Copilot in Excel

Most people who tell me Copilot in Excel is useless are half right.

It is useless — on their spreadsheet. Because their spreadsheet is a tangle of merged cells, blank rows, and a title floating in cell A1.

They open the Copilot pane, ask a question, get a shrug, and write the whole thing off as hype.

That’s not a Copilot problem. That’s a data problem.

Here’s the part nobody tells the client. Copilot in Excel only reads structured data. Fix the structure and the same “useless” tool answers everything you throw at it. The fix takes about ten seconds.

What is Copilot in Excel, really?

Forget the demos where someone conjures a dashboard out of thin air. Day to day, Copilot in Excel does four ordinary jobs, and does them well.

It summarises a table. It writes a formula column for you and explains how it works. It highlights, sorts and filters on request. And it flags trends or outliers you’d otherwise have to eyeball.

Notice what’s on that list? Nothing exotic. These are the things your clients already do by hand, slowly, every single week.

The catch is the layout. Copilot needs the data set out so it can read it. Microsoft is blunt about this — your data has to be an Excel table or a clean supported range, as spelled out in Format data for Copilot in Excel. One header row. Headers on columns only. No merged cells. No subtotals baked in. No blank rows cutting the data in half.

Give it a table and it flies. Give it a “report” with a logo in A1 and three blank rows for spacing, and it just stares back.

Step-by-Step: getting Copilot to actually answer

Save the file to the cloud

Copilot only works on files saved to OneDrive or SharePoint with AutoSave turned on. A workbook sitting on the desktop gets you a greyed-out button. File > Save a Copy > OneDrive, and AutoSave flips on by itself.

Turn your data into a table

Click any cell in your data. Press Ctrl+T. Confirm the “My table has headers” box. That’s it.

That one step fixes more “Copilot doesn’t work” complaints than everything else I show people combined.

Open the Copilot pane

The Copilot icon lives on the Home tab, far right of the ribbon. Click it and the pane slides in from the right with a few starter prompts. The official Get started with Copilot in Excel page is a tidy thing to hand a client here.

Ask once, specifically

This is where people fumble. They type “summarise this” and get mush. Be specific about the column and the goal:

Add a column that flags any order in the Total column over 5000 as "Review", and explain the formula.

Notice what’s in that prompt? A named column. A clear rule. A request to explain. That’s the whole difference between a useful answer and a coin toss. Ask once, but ask properly.

Why this actually changes behaviour

Here’s the real win, and it isn’t the formulas.

For years the gap between a spreadsheet and an answer was Excel knowledge. XLOOKUP, pivot tables, nested IFs — the stuff that lives in the head of one person in the office and nowhere else.

Copilot closes that gap. The person who knew the question but not the syntax can now just ask.

“But won’t it get things wrong?”

Yes. It will. Microsoft says so plainly in their Copilot in Excel FAQ — read what it writes, check it, then accept it. Treat it like a sharp junior who’s fast but needs reviewing. You wouldn’t ship a graduate’s first draft unread either.

And that review habit is the part worth teaching. Copilot doesn’t replace judgement. It removes the typing between you and the judgement.

If you look after SMB clients, this is a five-minute conversation that pays for itself. Most of them are already paying for the Copilot licence and getting nothing from it in Excel — because their data was never structured for it.

Show them Ctrl+T. Show them one good prompt. Watch the lights come on.

If you’re not showing your clients this, you’re leaving value on the table that they’re already paying for.

Copilot in Excel isn’t there to make people better at Excel. It’s there to make Excel skill stop being the thing that holds them back.

Has Microsoft Made Copilot Cowork Too Expensive and Too Hard to Use for SMB?

A lot of SMBs think their AI journey starts by buying more AI.

I think that’s the wrong place to start.

Over the last few months I’ve spoken to plenty of SMBs and MSPs who are excited about Microsoft Copilot, curious about Copilot Cowork, and interested in agents. Then they see the pricing model, hear the term pay-as-you-go, start looking at consumption costs, and immediately become nervous.

I don’t blame them.

The real question isn’t whether Copilot Cowork is good. The question is whether Microsoft has made it too expensive and too complicated for the average SMB to realise value from it.

And right now, I think there’s a genuine argument that they have.

Technology should remove friction, not introduce it.

What is Copilot Cowork, really?

Forget the product names for a moment.

Copilot Cowork is essentially Microsoft’s way of allowing AI experiences to go beyond the capabilities included in your existing Microsoft 365 subscription.

That can mean accessing additional AI services, consuming AI-powered workflows, running agents, or using capabilities that incur usage-based costs rather than being covered under a fixed licence.

The attraction is obvious.

You only pay for what you use.

The problem is that most SMBs have spent the last twenty years moving away from unpredictable IT costs. Fixed monthly subscriptions made budgeting easier. Consumption billing moves the conversation in the opposite direction.

That’s where things start getting uncomfortable.

“Isn’t this just cloud pricing all over again?”

In many ways, yes.

The difference is that AI usage can be harder for business owners to understand than storage, mailboxes or virtual machines.

Step-by-Step: Getting Value Before Paying More

Review the Copilot Features You Already Have

Open the Microsoft 365 apps your users work with every day.

Look at the built-in Copilot experiences already available in products such as Edge, Outlook, Teams and Microsoft 365.

Microsoft continues to expand these capabilities, often without organisations fully realising what’s already included.

You can learn more from https://learn.microsoft.com/microsoft-365/copilot/microsoft-365-copilot

Enable Microsoft 365 Copilot Chat

Navigate to:

Microsoft 365 App > Copilot

Many organisations still aren’t getting consistent value from Copilot Chat, despite it being available to users.

If your staff aren’t regularly using Copilot Chat, adding more AI services is unlikely to solve the problem.

Identify Repetitive Business Processes

Look for activities that happen repeatedly:

Status reporting
Meeting preparation
Policy summarisation
Document review
Knowledge retrieval

These are usually the areas where AI can provide immediate value.

Microsoft’s adoption guidance is available through https://learn.microsoft.com/microsoft-365/copilot/adoption/ adoption resources.

Measure Usage Before Expanding

Use the reporting and administrative tools available within Microsoft 365 to understand whether users are actually engaging with Copilot.

Many organisations skip this step entirely.

They purchase AI licences first and measure value later.

That’s backwards.

Introduce Consumption-Based Services Carefully

Only after people are regularly using the AI capabilities already available should you consider broader AI consumption models.

If you do move forward, make sure you understand how billing controls and cost management work.

Microsoft provides additional information through https://learn.microsoft.com/microsoft-365/copilot/microsoft-365-copilot-page.

Why this actually changes behaviour

The biggest issue isn’t price.

It’s uncertainty.

SMBs don’t generally object to paying for technology that creates value.

They object to paying for technology when they can’t predict what the bill will be or explain what they’re getting in return.

That’s an adoption problem, not a technical problem.

Copilot Cowork asks organisations to think differently about AI consumption. That’s understandable from Microsoft’s perspective, but it introduces complexity at a time when many SMBs are still trying to establish basic AI habits.

Notice what’s missing?

People.

If users aren’t actively incorporating AI into their daily workflows, no pricing model will save the deployment.

My recommendation?

Use every Copilot capability already included in Microsoft 365 first.

Build habits.

Measure outcomes.

Identify repeatable wins.

Only then move toward consumption-based AI services.

Copilot doesn’t get tired. Use that.

But don’t pay for more AI until you’ve proven the value of the AI you already have.

The real opportunity isn’t buying more AI.

It’s getting more value from the AI you’ve already paid for. If you’re not showing clients this, you’re leaving value on the table.

The Browser Is Becoming Part of the Conversation

The more I use Copilot Cowork, the more I realise that the interesting part isn’t the AI itself. It’s what happens when the AI can finally interact with the same systems I use every day.

For years we’ve talked about AI helping us write documents, summarise meetings and draft emails. Useful? Absolutely. But most work doesn’t stop there. Sooner or later you need to log into a website, update a portal, retrieve information from a dashboard, or complete a process that lives inside a browser window.

That’s why the addition of local browser use in Copilot Cowork has caught my attention.

The Gap Between Advice and Action

One of the frustrations I see with AI tools is that they often stop at recommendations. They’ll tell you what to do, but they won’t actually do it.

Think about a typical day. You receive an email asking for an update. You find the relevant Teams conversation. You look through a SharePoint document. You then log into a service portal to check the current status before replying.

The work isn’t creating the email. The work is gathering the information across multiple locations and then taking action.

What browser use starts to do is close some of that gap.

Instead of simply suggesting a next step, Cowork can potentially navigate the website on your behalf while remaining inside the flow of the conversation. That changes the relationship between the user and the tool. You’re no longer just asking questions. You’re delegating pieces of work.

The Real Opportunity for SMBs

When I talk with SMBs and MSPs, one common theme emerges. Many important business systems don’t have polished integrations or APIs.

There are customer portals, supplier websites, expense systems, training platforms and countless line-of-business applications that still require someone to open a browser and manually complete a task.

That’s the reality of most small businesses.

Imagine asking Cowork to collect information from a supplier portal, compare it against a spreadsheet in Excel, create a summary in Word and then draft an Outlook email ready for review.

The value isn’t that any individual step is difficult. The value comes from reducing all the switching between systems that quietly consumes large portions of the day.

Every context switch has a cost. Most people simply don’t notice it because they’re so used to doing it.

Human Control Still Matters

Of course, this isn’t a licence to let AI loose across every system without oversight.

One thing I appreciate about Microsoft’s approach is that the browser session remains connected to the user’s identity and permissions. The AI is working with the same access the user already has rather than operating as some separate privileged account.

That’s important.

The future of workplace AI isn’t about removing people from the process. It’s about putting people higher in the process.

I see the role shifting from operator to supervisor. Instead of spending ten minutes navigating through screens and forms, you’re reviewing work, making decisions and approving outcomes.

The keyboard becomes a little less important. Judgement becomes more important.

What I’m Watching Next

I suspect many people will initially view browser use as a novelty. They’ll try a few demonstrations and move on.

I think that misses the bigger story.

The real significance is that Copilot is gradually moving beyond content creation and into work execution. The ability to interact with websites, applications and business processes starts to make the assistant feel less like a chatbot and more like a digital team member.

We’re still in the early stages, and I’d encourage organisations to test it carefully and deliberately.

But every major technology shift starts with a small behavioural change.

For me, that change is simple.

When I open a browser now, I’m increasingly asking not “What can I do here?”

I’m asking, “What can I hand off instead?”

How to Enable Browser Use in Copilot Cowork

Before users can take advantage of Browser Use, there are several prerequisites that must be met. According to Microsoft’s documentation, Browser Use is disabled by default and requires administrator configuration before users can access it. [learn.microsoft.com], [learn.microsoft.com]

Step 1: Enable Copilot Cowork

Browser Use relies on Copilot Cowork being available to users. As an administrator:

Sign in to the Microsoft 365 Admin Center.
Navigate to Copilot.
Open Cost Management.
Configure usage-based billing.
Assign access to the users who will use Copilot Cowork.

If usage-based billing hasn’t been configured, users won’t be able to access Cowork features. [learn.microsoft.com]

Step 2: Enable Browser Access

Once Cowork is available:

In the Microsoft 365 Admin Center, go to Copilot.
Select Settings.
Choose View all.
Locate the Cowork settings.
Turn on Allow browser access.
Save the changes.

Microsoft notes that Browser Use is turned off by default and must be explicitly enabled by an administrator.

Step 3: Verify User Requirements

Each user must meet the following requirements before Browser Use will work:

Have a Microsoft 365 Copilot licence assigned.
Have access to Copilot Cowork.
Have Microsoft Edge installed.
Be running a current version of Edge.
Be signed into Edge using the same work or school account used for Copilot.
Use Cowork in a supported browser experience rather than an unsupported client. [learn.microsoft.com]

Step 4: Launch Copilot Cowork

The user can then:

Open Microsoft 365 Copilot.
Launch Copilot Cowork.
Enter a request that requires interaction with a website.

For supported tasks, Cowork can use a hidden Microsoft Edge session running on the user’s device to interact with websites and web applications whilst keeping the user within the Copilot conversation experience. [learn.microsoft.com]

Step 5: Accept First-Run Consent

The first time Browser Use is invoked, users are presented with a consent prompt explaining:

Browser Use is currently in preview.
The feature can perform actions on the user’s behalf.
AI-generated actions may not always be perfect.
Sensitive actions may still require user confirmation.

Users must accept this prompt before Browser Use becomes available.

Step 6: Start with Low-Risk Scenarios

My recommendation is to begin with simple information-gathering tasks rather than business-critical transactions. Good examples include:

Looking up information in customer portals.
Checking ticket or order status.
Gathering information from vendor websites.
Researching data across multiple web-based systems.

As confidence grows, organisations can gradually expand usage to more complex workflows. This allows users to understand where the technology adds value while maintaining appropriate oversight.

If the process needs assistance while browsing it will pause and you will see something like:

Practical Tip: If Browser Use isn’t working, check the basics first. In my experience the most common causes are that Cowork billing hasn’t been enabled, Browser Access hasn’t been switched on by an administrator, or the user isn’t signed into Microsoft Edge with the same account they use for Copilot. [learn.microsoft.com]

Stop Azure Billing Surprises: How to Set Up Budget and Cost Alerts for Copilot Chat, Copilot Cowork and Azure AI

One of the biggest concerns I hear from people experimenting with Microsoft Copilot, Copilot Cowork, Azure AI Foundry, Azure OpenAI and other Azure services is:

“How do I stop unexpected Azure charges?”

This concern is becoming even more important as more Microsoft AI services move to a consumption-based pricing model. Features such as Copilot Cowork can consume Azure resources behind the scenes, and without monitoring in place, costs can creep up before you realise it.

The good news is that Azure provides built-in tools to help you stay in control. With about 10 minutes of configuration, you can create budget alerts and anomaly detection that will notify you before costs become a problem.

Here’s how I recommend every Azure user configure cost controls.

Why This Matters

Many Azure services charge based on usage. Examples include:

Microsoft 365 Copilot PAYG features
Copilot Cowork
Azure AI Foundry
Azure OpenAI
Azure AI Search
Virtual Machines
Storage services
Networking services

The danger isn’t usually the individual cost. The danger is forgetting something is running or not noticing a new workload starts consuming more resources than expected.

A few simple alerts can provide an early warning long before a large bill arrives.

Step 1: Create a Monthly Budget

Start by opening the Azure portal and navigating to:

Cost Management + Billing
→ Cost Management
→ Budgets

Select:

+ Add

Configure the Budget

Enter a meaningful name such as:

Monthly Azure Budget

Choose:

Reset Period = Monthly

Set the start date to today or the first day of the current month.

Now decide on a budget amount.

For most users I suggest:

AU$50 for light experimentation
AU$100 for regular testing
AU$200 for heavier AI workloads

If you’re just getting started with Copilot Cowork or Azure AI services, AU$100 per month is a sensible starting point.

Click Next to configure alerts.

Step 2: Create Budget Alerts

Budget alerts notify you when your spending reaches specific percentages of your budget.

Rather than waiting until you hit the limit, configure several warning levels.

Alert 1

Create:

Type: Actual Cost
Threshold: 50%

If your budget is AU$100 you’ll receive an alert at AU$50.

Alert 2

Create:

Type: Actual Cost
Threshold: 75%

You’ll receive an alert at AU$75.

Alert 3

Create:

Type: Actual Cost
Threshold: 90%

This provides a final warning before reaching your budget.

Alert 4

This is the most important alert.

Create:

Type: Forecast Cost
Threshold: 100%

Forecast alerts use Azure’s spending predictions.

This means Azure can tell you:

“At your current spend rate, you’re likely to exceed your budget before the end of the month.”

This often gives you warning before you actually spend the money.

Configure Email Notifications

For each alert enter your email address:

admin@yourdomain.com

You can add multiple recipients if needed.

Unless you’re planning advanced automation, leave:

Action Group = None

Email notifications are sufficient for most users.

Once all four alerts have been configured, create the budget.

Step 3: Configure Cost Anomaly Alerts

Budget alerts are excellent for gradual overspending.

However, they won’t necessarily detect sudden spending spikes.

That’s where anomaly alerts come in.

Navigate to:

Cost Management + Billing
→ Cost Management
→ Cost Alerts

Select:

+ Add

Configure the Alert

Choose:

Alert Type = Anomaly

For the view select:

Daily anomaly by resource group

This tells Azure to look for unusual spending patterns across your subscription.

Configure the Notification

Use a descriptive subject such as:

Cost anomaly detected in Azure subscription

Add your notification email address:

admin@yourdomain.com

Optionally enter a custom message such as:

Review Azure spending immediately and investigate the source of the anomaly.

Create the alert.

How Anomaly Detection Helps

Imagine your Azure environment normally costs:

AU$2 per day

Then one day:

A GPU virtual machine is left running
An Azure AI deployment starts processing large workloads
Azure AI Search is accidentally overprovisioned
Copilot-related services begin consuming significantly more resources

Azure notices the unusual increase and generates an alert.

Instead of discovering the issue weeks later, you’ll know almost immediately.

Step 4: Identify What Is Actually Spending Money

Once alerts are configured, the next step is understanding where your money is going.

Open:

Cost Management
→ Cost Analysis

Change:

Group By = Resource Group

to:

Group By = Resource

This simple change provides much more useful information.

Instead of seeing:

copilot-rg

you’ll see the actual resources generating costs such as:

Azure AI Search
Storage Accounts
AI Deployments
Virtual Machines
Managed Disks
Public IP Addresses

This makes troubleshooting much easier.

Step 5: Don’t Forget Compute Services

The most common cause of unexpected charges is running compute resources.

Pay particular attention to:

Virtual Machines
Azure AI Foundry deployments
Azure AI Search services
GPU resources
Azure OpenAI deployments

Where possible, enable automatic shutdown on virtual machines and remove unused resources.

Final Thoughts

The rise of AI services such as Copilot Cowork means more organisations will encounter consumption-based Azure costs. That’s not a reason to avoid these tools. It simply means spending should be monitored in the same way we monitor security, backups and availability.

The combination of:

Monthly budget alerts
Forecast alerts
Cost anomaly detection
Regular cost analysis reviews

provides an effective safety net for most users.

If you’re experimenting with Copilot Cowork, Azure AI Foundry or any other Azure AI services, I strongly recommend configuring these controls before you start serious testing. A few minutes of setup today can save a lot of surprises at the end of the month.

Use What You Already Have Before Paying for More Copilot

One of the things I’m seeing more often now is organisations enabling Copilot Cowork PAYG and then wondering where the consumption costs are coming from.

The assumption seems to be that every AI interaction needs to go through Copilot Cowork and every task needs an agent.

It doesn’t.

In fact, many Microsoft 365 users already have AI-powered tools sitting in front of them every day that don’t require PAYG consumption at all.

That’s the part many people miss.

The conversation shouldn’t start with “Which AI should I use?”

It should start with “What have I already paid for?”

If you’re not showing clients this, you’re leaving value on the table.

What are the included Microsoft 365 Copilot tools, really?

When most people hear “Copilot”, they immediately think about the chat interface.

That’s only one option.

Microsoft has been embedding AI capabilities throughout Microsoft 365 for years. Features such as Outlook Draft with Copilot, Teams meeting recap, PowerPoint Designer, Editor, transcription, summaries, coaching and intelligent suggestions are already available through various Microsoft 365 subscriptions.

What makes these valuable is that they’re integrated directly into the workflow people already use.

There’s no prompting.

There’s no agent configuration.

There’s no additional consumption model to monitor.

You simply use the feature where the work already happens.

“Isn’t this just a cheaper version of Copilot?”

No. It’s often a more appropriate version of Copilot.

The goal isn’t to generate more AI activity.

The goal is to get better outcomes.

Meet people where they already are.

Step-by-Step: Start with Included AI Features First

Review your Microsoft 365 licensing

Open:

Microsoft 365 Admin Center > Billing > Your products

Before enabling PAYG services, understand exactly what capabilities are already included in your existing licences.

Microsoft regularly updates included features, so it pays to check first.

You can review licence capabilities through the Microsoft Learn documentation for Microsoft 365 Copilot plans and Microsoft 365 subscriptions.

Enable transcription and meeting intelligence

Open:

Teams Admin Center > Meetings > Meeting policies

Many organisations pay for AI-generated summaries while simultaneously disabling transcription.

That makes no sense.

Features such as transcripts, intelligent recap and meeting search often deliver immediate value without users needing to learn anything new.

Microsoft documents these capabilities in Teams meeting recap.

Use Outlook drafting and coaching features

Open:

Outlook > New Email > Draft with Copilot (where available)

Measure before enabling PAYG

Open:

Microsoft 365 Admin Center > Reports

Look at actual adoption.

Who is using the included features?

What problems are being solved?

What tasks genuinely require a custom agent or consumption-based AI service?

Only after answering those questions should additional AI expenditure enter the discussion.

Why this actually changes behaviour

The biggest challenge with AI isn’t usually technology.

It’s habit.

People live in Outlook.

People live in Teams.

People live in Word.

The closer AI gets to those locations, the greater the chance it will actually be used.

That’s why I encourage clients to focus on workflow before features.

A custom agent that nobody uses is not innovation.

It’s a cost centre.

Notice what’s missing?

Prompt training.

Agent management.

Consumption monitoring.

Complex governance discussions.

Those things still matter, but they shouldn’t be the starting point.

My recommendation?

Get users comfortable with the AI capabilities they already have access to first.

Then identify the gaps.

Then determine whether Copilot Cowork PAYG or custom agents genuinely solve a business problem worth paying for.

Too many organisations are starting at the wrong end of the conversation.

Copilot doesn’t get tired. Use that.

But don’t pay for AI to solve a problem that’s already been solved by tools sitting in your Microsoft 365 subscription today.

The real opportunity isn’t more AI.

It’s getting more value from the AI you’ve already paid for.

If You’re Worried About Security, Should You Even Be Doing AI?

The people most concerned about AI security are often the people who should be using AI first.

That sounds backwards, but hear me out.

I still meet organisations that have effectively banned AI because someone raised concerns about data leakage, privacy, compliance or intellectual property protection.

Meanwhile, staff are already using AI on personal devices, free online tools and consumer accounts completely outside corporate visibility.

That’s not security.

That’s avoidance.

The better question isn’t whether you should use AI.

The real question is whether you’re prepared to manage it properly.

What is AI security, really?

Many people think AI security is about stopping users from accessing AI tools.

I think that’s an outdated view.

AI security is about controlling how organisational data is accessed, processed and governed when AI becomes part of everyday work.

Notice what’s missing?

The AI itself.

The same principles we’ve applied to email, file sharing, Teams, SharePoint and mobile devices now apply to AI. Identity matters. Permissions matter. Data classification matters. Monitoring matters.

The organisations that already have these foundations in place are often much better positioned for AI adoption than they realise.

“Isn’t this just another technology that introduces risk?”

Every technology introduces risk.

Email introduced risk.

Cloud services introduced risk.

Mobile devices introduced risk.

The objective has never been to eliminate risk. The objective has always been to manage it.

Step-by-Step: Preparing Microsoft 365 for AI

Review Your Permissions

Open:

Microsoft 365 Admin Centre > Reports > Usage

and

SharePoint Admin Centre > Active Sites

Look for locations that contain sensitive information and identify who has access.

AI doesn’t magically create new permissions.

It simply makes existing permissions more visible and more useful.

If everyone can access everything today, AI will expose that problem faster.

Check Sharing Settings

Open:

SharePoint Admin Centre > Policies > Sharing

Review whether users can create anonymous sharing links or share broadly outside the organisation.

Many organisations discover their biggest security exposure has nothing to do with AI.

It’s uncontrolled sharing.

Microsoft provides useful guidance in its documentation on https://learn.microsoft.com/sharepoint/modern-experience-sharing-permissionsSharePoint sharing and permissions.

Classify Important Data

Open:

Microsoft Purview Portal > Information Protection

Apply sensitivity labels to important content.

Start simple.

Financial information.

Client information.

HR records.

Commercial agreements.

You don’t need a hundred labels.

You need a handful that people will actually use.

Microsoft provides detailed guidance on https://learn.microsoft.com/purview/sensitivity-labelssensitivity labels.

Configure Data Protection

Open:

Microsoft Purview Portal > Data Loss Prevention

Create policies that prevent sensitive information being shared incorrectly.

Think of this as putting guard rails around the business rather than trying to control every individual action.

A good starting point is Microsoft’s guidance on https://learn.microsoft.com/purview/dlp-learn-about-dlpData Loss Prevention.

Monitor and Improve

Open:

Microsoft Purview Portal > Audit

Review activity regularly.

Look at what users are doing.

Look at sharing behaviour.

Look at data movement.

Security isn’t a project.

It’s an ongoing discipline.

Why this actually changes behaviour

This is where I think many organisations miss the opportunity.

AI doesn’t just increase productivity.

It exposes operational weaknesses.

If permissions are messy, AI highlights it.

If data governance is weak, AI highlights it.

If information is scattered everywhere with no ownership, AI highlights it.

That’s a good thing.

For years, many businesses have accumulated technical debt around information management because users could only find information if they knew exactly where to look.

AI changes that equation.

Suddenly information becomes discoverable.

Suddenly forgotten files become valuable.

Suddenly people start asking questions about why certain information is available to everyone.

Those are all governance conversations that should have happened years ago.

AI isn’t creating new security problems as much as it’s revealing existing ones.

That’s an important distinction.

Visibility drives accountability.

The organisations seeing the best outcomes are not necessarily the ones with the biggest security budgets.

They’re the ones with the best operational habits.

Permissions are reviewed.

Data is classified.

Sharing is controlled.

Access is monitored.

Those practices were valuable before AI.

They’re even more valuable now.

Copilot doesn’t invent information. It works with what you’ve already allowed people to access.

That’s one reason I encourage organisations to start their AI journey even when they have concerns.

The process often becomes a catalyst for improving overall security.

If you’re not showing clients this, you’re leaving value on the table.

Many SMBs have spent years investing in Microsoft 365 security controls they barely use.

AI provides a practical reason to finally turn those investments into operational practices.

Here’s the real win.

The organisations that approach AI through a security lens often end up improving both.

They strengthen governance, improve data quality, reduce risk and gain productivity at the same time.

Not because AI solved the problem.

Because AI forced them to look at the problem.

Security shouldn’t stop your AI journey.

Security should shape it.

When done properly, AI isn’t the risk.

The absence of governance is the risk.

Before You Buy Microsoft 365 Copilot, Clean Up Your Tenant First

One of the biggest mistakes I continue to see with Microsoft 365 Copilot is treating the licence purchase as the project.

It’s not.

The licence is the easy part. The hard part is making sure the information Copilot can access is actually worth finding.

Copilot doesn’t create information. It exposes what already exists.

If your tenant is messy, overshared and unmanaged, Copilot simply helps users find the mess faster.

What is Microsoft 365 Copilot readiness, really?

Most people think readiness is about licences, supported apps and technical prerequisites.

That’s not readiness. That’s procurement.

Real readiness means asking whether your Microsoft 365 environment contains information that is organised, secured and governed well enough for AI to work across it. Microsoft talks about defining your strategy, protecting sensitive data and checking readiness before rollout in its Microsoft 365 Copilot rollout guidance.

Copilot works across the data users already have access to. That should make every MSP pause.

Because if users already have access to content they shouldn’t, Copilot won’t politely ignore it. It will work with the permissions you’ve given it.

Step-by-Step: Review your tenant before assigning licences

Audit SharePoint permissions

Start with SharePoint.

This is where a lot of the Copilot value lives, and it’s also where many of the surprises hide.

Review high-value sites, external sharing, broad groups, anonymous links and old project workspaces. Microsoft has specific guidance around building a secure and governed data foundation for Copilot, including oversharing remediation and guardrails.

Notice what’s missing?

Most SMB tenants have never had a proper SharePoint permissions review.

Review OneDrive ownership

Every OneDrive is effectively a knowledge repository.

Look for departed staff, abandoned content, sensitive folders and business-critical files that only one person controls.

Copilot won’t know whether that file belongs in a managed SharePoint library instead. It will simply see information the user can access.

Clean up Teams sprawl

Open the Teams admin centre and look at inactive teams, duplicated teams and channels nobody owns.

If humans can’t tell which Team contains the source of truth, don’t expect Copilot to magically understand your operating model.

“We thought Copilot was giving bad answers.”

In many cases, the tenant was giving bad data.

Review sensitivity labels

If you use Microsoft Purview, check whether sensitivity labels exist, whether they’re published to the right users and whether people understand them.

Sensitivity labels are not decoration. They classify and can protect organisational data across Microsoft 365, as Microsoft explains in its sensitivity labels documentation.

Keep labels simple.

A label nobody understands is just another button nobody presses.

Check retention and stale content

Old content is not harmless just because storage is cheap.

Review retention policies, old libraries, archived Teams and documents that should no longer be active reference material.

Copilot can make stale content visible again.

That’s not intelligence. That’s exposure.

Validate identity and device controls

Before assigning Copilot licences, review MFA, Conditional Access, privileged accounts and device compliance.

This is where SMBs often underinvest.

They buy the AI licence, but the tenant still has weak identity hygiene and unmanaged devices.

That’s backwards.

Decide how you’ll measure usage

Don’t wait until renewal time to ask whether Copilot is working.

Set expectations early. The Microsoft 365 admin centre includes a Microsoft 365 Copilot usage report for adoption and usage metrics.

That matters because licence assignment is not adoption.

A user having Copilot and a user changing the way they work are two different things.

Why this actually changes behaviour

Here’s the real win.

A Copilot readiness review improves the tenant even before you assign the first paid licence.

Permissions get cleaned up.

Teams become easier to navigate.

Content ownership improves.

Old information gets archived.

Security conversations become practical instead of theoretical.

Copilot doesn’t get tired. Use that.

But don’t ask it to compensate for years of neglected governance.

The best Copilot deployments I’ve seen don’t start with a licence order. They start with a conversation about data, access and outcomes.

My recommendation?

Treat Copilot readiness as an MSP service, not a pre-sales checklist.

If you’re not showing clients what Copilot might expose before they pay for it, you’re leaving value on the table.

Microsoft 365 Copilot isn’t there to fix a messy tenant.

It’s there to make a well-run tenant dramatically more useful.

Creating a Digital Twin of Your Business

When most people hear “digital twin”, they picture an engineer running a virtual copy of a jet engine, or watching a simulated factory floor hum along on a screen. It sounds like something built for heavy industry, a long way from a business that runs on email, spreadsheets and the occasional frantic search through old files. I’ve come to think the idea fits an ordinary organisation just as well — and that most of us are far closer to having one than we’d assume. The raw material is already sitting there. We’ve just never thought of it in those terms.

A digital twin of a business isn’t a 3D model. It’s a living representation of how your organisation actually thinks: the decisions it has made, the reasons behind them, the way a job quietly moves from one person to the next. That knowledge already exists. The problem is that it’s scattered. Some of it sits in SharePoint, some in a Teams thread nobody has opened in a year, some buried in a colleague’s sent items — and an uncomfortable amount lives only inside one person’s head.

You already own the knowledge

A while back I watched someone spend half a morning answering a question their business had already answered twice. The work existed. It simply couldn’t be found quickly enough, so they built it again from nothing. That’s the everyday cost of not having a twin you can talk to. You’re not short of information. You’re short of a way to ask your own business what it already knows.

This is where Copilot starts to shift things. Connected across your Microsoft 365 tenant, it lets you put a question in plain language and pulls the thread together for you. Ask why a particular client moved onto a different plan, and Copilot can surface the Outlook email where it was decided, the meeting where it was thrashed out, and the document that recorded the outcome. A new staff member can ask it how something is normally done and get an answer drawn from real history, not folklore. You stop hunting for a file and start interrogating your own past.

The twin is only as good as what you feed it

This is where most businesses come undone. If a decision gets made on a phone call and never written down, the twin can’t see it. If the reasoning lives only in someone’s memory, it isn’t in the model. So the habit worth building is unglamorous but powerful: put decisions somewhere Copilot can reach. Keep the Teams meeting recap instead of letting it disappear. Write the why into the document, not just the what. Treat a SharePoint page or a Loop component as the place your thinking genuinely lives, rather than a tidy-up job for later.

None of that is technical work. It’s a discipline — choosing to treat your own knowledge as something worth keeping, instead of something you’ll cobble back together under pressure when you next need it.

What it actually buys you

I don’t think the goal is a perfect replica. No model captures everything, and you wouldn’t want one that tried. But a business that can answer its own questions — one that remembers why it did things — moves faster and argues less. It brings new people up to speed sooner. It stops relitigating decisions that were settled months ago.

The pieces are already sitting in your tenant, waiting to be connected. What I’m watching now is which businesses bother to feed the twin, and which keep solving the same problem every Tuesday morning, none the wiser for having solved it before.