Category: AI

CIA Brief 20260627

image

Security & Threat Intelligence
Microsoft Product Updates & Announcements
Cloud & AI
Sustainability

After hours

When a cyber attack took 100 hospitals offline – https://www.youtube.com/watch?v=WxY6aLRVgcI

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

Before You Buy the Copilot Licence, Do This First

MAI_a705418914201c07

Everyone wants to know what Copilot can do. Almost nobody asks what Copilot will find.

That’s the question that actually matters. Copilot doesn’t create new access — it works entirely within your existing Microsoft 365 permissions. It can only surface what a user is already allowed to see.

Sounds safe. It’s not. Not if your SharePoint environment looks like most tenants I’ve walked through.

Sites shared with “Anyone with the link” since 2021. Files in folders with permissions no one’s reviewed in years. Ownerless sites stuffed with content nobody knows exists. When your finance manager asks Copilot to “summarise what we know about Project X,” it’ll pull from everything she can already access — including documents she’d have had to know to search for directly.

That’s not a Copilot problem. That’s the data governance problem you already had, just made visible.

My recommendation? Run the readiness assessment before you assign a single licence.

What is the Copilot Readiness Assessment, really?

Most people think readiness means “do you have the right licence and update channel.” The Copilot Readiness Report in the Microsoft 365 admin centre does tell you that — which users are technically eligible, which devices are on the right update channel, who your best pilot candidates are.

That’s the easy half.

The hard half is whether your data is in a state that Copilot should be let near. That check lives in a completely different place, and most readiness guides skip it entirely.

Notice what’s missing? Almost every “Copilot readiness checklist” you’ll find online focuses on licence eligibility. The data side is where the actual risk sits.

Step-by-Step: Running a Proper Readiness Check
Open the M365 Copilot Readiness Report

Go to the Microsoft 365 admin centre. In the left nav, select Reports > Usage, then choose Microsoft 365 Copilot and open the Copilot report. Click the Readiness tab.

You’ll see prerequisite licence counts, update channel eligibility, and a user table flagging suggested Copilot candidates. Export the list. It gives you a concrete starting point for a pilot conversation with your client.

Check for Oversharing in SharePoint

Open the SharePoint admin centre. Go to Reports > Data Access Governance. This is where you find the oversharing risk — sites with “Anyone” sharing links active, files broadly accessible across the tenant, high-member-count sites with no clear owner.

Work through the data access governance reports. Anything flagged here is content Copilot can reach on behalf of any user who has permission.

By default, SharePoint sharing is set to the most permissive option. Most tenants have never changed it.

Run the Content Management Assessment

Still in the SharePoint admin centre, go to Advanced Management > Content Management Assessment and select Start assessment. This surfaces inactive sites, ownerless sites, and sites that haven’t been attested by anyone recently.

SharePoint admin centre
  > Advanced Management
    > Content Management Assessment
      > Start assessment

Rerun it every 30 days. This isn’t a one-time exercise. It’s a recurring conversation starter with every client who has Copilot.

Review Your Sensitivity Labels

Open the Microsoft Purview compliance portal > Information protection > Labels. Check whether labels are deployed and whether content users will ask Copilot about is actually labelled.

Sensitivity labels travel with content. Copilot honours them at response time — it won’t surface content a user doesn’t have decrypt rights for. No labels means no enforceable control over what ends up in a Copilot response.

They’re not a Copilot feature. They’re the floor you build on.

Why This Actually Changes Behaviour

Here’s the real win.

Running this before you sell the licence gives you a different kind of client conversation. Not “here’s what Copilot can do” — but “here’s what your data looks like right now, and here’s what we need to fix before Copilot is safe to use.” That’s a trusted adviser conversation, not a licence upsell.

Microsoft’s Secure & Governed Data Foundation blueprint organises this into three pillars: remediate oversharing, set up guardrails, meet regulations. It’s worth reading before your next client review. Print it. Take it in.

If you’re not showing clients this work before you enable Copilot, you’re not protecting them — you’re just adding a powerful AI to a mess.

Copilot doesn’t create oversharing. It reveals it. Fix the foundation first, then turn on the power.

Copilot Cowork Just Hit GA — and CSP-Managed Tenants Are Hitting a Billing Wall

copilot-cowork-csp-billing-header

Why “Your organization is managed by your solution provider” appears, why the customer’s own Azure subscription won’t save you, and the exact partner-side fix.

The symptom

Here’s a scenario that is going to land on a lot of MSP desks over the coming weeks. You have a client who has been happily using Microsoft 365 Copilot Cowork while it was in preview. They love it. They want to roll it out to more people. Then Cowork moves into General Availability, and suddenly they can’t add any new users to it. When they go digging in the Microsoft 365 admin centre, into the Copilot section to sort out billing, they are met with this brick wall:

The exact message

“Your organization is managed by your solution provider. Copilot credit setup for organizations managed by a solution provider must be set up by your provider. Contact your provider to enable consumption-based AI services for your organization.” The kicker is that this particular client already has a perfectly good pay-as-you-go Azure subscription sitting in their tenant. So the natural reaction is: I have an Azure subscription, I have billing, why is Microsoft telling me to phone a friend? The short version is that this is not a bug, it is not a permissions problem, and it is not something the client can click their way out of. It is a commerce-channel issue, and the resolution lives with whoever holds the CSP relationship — which, for most of us reading this, means it lives with us.

What actually changed at GA

When Cowork was in preview, the gloves were off — people could use it without the full commercial billing plumbing being in place. At GA, Microsoft moved Cowork behind what they call usage-based billing, powered by Copilot Credits. This is the same consumption model that sits alongside fixed per-user Copilot licensing. Worth noting precisely: as it stands today, this usage-based billing method only applies to Copilot Cowork and the Work IQ API — it is not the whole Copilot estate. Microsoft has said more agents and services will be folded into this model over time, but right now Cowork is the headline reason an MSP will trip over this.

How the new billing model is wired up

Usage-based billing is managed from a new node in the Microsoft 365 admin centre: Copilot, then Cost Management. That is where an admin activates a default spending policy, sets monthly and per-user spending limits, configures alert thresholds, and — critically — chooses a billing method. The billing method is an Azure subscription. Copilot Credits are drawn against that subscription on a pay-as-you-go basis (with optional pre-purchase plans layered on top for discounting, but ignore that for now). So the whole thing hinges on one question: which Azure subscription is allowed to be the billing method? And that is exactly where a CSP-managed tenant comes unstuck.

Why the client’s existing Azure subscription doesn’t help

This is the bit that catches people out, so it is worth being precise. The client genuinely has an Azure subscription. But the Copilot Cost Management setup, in a CSP-managed tenant, will not let them attach it — because that subscription is almost certainly on the wrong commerce channel. When a tenant is managed under the Cloud Solution Provider program, Microsoft routes all consumption commerce — Azure, marketplace, and now these AI services — through the partner’s Microsoft Partner Agreement billing account. A subscription the customer signed up for directly (a credit-card MOSP or direct Microsoft Customer Agreement Azure sub) is a completely separate billing relationship that the partner does not own. The commerce platform sees the tenant flag that says “this org is CSP-managed”, looks for a billing source on the partner channel, doesn’t find one, and throws up the “managed by your solution provider” gate. The presence of some other Azure subscription in the tenant is irrelevant to that check.

The mental model: who owns the commerce channel

If you keep one diagram in your head, make it this one. A CSP-managed customer’s consumption billing has to originate from an Azure plan that the partner provisions under their Microsoft Partner Agreement. The Azure plan gives the customer access to Azure services at pay-as-you-go rates under a Microsoft Customer Agreement, and the resulting Azure subscription lives in the customer tenant but invoices back to the partner. That partner-channel subscription is the only thing the Copilot Cost Management billing-method picker will accept for a CSP tenant. Here is how the three channels compare:

– Billing channel
– Who owns it
– Works as Cowork billing method in a CSP tenant?

Direct / MOSP Azure (customer’s own credit card)
The customer
No — wrong channel, not visible to the CSP gate

Direct Microsoft Customer Agreement (Azure direct)
The customer
No — tenant is flagged CSP-managed, so this is bypassed

Azure plan under Microsoft Partner Agreement (CSP)
The partner (you)
Yes — this is the channel the gate is looking for

The fix, step by step (partner side)

Assuming you are the CSP for this client, the resolution is to provision an Azure plan and an Azure subscription for them through the partner channel, then point Copilot Cost Management at it. Work through these in order:

  • Confirm the Microsoft Customer Agreement is accepted. In Partner Center, open Customers, select the customer, and check the Microsoft Customer Agreement status on their Account page. You cannot purchase an Azure plan until the MCA is in place — invite them to sign it directly with Microsoft if it isn’t.

  • Purchase the Azure plan. In Partner Center, with the customer selected, choose Add products, set Segment to Commercial, find Azure plan, add to cart, Review and Buy. If the customer already has an active Azure plan, skip to the next step.

  • Create an Azure subscription under that Azure plan. Sign in to the Azure portal with your Partner Center (Admin agent) credentials, making sure you are in your partner directory, not the customer’s. Go to Cost Management + Billing, pick the billing scope for the account where the customer sits, open Customers, select the customer, then All billing subscriptions, and choose Add. Pick a Usage based / Azure subscription with the plan set to Microsoft Azure Plan, then Review and create.

  • Lean on AOBO for the Azure rights. Subscriptions you create through CSP grant Admin-on-Behalf-of, which gives any Admin agent in your partner tenant Owner rights on that subscription automatically. That satisfies the setup wizard’s requirement for Owner or Contributor on the Azure subscription and resource group — no extra role assignment needed.

  • Configure usage-based billing in the customer’s M365 admin centre. Go to Copilot, then Cost Management, and select Get Started. In the Billing method section choose the new CSP Azure subscription. Set a sensible monthly spending limit, a per-user spending limit, and alert recipients and thresholds, then Activate. The Cowork block clears and you can add users again.

Prerequisites worth double-checking before you start

Setup will fail at the last hurdle if any of these are missing, so confirm them up front:

  • On the Microsoft 365 side, the person running the Cost Management setup needs Global administrator or Billing administrator. AI administrator and License administrator can create spending policies and manage limits, but they cannot set or change the billing method.

  • The tenant must have at least one SharePoint licence, or a licence that includes SharePoint. This is a real prerequisite for the Copilot billing node, and easy to overlook on a lean tenant.

  • You need Owner or Contributor on both the Azure subscription and a resource group in it. Via CSP and AOBO this is automatic, but if you have deliberately stripped AOBO and are using Lighthouse or directory accounts instead, make sure the identity doing the setup actually has those rights.

  • An Azure resource group must exist in the subscription — the wizard can create one for you during setup if needed.

Direct CSP vs indirect reseller — know which one you are

There is an important fork here. If you are a direct-bill CSP partner, you hold the Microsoft Partner Agreement billing account yourself and you run every step above in your own Partner Center. If you are an indirect reseller sitting underneath a distributor or indirect provider, you do not own that billing account — the Azure plan purchase is initiated through your indirect provider’s flow, not your own Partner Center billing scope. In that case you coordinate with your distributor to get the Azure plan provisioned, and then you can still handle the Azure subscription creation and the customer-side Cost Management configuration. And if it turns out a completely different provider holds the CSP relationship for this client, then none of this is yours to fix directly — that provider has to provision the Azure plan, or the CSP relationship needs to be transferred to you first.

Gotchas and things I’d watch

A few practical landmines that are easy to step on with this new model:

  • Budgets notify, they don’t stop. A budget on a billing policy triggers email alerts at the thresholds you set, but by default it does not enforce a hard cap or interrupt service. If you want a genuine ceiling, use the monthly spending limit and per-user limits in the Cost Management spending policy, which can actually cut access when hit.

  • Set a per-user limit on day one. The whole point of consumption billing is that a single enthusiastic user can run up real spend. The per-user monthly limit is optional in the wizard, but for an MSP managing someone else’s bill, treat it as mandatory.

  • Region selection is sticky. When you create the billing policy you choose a region that determines where tenant ID and usage data are stored, and you cannot edit the subscription or resource group tied to a policy afterwards. Get it right the first time.

  • Turning pay-as-you-go off is not instant. Disconnecting a service from a billing policy can take up to two hours to actually stop users, so don’t panic if access lingers briefly after you flip it off.

  • Pre-purchase plans layer on top, they are not an either/or. If cost predictability matters, a Copilot Credit pre-purchase plan gives discounted credits that are consumed first, with pay-as-you-go catching any overage. You don’t have to choose one or the other.

The takeaway

This is going to be a recurring support ticket. Cowork going GA is good news, but the GA billing model assumes the customer can attach their own Azure subscription — and for CSP-managed tenants that assumption simply doesn’t hold, no matter how many Azure subscriptions are already sitting in the tenant. The fix is entirely on the partner side: provision an Azure plan and subscription through the CSP channel, then point Copilot Cost Management at it. If you manage Microsoft 365 customers through CSP and any of them are using Cowork, get ahead of this now, because the moment GA flips the billing requirement on, their ability to add users stops until you’ve done the plumbing. As always, plan it, test it on one tenant, and document the steps so your L1 team can repeat them.

Can MSPs Actually Bill for Copilot Cowork?

image

I’ve been mulling over a question that doesn’t get asked enough, and I think it deserves a hard look: when Copilot Cowork lands with pay-as-you-go billing, do small and midsize MSPs actually have the skills to handle it? Not the product. The billing. Because from where I sit, that’s the part most of us are least prepared for.

For years, the SMB MSP model has run on something beautifully predictable: per-seat licensing. A client has thirty users, you sell thirty licences, you mark them up, and everyone knows what next month’s invoice looks like before it arrives. That predictability is the whole foundation. It’s what lets you quote a managed services agreement with a straight face. Consumption billing pulls that foundation out from under you.

We’ve Never Had to Read This Kind of Meter

PAYG is a different animal. Usage goes up and down. Costs follow. Suddenly you’re not selling a fixed thing, you’re selling access to a meter that ticks based on what people actually do inside Copilot. And here’s the uncomfortable truth — most of us have never had to read a meter like this before. We don’t have the muscle for it.

Think about the questions a client will ask the moment their first variable bill arrives. Why was it higher this month? Which users drove that? Was it worth it? If your answer is a shrug and a forwarded Microsoft invoice, you’ve got a problem. You need to pull the usage data, make sense of it, and explain it in plain English. That’s not a skill most SMB MSPs have built, because we’ve never needed it.

Configuring It Is the Easy Part

Turning Copilot Cowork on through the admin centre isn’t the hard bit. Microsoft will make that straightforward enough. The hard bit is everything that wraps around it — setting spending limits so a client doesn’t get a nasty surprise, deciding who gets access, and putting guardrails in place before usage runs away from you.

Then comes reporting, which is where I think the real gap shows. Can you stand in front of a client at the monthly meeting and show them, clearly, what they consumed and what they got for it? You’ll be living in the Microsoft 365 admin centre and the usage reports, and you may well end up pulling that data into Excel — perhaps asking Copilot itself to summarise the month’s consumption into something a business owner can read in thirty seconds. If you can’t produce that story, the client will assume the worst.

This Is a Discipline We Have to Learn

What worries me isn’t the technology. It’s that consumption billing is a genuine discipline, and it’s one the SMB MSP world has largely skipped. The cloud providers have been doing variable billing for years. Most of us serving small business have not. We’ve been comfortable in fixed-price land, and Cowork is going to ask us to grow up fast.

So I’d put the question back to you honestly. Could your business take on a client with Copilot Cowork tomorrow, configure it sensibly, manage the spend, and report on it with confidence? If there’s hesitation in that answer, you’re not behind — you’re normal. But the MSPs who close that gap early, who learn to read the meter and tell the story, are the ones who’ll own this conversation. The rest will be forwarding invoices and hoping nobody asks why.

Need to Know podcast–Episode 367

This episode ultimately reflects on how organisations must adapt to an environment where solutions are no longer neatly balanced between simplicity and capability. Instead, businesses need to reassess priorities, stay informed, and make deliberate choices about which innovations deliver real value. For SMBs, the challenge is not just keeping up—but identifying what’s truly “good enough” in an increasingly complex cloud-first world.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-367-goldilocks-gone/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog

Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron

CIAOPS AI Dojo

CIAOPS weekly news update – CIA Brief – CIAOPS

CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS

Get your M365 questions answered via email

Join my email list

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com

AutoJack: How a single page can RCE the host running your AI agent

Azure Sets a New Performance Record for LLM Training Benchmark at Extreme Scale

Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave report

Copilot Cowork is now generally available

Microsoft Defender email security benchmarking: Key insights from one year of data

Stay productive in new Outlook for Windows with these 5 features

What’s new in Power Platform: June 2026 feature update

What’s New in Notebooks | June 2026

Mercedes-AMG PETRONAS F1 Team responds to the intensity of race weekends with Microsoft

AI brands as bait: How threat actors are using the AI hype in social engineering

AI Is Starting to Feel Like the Petrol Bowser

image

I filled up the car last weekend and did that thing we all do now — glanced at the price per litre, winced a little, and worked out whether to fill the tank or just put in enough to get me through the week. It struck me, standing there, that I’ve started having the exact same conversation about AI.

For a while, AI felt free. You paid your subscription, you used it, and the meter never seemed to run. That era is ending. Token prices, usage caps, premium request limits — the cost of running AI is becoming visible, metered, and impossible to ignore. For a small business, it’s shifting from a novelty into a line item. And like petrol, it’s no longer optional. You can’t really run the business without it, but you can’t ignore what it costs either.

A running cost, not a one-off

The mistake I keep seeing is treating AI like a piece of software you buy once and forget. It isn’t. It behaves far more like fuel or electricity — something you consume, in varying amounts, every single day. Some weeks you’ll barely touch it. Other weeks, when you’re deep in a proposal or cleaning up a quarter’s worth of numbers, you’ll burn through it.

That changes how you should think about it. A running cost needs watching. It needs a budget. And it needs someone, every so often, asking the plain question: are we actually getting value for what we’re spending here?

Spend where the work actually is

Here’s where it gets interesting for a small business. You haven’t got an unlimited tank, so you have to decide where AI earns its keep. For most of the small operations I work with, the answer isn’t exotic. It’s the boring, repetitive, time-sapping work — the email triage, the first draft of a report, the summary of a long meeting nobody wants to rewatch.

That’s exactly where Copilot inside Microsoft 365 pays for itself. Asking Copilot in Outlook to clear and draft replies to a morning’s backlog saves real hours. Having it summarise a Teams meeting you missed, or pull the key figures out of an Excel workbook, turns an afternoon into a few minutes. The trick is to point your spend at the tasks that are costing you time and money today — not the shiny demos that look clever but never touch your actual week.

Economise without going without

The same way you don’t leave the car idling in the driveway, you don’t want AI burning through your allowance on low-value busywork. Be deliberate. Use the everyday Copilot features that already come with your licence before you reach for premium-priced add-ons. Give your people a quick steer on what’s worth asking and what’s just noise. And look at the bill — actually check where the consumption is going, the way you’d question a sudden jump in the power account.

None of this is about spending less for its own sake. It’s about spending on purpose.

Where I’ve landed

Petrol taught small business owners to think in terms of value per trip, not just price per litre. AI is heading the same way. The ones who do well won’t be those who spend the most or the least — they’ll be the ones who know exactly what they’re buying and why. Watch your usage, back the work that matters, and treat AI like the utility it’s quietly becoming. The meter is running now. Best to know what it’s running on.

Your first Copilot Studio agent — and the bits the demo skips

MAI_111667a8d6c40e32

Everyone wants to build an agent right now.

It’s the demo that makes the room go quiet. You describe what you want in plain English, and thirty seconds later there’s a working assistant answering questions from your own documents.

Then the bill arrives. Or worse — it doesn’t, because nobody published the thing and it’s sitting in a maker’s personal environment doing nothing.

Here’s what I keep seeing. People treat an agent as a science project. They build one, screenshot it, post it on LinkedIn, and move on. The client never touches it.

That’s not a product. That’s a party trick.

If you’re an MSP, the agent isn’t the deliverable. The service around it is. Let me show you the bits people skip.

What is a Copilot Studio agent, really?

Strip away the marketing and an agent is three things: instructions, knowledge, and tools.

Instructions are the job description — what it does, the tone it takes, when to give up and send someone to a human. Knowledge is what it’s allowed to read: a SharePoint site, a public page, a handful of documents. Tools are the actions it can take, like logging a ticket or looking up an order.

That’s it. You’re not training a model. You’re scoping a very literal new hire.

And there are two doors into this. The Agent Builder baked into Microsoft 365 Copilot, and Copilot Studio proper. The choice between them comes down to audience and reach — a quick helper for your own Copilot chat, or a real one you publish out to Teams, a website, wherever your client’s people already work.

Step-by-Step: building your first agent

Portal only. No code.

Open the studio

Go to copilotstudio.microsoft.com and check the environment name in the top right. This matters more than it looks. Build in the wrong environment and you’ll be untangling it later. Pick the client’s environment deliberately, every time.

Describe what you want

You get a box. Type what the agent should do in your own words — that’s the whole guided, no-code start. Mine for a small-business help desk reads like this:

Help our staff with common IT questions — password resets,
VPN setup, who to call for hardware. Answer only from the
company IT knowledge base. If you're not sure, say so and point
them to the service desk. Don't guess.

Notice what’s missing? No model to pick. No temperature dial. No code. You’re writing a job description in plain English. And the load-bearing line is the last one: ask it once to admit when it doesn’t know. An agent that says “I’m not sure” beats one that bluffs with total confidence.

Add knowledge, narrowly

Point it at one good source first. The company FAQ. The IT policy site. Not everything you own — one trusted thing. Test it. Then add more. An agent fed the whole tenant on day one is an agent that confidently surfaces the wrong document.

Test like a real person

Use the test pane on the right. Ask the messy questions: “can’t log in”, “where’s the VPN guide”, “who do I call”. If it waffles, fix the instructions — not the model.

Publish it

This is the step everyone forgets. An agent does nothing until you hit Publish. And every change you make afterwards needs publishing again, or your users sit on the old version. Then add a channel — Teams and Microsoft 365 Copilot are the obvious two — and decide who’s allowed in.

By default it’s Authenticate with Microsoft, which means your tenant and no one else. Leave it there. “No authentication” hands a working link to the entire internet. For an internal SMB agent, that is never what you want.

The licensing question you answer first, not last

Here’s the bit the demos never mention.

Agents built in the Agent Builder inside Microsoft 365 Copilot ride along with the licence your client already pays for. The custom agents you build and publish in Copilot Studio consume Copilot Credits — and since September 2025 that’s the currency Microsoft meters them in. Pay-as-you-go, or prepaid packs.

“So I just describe it and it works?” Yes — and that’s exactly the trap. The describing is the easy part. The scoping, the publishing, and the consumption call are the actual job.

So before you build, settle one thing: is this an internal helper for a few Copilot users, or a published agent the whole company will hammer all day? The answer decides which door you walk through and whether there’s a consumption bill hanging off it.

Get that wrong and you’ve either over-built a toy or under-budgeted a product.

The point of an agent isn’t to look clever for ninety seconds in a demo.

It’s to take a repetitive question off a human’s desk and answer it the same way, every time, at 2am. A published agent earns its keep. An unpublished one is a screenshot.

Build one narrow agent, publish it properly, and put your name on the governance around it. If you’re not showing your clients this, someone else will — and they’ll be the ones charging for it.

The Hiring Shift Copilot Has Quietly Forced

image

A few weeks ago I watched someone forward a Copilot-drafted email to a client without really reading it. The tone was off. A figure was wrong. The client picked it up before they did. Nobody was being lazy — they were being efficient, in the exact way we’ve all been trained to be efficient. Get the task done. Move to the next one. That small moment has stuck with me, because I think it points at something much bigger that’s quietly reshaping how small businesses need to think about the people they hire, and the behaviours they reward.

For most of my working life, businesses hired people to do things. Send the email. Build the report. Process the invoice. Update the spreadsheet. Speed and responsiveness were the metrics that mattered most. If you could turn incoming requests into completed work quickly and reliably, you were valuable. That model held up because doing the thing was the hard part, and doing it well took real skill, attention and time.

The work that used to be hard isn’t hard anymore

Copilot has quietly upended a lot of that. Drop into Outlook and you can have a draft reply in seconds. Open Word with a half-formed idea and Copilot will hand you a structured first pass before your coffee has cooled. Excel will summarise a sheet, flag the anomalies, and suggest a formula it thinks you wanted. Teams will catch you up on the meeting you missed and tell you what was decided and who owns what. Every one of those tasks used to be where someone earned their keep. Now they’re table stakes.

What’s left isn’t the doing. It’s the deciding. Was that actually the right answer? Does the draft fit the specific client we’re dealing with, or the average client Copilot has imagined? Is the figure it pulled from SharePoint the current number, or one from two restructures ago that nobody got around to archiving? Should we even send this email, or is there a phone call hiding behind it?

We’ve been training people out of asking

Here’s the part I find uncomfortable. A lot of small businesses have spent years quietly training their people out of pausing. We rewarded responsiveness over reflection. Inbox zero over inbox thoughtful. Closing tickets over questioning whether the ticket made sense in the first place. Over time, some genuinely good people got very fast at moving work between systems without really engaging with any of it.

That worked when the slow, expensive part of the job was producing the output. It doesn’t work now. The slow part is the human bit — the read, the sense-check, the quiet moment of “this doesn’t sit right with me” that keeps a business out of trouble with a client, a regulator, or its own future self.

The maths has flipped

When output was expensive, mistakes were rare almost by accident. There was friction in the system, and friction gave people time to second-guess themselves. A bad proposal took half a day to write, so it usually got read twice before it left the building. A bad proposal now takes ninety seconds, and so do the next ten after it.

The businesses that come out of this next stretch in good shape won’t be the ones with the fastest Copilot adopters. They’ll be the ones that have quietly shifted what they recognise and reward — from doing the thing, to noticing when the thing isn’t right. That’s a hiring conversation, a performance review conversation, and most of all a culture conversation. And in most of the small businesses I see day to day, it’s well overdue.