Microsoft Copilot for NZ SMBs
Microsoft 365 Copilot answers questions using the files, emails and chats each person can already open. That is the risk. If a staff member can reach a folder they should not, Copilot can find it for them. Before you switch it on, tidy your permissions and sharing links, and label your sensitive data.
OxygenIT, 7 Horner Street, Papanui, Christchurch 8053, is ISO 42001 and ISO 27001 certified as at 12 May 2026. We work with NZ businesses of roughly 20 to 200 staff, and we work in Microsoft 365 tenants every day.
Updated November 2026. Reviewed by Tim Clarkson
Not ready yet? See whether you are ready first
What the Copilot service includes
Microsoft 365 Copilot is an AI assistant built into Word, Excel, Outlook and Teams. It does not have its own copy of your data. It reads what each person can already open in SharePoint, OneDrive, email and Teams, then uses that to draft, summarise and answer questions. For a New Zealand business of 20 to 200 staff, that makes permissions the first thing to check. Old sharing links, open team sites and folders shared with everyone become searchable in plain English the day you switch Copilot on. As at 12 May 2026, OxygenIT is ISO 42001 and ISO 27001 certified, and we work in Microsoft 365 tenants every day. Read more about the OxygenIT team, or see broad AI consulting for NZ businesses if your plans go wider than Copilot. A safe rollout has four parts: review who can see what, label sensitive information, agree a written AI policy, and start with a small pilot group before wider release.
Who it is for
NZ businesses of roughly 20 to 200 staff that already run on Microsoft 365 and want a governed Copilot rollout, starting with a pilot group rather than the whole business.
What is included
- Use-case selection
- Pilot scope
- Pilot setup
- Staff guidance and handover
What you need first
Eligible Microsoft 365 and Copilot licences. Licences sit outside the service fee, and OxygenIT can resell them to you.
A readiness assessment first. Licence eligibility, oversharing and data readiness are checked in the AI Readiness Audit, a separate paid assessment that is not part of the pilot.
How it starts
Book a 15-minute call to talk through your Microsoft 365 setup and what you want Copilot to do. Scoping the pilot comes next.
Step 1 of 3
Check licences, access and data readiness
Before you switch Copilot on, fix who can see what and label your sensitive information. Copilot reads whatever each person can already open in SharePoint, OneDrive, email and Teams. Any file that is overshared today is easy to find in plain English once Copilot goes live. The usual places to look are old sharing links, team sites open to the whole business and folders shared with everyone. You also need eligible licences for the staff in the pilot. These checks are a separate paid assessment that comes before the pilot, so you know where your tenant stands before it starts.
Before the pilot: a separate paid readiness assessment
These checks are not part of the Copilot pilot. They are a separate paid assessment that comes first: the AI Readiness Audit.
- Licence eligibility
- Oversharing and permissions
- Data readiness
Is your business ready for Copilot?
You are ready for Copilot when every row below matches the Ready for Copilot column, and not ready while any row still matches Not ready yet.
| Area | Ready for Copilot | Not ready yet |
|---|---|---|
| Licences | An eligible plan, with Copilot licences for pilot staff | Plan not eligible, or no Copilot licences assigned |
| Access and permissions | Access matches each role, and sharing links have been reviewed | Sites and folders open to everyone, old links still live |
| Data readiness | Sensitive information found and labelled | Sensitive files unlabelled and mixed in with everyday files |
The Copilot licensing tiers and plans guide and Microsoft 365 plans for business show which plans include Copilot and what they cost, and OxygenIT can resell the Microsoft licences you need.
Step 2 of 3
Choose business use cases and a pilot
A Copilot pilot starts with a short list of business tasks where it might help, such as drafting documents, summarising long email threads or preparing meeting notes in Teams. We choose the use cases with you and agree the pilot scope before anything is switched on. A pilot is a test, not a promise. Some use cases will earn a place in the wider rollout and some will not. You decide which, based on what your staff find. It also pays to write an AI policy before rollout, so pilot staff know what they may and may not put into Copilot.
What the pilot scope records
- Use-case selection
- Pilot scope
- Which staff take part
- Which use cases are tested
- How success is judged
Step 3 of 3
Set up Copilot and guide staff
Copilot is switched on for the pilot group, and staff are shown how to use it within the rules you have set. In a governed rollout, Copilot is your approved AI tool. It works inside your Microsoft 365 tenant, under the permissions and labels you have already checked. Unapproved tools are different. A free chatbot opened in a browser sits outside those controls, and anything pasted into it leaves your tenant. If staff already use AI tools you have not approved, shadow AI discovery and control is the separate service for finding them and deciding which to allow, restrict or block.
Handover
- Pilot setup
- Staff guidance sessions
- Handover notes
Deliverables, responsibilities and service limits
Here is what you receive, what is not included and what we need from you, so you can hold any provider, OxygenIT included, to the same list.
What you receive
- Use-case selection
- Pilot scope
- Readiness assessment: a separate paid prerequisite, not part of the pilot. See the AI Readiness Audit
- Adoption actions
- Staff guidance and handover notes
Not included and limits
- Microsoft licences are not part of the service fee. OxygenIT can resell them; see the licensing guide
- Productivity or time-saving guarantees (never offered)
- Work outside agreed scope
What we need from you
- A named owner for the rollout
- Admin access to Microsoft 365 as agreed
- Pilot staff available for guidance sessions
- Decisions on which data Copilot may reach
Some businesses we assess are not ready for Copilot, and we will tell you that rather than sell you licences.
Price: from $1,500 depending upon scoping call and discovery
How the project runs
Copilot runs as a project: discovery, readiness, rollout and handover. Readiness is the AI Readiness Audit, a separate paid assessment that comes first. We agree the pilot scope with you before anything is switched on. We agree the project dates and milestones with you before work starts.
Frequently asked questions
Is my business ready for Microsoft 365 Copilot?
Your business is ready for Microsoft 365 Copilot when the right people hold eligible licences, file access matches each role and sensitive information is labelled. If folders are open to everyone or old sharing links are still live, you are not ready yet. The AI readiness audit checks licence eligibility, oversharing and data readiness. It is a separate paid assessment, done before any Copilot pilot starts.
Can Copilot show staff files they should not see?
Yes, if those files are already open to them. Copilot does not create new access. It uses every permission each person already holds, so a folder shared too widely is easy to find with a plain English question. The fix is to tidy permissions and sharing links before you switch Copilot on. For wider risks across the AI tools your business uses, see the AI security review for NZ businesses.
Which Microsoft 365 licence do we need for Copilot?
You need an eligible Microsoft 365 business plan, plus Copilot licences for the staff who will use it in Word, Excel, Outlook and Teams. Microsoft changes its plans and prices, so the Copilot licensing guide sets out the current options. Licences are not part of our service fee, and we can resell them to you.
Do we need an AI policy before using Copilot?
Yes, put a written AI policy in place before staff start using Copilot. It tells staff what they may put into Copilot, which data it may reach and who approves new uses. Without one, each person makes up their own rules. We run our own AI use under ISO 42001, and ISO 42001 AI governance shows how the same structure can work in your business.
Who should own Copilot in your business?
One named person in your business should own Copilot. Usually that is someone senior enough to decide which data it may reach and which uses are approved. They sign off the pilot scope, keep the AI policy current and answer staff questions about what is allowed. It does not need to be your IT provider. The AI policy guide explains what that owner should put in writing.
Book a 15-minute call
Copilot runs as a project, and it starts with a conversation about your Microsoft 365 setup and what you want Copilot to do. Call 0800 242 206 or book a 15-minute call to start.
Or call 0800 242 206
