Rolling out Copilot without regretting it

Most disappointing Copilot rollouts share a shape: licences bought for everyone, switched on inside a week, nothing done to the data underneath, and six months later usage is thin and the finance director wants to know why. The fix is boring and sequenced, which is exactly why it works.

Permissions before licences

Copilot shows each person whatever that person could already have opened for themselves. That sounds safe until you remember what has accumulated in your file shares: documents shared with “everyone in the organisation” years ago by somebody in a hurry, folders inherited from a project that ended in 2021. Over-sharing nobody could find is over-sharing a good search engine now surfaces on request.

So, before the pilot, audit the sharing on the sites that matter, fix the “everyone” links on anything sensitive, and get sensitivity labels onto the files that need them. A sensitivity label marks a file as confidential and stays attached to it wherever it goes, which is what gives data loss prevention rules something to act on. This is the least glamorous work in the whole programme and the most important, because the data boundary only protects what your permissions have not already given away.

Pilot small and specific

A useful pilot is a couple of dozen people in roles heavy on writing, meetings and analysis, rather than a scattering of licences across the org chart. Give them real training instead of a launch email, name one person they can ask, and collect concrete examples of what worked and what flopped.

Those examples are the actual output of the pilot. They become your training material, your business case, and your honest list of what Copilot is not yet good at. Expect the pilot to surface shadow AI too: people who were already pasting work into free tools tend to say so once there is a sanctioned alternative to compare it against.

Measure like a sceptic

The Copilot Dashboard, which your administrators can see, shows who is actually using what. Usage that never turns into habit is the honest signal, and the one worth acting on. Microsoft added a view of exactly that in September 2026, picking out “who is building a habit using Copilot”, and its usage snapshot report now refreshes daily. Vendor and consultancy figures on adoption and hours saved vary too widely to plan against, so measure your own organisation instead.

Decide up front what happens if usage stays flat. Moving licences from the people who never opened it to the ones on the waiting list is a normal part of running the programme, not an admission that it failed. The waiting list can now be a literal one: where self-service buying is blocked, people can request a licence, and since September 2026 those requests land on a dedicated License Requests page in the admin centre.

Not everyone needs the paid seat, meaning one person’s full licence, and the free tier has grown. Copilot Chat comes with most business plans, and inside Outlook it now reads the user’s own inbox and calendar. Some of those users also get a limited Copilot in Word, Excel and PowerPoint on what Microsoft calls standard access, which can slow down at busy times, where the paid licence gets priority. For colleagues whose work rarely needs Copilot to search across their files, that may be enough, which at a few hundred people is real money. See which Copilot is which.

Buy fewer licences than you think you need, prepare the data more than you think you need to, and let measured usage argue for the expansion.

Once agents enter the picture the governance load grows again. Read Copilot agents at work before the first Friday-afternoon agent appears. Cowork needs its own decision, because in Microsoft’s words “a spending policy is an access control, not only a budget”: anyone covered by a policy that includes Cowork can use it, however small the limit, and the default policy covers everyone in the organisation unless you narrow it.