Direct Answer: Copilot now ships inside Microsoft 365 Business Standard and Premium, so most companies meet it at renewal. Before turning it on, review SharePoint sharing links, site owners, and broken permission inheritance.
An office manager in Monterey County opens what looks like a routine Microsoft billing email and finds out the plan is changing. Copilot is now part of the subscription, and the renewal date is about a month out.
Nobody asked for it. Nobody budgeted for it. And now somebody has to decide whether to switch on an AI tool that can read across every file the company keeps in SharePoint and OneDrive.
This article covers the part that actually matters before renewal day: what changed in the packaging, why file permissions are the real risk, and how many seats a local business genuinely needs. If you handle client files, patient records, or grower contracts, the permissions section is the one to read twice.
What Actually Changed in Your Microsoft 365 Plan
As of July 1, 2026, Microsoft moved Copilot out of the add-on column and folded it into Microsoft 365 Business Standard and Business Premium. New customers get it in the box.
Existing subscribers do not choose it. You meet the new packaging at renewal. Industry coverage of the change notes that tenants get at least 30 days notice before the switch happens.
Thirty days is a fine runway for a company with an internal IT director. It is a short runway for a 40-person office in Salinas or Marina where the person handling technology is also handling payroll and vendor invoices.
On cost, be careful with any number you read online. Microsoft’s per-seat tiers moved again in 2026, and what you pay depends on your plan, your term length, and how your licenses were bought. Get the exact per-seat figure from your license reseller or your IT partner before you build it into next year’s budget.
So the question to ask is not “should we buy Copilot.” It is “is our Microsoft 365 tenant in good enough shape to turn it on.” For most small offices we look at, the honest answer is not yet.
Copilot Obeys Your Permissions. It Does Not Fix Them
Here is the piece almost nobody warns owners about. Copilot does not break your security settings. It follows them exactly.
That means Copilot will find, read, and summarize anything an employee technically has access to, even if nobody ever intended that person to see it. If a payroll spreadsheet sits in a folder that quietly grants access to the whole company, Copilot can surface it in a one-sentence answer.
Microsoft’s own readiness guidance points to the same handful of culprits every time:
- Site privacy set so everyone in the organization can walk in
- Default sharing links set to the broadest option instead of specific people
- Broken permission inheritance, where a subfolder no longer matches the site above it
- Old “everyone except external users” grants that nobody has reviewed since they were made
- Sites with no owner at all after a staff change
Now picture a Salinas Valley grower or a Monterey nonprofit that has been in the same tenant since 2019. That is six or seven years of sharing decisions, made in a hurry, by people who have since moved on.
The files did not get riskier. The tool that reads them just got much better at finding them.
The Before-You-Enable Sequence That Actually Works
You do not need a security audit with a binder at the end. You need to run reports Microsoft already gives you, then act on what they say.
Inside the SharePoint admin center, Microsoft publishes data access governance and content assessment reports. They flag the exact things that cause trouble:
- Sites shared with everyone in the organization
- Ownerless sites
- Stale sites nobody has opened in years
- Files carrying sensitive data like Social Security numbers or bank details
Microsoft recommends running these before Copilot goes live, then re-running them on a regular cadence. That is the important word: cadence. Oversharing creeps back the moment someone shares a folder the fast way.
One practical note. These scans are started by hand, and they can take anywhere from a couple of hours to a few days depending on how much content sits in your tenant. A grower with fifteen years of harvest records will wait longer than a six-person office.
That timing is why this is summer work, not renewal-week work. Then comes the follow-up that makes the report worth anything:
- Assign a named owner to every single site
- Kill tenant-wide edit links and set the default to specific people
- Fix broken inheritance on the folders holding payroll, HR, and personnel files
- Archive sites nobody has touched in three years
- Re-run the reports quarterly so you catch drift early
Five Steps Before You Switch Copilot On
This is the order we work through with a client tenant before any AI feature gets enabled for staff.
If You Handle Client or Patient Files, Slow Down Here
This is where most of the local buyer base sits. Monterey County law offices, accounting firms, registered investment advisers, and healthcare-adjacent practices all keep their working files in SharePoint and OneDrive.
Copilot summarizing a misfiled document does not change who is legally allowed to see that document. The obligation stays exactly where it was.
California requires businesses to notify affected people when unencrypted personal information is exposed. Practices touching patient information carry HIPAA duties on top of that. An internal exposure still counts as an exposure when the wrong staff member reads a file they were never cleared for.
One investment adviser in the area put the worry plainly when they reached out. They try their best to be cyber-safe, and they want to know they are doing what they can to protect client data. That is the right instinct, and it deserves a real answer rather than a shrug.
Two controls do most of the work for a small firm:
- Sensitivity labels classify and protect documents, so labeled content carries its restrictions wherever it travels
- Site-level access restriction locks a whole site to a defined group, so nothing inside it is reachable by anyone else, Copilot included
Used together, a 12-person firm can turn Copilot on for general work while the client matter sites and patient folders stay walled off. Regulated industries often have a harder time finding IT support that understands these obligations, which is why the setup conversation matters more than the software.
Who Needs a Copilot Seat First, by Organization Type
Seat counts should follow how people actually work, not headcount. Here is how that breaks down across the kinds of organizations we see across Monterey County.
| Organization type | License first | Hold off on |
|---|---|---|
| 12-person law office | Attorneys and paralegals who draft and summarize daily | Reception and billing until matter sites are locked down |
| Grower or packing house, 80 staff | Office admin, HR, and sales team | Field and line staff who rarely open Word or Excel |
| Small school district, 3 sites, ~70 staff | Administrators and department leads writing reports | Classroom staff until student data handling is reviewed |
| Monterey nonprofit, 20 staff | Grant writers and the executive director | Program staff and volunteers on shared logins |
| Accounting firm or RIA | Partners and client-facing advisers | Anyone with access to unlabeled client folders |
Don’t Pay for Seats Nobody Opens
The most common waste in this rollout is not the license price. It is buying seats for people who never open the feature.
Reported adoption numbers suggest paid Copilot seats still represent only a small single-digit percentage of commercial Microsoft 365 subscribers, and a good share of the seats companies do buy go barely used.
That math lands differently depending on the business. A packing house where most of the workforce never touches Word does not need the same seat count as a 12-person law office. A district with three school sites and roughly 70 staff is a third picture again.
A sane approach:
- Start with the people who write, summarize, and sit in meetings all day
- Give it 60 to 90 days and pull real usage data
- Expand only where the numbers show the tool is getting used
Smaller organizations working on fixed budgets should be especially deliberate here. We cover that thinking in more detail in what nonprofits on the Central Coast should expect from IT support.
Plan for the New Help Desk Questions
AI features create a whole new category of everyday questions on top of the tickets a business already generates.
The routine requests local offices send in look like this:
- Two teachers cannot reach the printer, again
- A browser keeps resetting its default no matter how many times it gets changed
- An expired password is blocking QuickBooks on a Monday morning
- Email search only returns about a month of history
Add Copilot and you also get “why can’t it see this file,” “where did the Copilot button in Word go,” and “who else can read that meeting recap.” Those are permission questions wearing a software costume.
What matters is having someone who explains the answer without the jargon. One local client put it well in a review: “Jose also answered my questions in lay terms that I could understand.” That is the bar.
When support can connect quickly and explain what it is doing, these tickets take minutes instead of afternoons. Tools like Microsoft Quick Assist are part of that, and so is knowing what a support partner should be handling behind the scenes before anyone files a ticket.
Frequently Asked Questions About Microsoft Copilot IT Support
Can I just turn Copilot off when it shows up at renewal?
In most cases you can control who has access to it through your tenant settings and license assignments, so it does not have to go live for everyone on day one. What you cannot do is un-include it from the plan. Your reseller or IT partner can confirm exactly what your specific tenant and plan allow.
Will Copilot expose files it shouldn’t?
Not on its own. It only retrieves content the signed-in user already has permission to open. The problem is that in most tenants, people have permission to far more than anyone realizes, and Copilot makes that easy to stumble into. Fix the permissions and the risk drops sharply.
How long does the pre-enablement cleanup take?
The scans themselves run from a couple of hours to a few days depending on how much content sits in your tenant. The cleanup afterward is the real work, and for a tenant that has been running since 2019 with no permission review, plan on a few weeks of steady effort rather than one weekend.
Does HIPAA or California breach law change anything here?
Your obligations stay the same, but the odds of internal exposure go up if permissions are loose. Practices handling patient information and firms handling client financial data should lock sensitive sites down with sensitivity labels and site-level access restriction before enabling AI features broadly.
How many seats should a 40-person office start with?
Usually far fewer than 40. Start with the handful of people who spend their day writing, summarizing, and in meetings, then look at real usage after two to three months before you add more.
Thinking Through Copilot Before Your Renewal Date?
Copilot readiness is really a roadmap conversation, not a software purchase. A local provider who already documents your sites, permissions, and license inventory can run the pre-enablement review during the quieter summer weeks rather than scrambling the week renewal lands. Our virtual technology officer work exists for exactly this kind of decision, where an owner needs someone to say which seats are worth funding next year and what has to be cleaned up first. Adaptive Information Systems works out of the Main Street office in Salinas and can be reached at (831) 644-0300 or adaptiveis.net.
