on in SharePoint and remediate them.

But longterm, it's difficult to keep on top of. Utilizing sensitivity labeling and data loss prevention adds an additional security foundation, a governance foundation that we can protect sensitive information. So with data loss prevention, we can configure identification trainable classifiers around specific information for a business, an industry that locks down that sensitive information, preventing Copilot from taking that information out. Same applies with sensitivity labeling. It will not look at documents with a label on if you as an individual don't have permissions to that label.

So again, we're adding layers of security and data governance to protect the leaking of sensitive information. And the last thing is Copilot works outside out of the box. The answer is it does. But it's really important as an MSP specifically that we tackle your data, your structure, your governance and your preparation. And that's where Copilot readiness comes in. Are our businesses ready to adopt Copilot? The assessment engine that's available in inforcer for Copilot readiness really highlights those concerns.

Are we ready? Yes or no? We can start to tackle those kind of comments and descriptions. Your data must be structured, governed and it has to be ready. And that statement is rings so true when we look at using AI within a business.

So I want to talk about real use cases productivity summarize emails and teams chats. We absolutely can make life easier. We want to make sure that we are utilizing it to the best that we can. And under productivity, there's lots that we can do. Rewrite, format content, create tables, lists, and comparisons for us. Copilot has the capability to do all of this for us. Streamlining presentations. How do you think I created this wonderful 15 slide PowerPoint presentation, Copilot certainly assisted there's no doubt about it.

With some changes to some wording, understanding the conversations we have, we can speed up our productivity so we can start these sort of presentations, communications, emails, summarize what we're doing. If we're missing a team's meeting, again, we can get Copilot to summarize the key facts, provide me five bullet points, for example. Other areas that are also useful is operational. So analyzing sales data quickly. If you're utilizing Dynamics for example, the latest Copilot integration allows us to analyze information quite rapidly.

It plugs into and connects to other elements like HubSpot and other platforms are available. Extracting insights from reports. So Power BI or a report that's been created by someone, we can generate information from that and extract it. So it's useful content for us. I mentioned this already under productivity, but generating meeting recaps. If you're running late to a meeting, you need to know what's going on. Drafting knowledge based answers I think is a real useful productivity solution or operational solution around the MSP and our service desk team is being in those meetings having them recorded and drafting knowledge based articles or answers that help us as an MSP and our engineers become more efficient in adopting and resolving issues perhaps on a ticket level.

This is a real use case for MSPs as much as other customers. And then MSP applications are kind of listed out because this is kind of aimed at the MSP model is faster policy framework drafts. You know, how do we speed up when we're creating policies for our customers? Perhaps this is a regulation we're following. We can essentially take a template of a policy, update it to reflect someone's information or a business's information and draft these things far quicker than we have done before.

Quicker documentation creation, as I said earlier, the ability to go into Copilot and say, I've just completed this ticket. This was the problem. This was a fix. Create my step-by-step guide so I can publish this into my documentation company it grew Jira's platform confluence there's the opportunity to kind of speed up that kind of quicker documentation creation incidents summaries and alerts is another hot topic creating information and pulling information from perhaps meetings that you've had with customers going through incidents that have taken place having those summaries really help for us to speed up problems that have occurred.

If we've plugged Copilot incorrectly to our kind of PSA environment, ticketing solutions, we can also generate client ready reporting with Microsoft Copilot and workflows and Copilot agents, workflow agents, sorry. The ability to connect to different platforms and pull information using the APIs that are freely available in most PSA environments bright gauge as well connect wise service now and so on we can start to use Copilot agents to generate client ready reporting and I think from kind of 2026 onwards this is going to be really relevant to MSPs how can we start automating reports automating the information that's relevant for a security side and the perspective enforce or offers really good kind of assessment reporting.

So actually we can start ticking these boxes already without necessarily the need for Copilot directly. So I guess talking about recommended requirements some of this has certainly changed more recently but license requirements are fully available.

So with business premium we can have Microsoft 365 Copilot as well as Copilot for business from the 1st of December. Microsoft are doing the best they can and apologies this slide is probably not quite up to date. But we're Microsoft are going down the route of giving everyone the ability to start using AI where possible and I just want to talk about the top right hand corner of technical preset prerequisites. These are recommended. It's not enforced.

It's a recommendation but modern authentication. We need to block legacy authentication Intune for device management. I think this is underrated when we talk about using Copilot any AI full stop. We need to be able to secure where that data is being fed. If Copilot is available for us to use in any platform on any device, we're making our data and our exposure much larger than it needs to be and we can containerize that with device management.

Zero trust using conditional access. So let's restrict what people can do outside and the conditions that we're allowing Copilot to manage. Exchange online configured securely probably should say dependent for office but let's start locking down how we manage our exchange environment of data that's being processed. SharePoint online archiving I think is a huge topic. SharePoint online in an active state and archiving. We need to be managing our data and this is where hygiene comes into play.

How do we secure Sharepoint with sharing and external access? How do we also make sure it's locked down in an appropriate manner? The last area I want to talk on is one drive being properly deployed. We need to make sure we have the right controls and utilizing products like inforcer to standardize best practices around Copilot readiness. That Copilot readiness report that's available really allows us to identify areas of improvement, technical readiness before we start adopting Copilot for customers.

It's the journey we take companies on. So it t must be AI ready. And there's seven points I wanted to raise. Emission cleanup, absolute must, critical in some instances. Sensitivity labeling, it's recommended. I would definitely encourage us to start using it for key classified sensitive data. It's available with the premium SKU. There's no reason why we can't. It's just not automated. Data loss prevention. Everyone should probably already have a DRP policy when it comes to GDPR.

Other regulatory policies around EU and the US data loss prevention policy should be implemented across the board regardless and using inforcer you can speed up that process by selecting those predefined DRPs and pushing them to your customers external sharing being limited to control monitor the external aberration is a huge thing when we talk about protecting and utilizing a Copilot we look towards data management and data governance And this sits with BI readiness. Are we protecting our data appropriately when it comes to external sharing?

I would say probably not shadow IT controlled monitor and manage unapproved applications is a huge hot topic when we talk about protecting data and as much as clile is there and manages with over permission over permissioning. We also need to make sure shadow it is protected where possible. Teams governance, reducing the sprawl and enforcing life cycle policies. We don't need loads of team sites and teams accounts. And we should be restricting those and controlling them.

And again, simple tick boxes like preventing users from creating Microsoft 365 groups resolve these hot topics quite quickly. And then a permission audit. We should be doing a matrix and reviewing where permissions sit. That over permission piece is huge. Copilot amplifies the state of your data. The messy data is a messy Copilot. Secure data is a secure Copilot. And I think that critical insight statement really rings true when we look at data posture, data management moving forward.

It's absolutely vital. So talking about how MSPs can kind of generate a revenue. I like to think that whenever we work in MSPs, we need to do revenue streams. Whenever we're supporting a service or a customer, revenue streams are really important. And this comes down to areas we should be focusing on. AI readiness assessment is a topic, a hot topic. Talking people through are they ready to adopt AI generally Copilot or alike? Is that possible?

And again, I think it rings true with the Copilot readiness assessment with inforcer. That's the monetization. It's an opportunity to sell a service. Data governance and projects. I think it's a journey we take people on.

I think when we look at governance, it's becoming a governance as a service when we start that new journey with customers. SharePoint teams cleanup, sensitivity, labeling, deployments, all these topics you see in front of you. These are all revenue streams we can consider. Copilot on boarding workshops, training people. These are costs. We don't do them for free for customers. They're projects that are available for us to do. Governance of the services we're going to be doing for a long time.

And I think this is going to be an opportunity for us to kind of work out where we can generate that revenue. Clients want Copilot. They aren't ready for it. And it's us as MSPs that can bridge that gap. And again, great statement, 100% true. It's going to be down to us to kind of bridge the gap on making sure customers are ready or as ready as they can be. So I want to talk briefly around how inforcer is going to help is AI readiness audits.

We have that available. The Copilot readiness assessment is available. Data loss prevention 100% in place.

You can predefine your data loss prevention policies and then push them out to your customers. Sensitivity labeling is absolutely available with inforcer. It's been there for the last well since December 2025. It's available for you guys to use. Baseline management. We talk so much around best practices and security. And I don't think it's any more of a topic of we should do. It's something we have to do. It's something we should already be doing is enforcing best practices and standards which we don't currently do.

Drift detection. Another really important topic. Post deployment. We want to be able to monitor changes made to an environment, violations on policies, is someone making a change when they shouldn't be. As an MSP, we need to know about it. And the last thing that I really like that inforcer really offers is client reporting, the ability to report in a way that kind of rings true and shows proactive measures for an MSP. This can be done with inforcer.

So, inforcer makes AI governance measurable, auditable, and more importantly, repeatable. We can scale this at mass for the clients we have, but we can only do that if they're fully on boarded. The ability to see them in a single pane of glass with a multi-tenant management solution. And that's it guys. Thank you so much for your time. Look out for the next episode. Copilot isn't magic. So we want to go through the next steps, the mathematics, the governance around it and what Microsoft Graph or Work IQ is really doing.

So we listen into the next