Before Microsoft Copilot will work safely, your business needs the right Microsoft 365 licences, tidy file permissions, multi-factor authentication and a clear data structure. Copilot surfaces anything a user can already access, so weak permissions become a live risk the moment you switch it on. Here is the full prerequisites checklist for 2026.
What Microsoft Copilot Requires Before It Switches On
Most Christchurch business owners think simply buying a Copilot licence gets the job done. It doesn’t. Copilot relies on Microsoft 365. It only performs well if the setup underneath it is right. We’ve walked into a few offices where the licence was active for months, but Copilot barely worked. The necessary groundwork was missing, you see. That’s the honest story behind the Copilot requirements discussions we have with clients these days.
Here is the core truth. Copilot doesn’t create new data. It reads and summarises what your business already holds in Microsoft 365. Think emails, SharePoint files, Teams chats, and OneDrive documents. So if your data is a mess, Copilot’s answers will reflect that mess. Garbage in, garbage out. That’s not a new rule, but it is much more visible now.
The Licence Layer
First, you need the right Microsoft 365 plan. Copilot for Microsoft 365 requires a qualifying base licence. That’s usually Business Standard, Business Premium, E3, or E5. Without one of these, the Copilot add-on will not activate. We’ve seen IT teams try it over and over, but it just won’t switch on.
- You need a qualifying Microsoft 365 subscription (Business Standard or higher).
- Azure Active Directory, now called Microsoft Entra ID, must be configured properly.
- Each user needs an individual assignment; Copilot doesn’t work on shared or generic accounts.
That last point catches people out. We see this mistake all the time. Small teams try to save on cost by sharing one login. Then they wonder why Copilot behaves oddly, or won’t start at all.
The Data Layer
Second, your content needs structure. Copilot pulls from SharePoint and OneDrive. It uses something called the Microsoft Graph. If your files are scattered, duplicated, or still sit in old shared drives instead of SharePoint, Copilot has nothing solid to search. And if permissions are wrong, Copilot might show a document to someone who shouldn’t see it. That is not a Copilot problem, it’s a data governance problem. Copilot just shows it.
Third, your tenant needs sensible information governance. Microsoft recommends businesses apply sensitivity labels and data loss prevention policies. Do this before rolling out Copilot broadly. This isn’t just a tick-box exercise. It stops Copilot from accidentally showing sensitive HR files or financial records. It keeps them from the wrong staff member during a simple search prompt.
The Identity and Device Layer
Fourth, identity security needs to be strong. Multi-factor authentication should be on for every user. Not just for admins. And fifth, devices accessing Copilot must meet basic security standards. That means updated operating systems, managed endpoints. No ancient unsupported machines still running old software versions.
One Christchurch client called us. They thought Copilot was broken. Turns out half their staff used outdated Windows builds. And their SharePoint was really just a dumping ground of unsorted folders from 2016. Copilot wasn’t broken, you see. The whole foundation was shaky.
Before you flick the switch, run through this quick mental checklist:
- Confirm your Microsoft 365 licence tier supports Copilot.
- Check every user has their own named account.
- Review SharePoint and OneDrive for structure and old permissions.
- Apply sensitivity labels where they’re needed.
- Turn on multi-factor authentication tenant-wide.
- Update or retire outdated devices.
Get these six things sorted. Copilot then has a real chance to be useful. Not just expensive.
Why Your Data Permissions Matter More Than Your Licence
Buying a Microsoft 365 Copilot licence is the easy bit. The hard part is fixing what Copilot can see once it’s switched on. Copilot doesn’t create new access rules. It works inside the permissions you already have in place. So if your SharePoint sites, OneDrive folders, and Teams channels are a mess, Copilot will happily surface that mess. It will show it to any staff member who asks the right question.
We see this error all the time. A business rolls out Copilot licences to twenty staff. They feel good about the upgrade. Within a week, someone in accounts asks Copilot to summarise “recent HR discussions.” They get back wage details for the whole team. Nobody granted that access on purpose. It happened years ago, through an old shared link. No one remembered to remove it, by the way.
Microsoft’s own documentation confirms this. Copilot respects your existing permission model. It does not audit or correct it for you. That’s your job. Or it’s ours, before you go live.
Common Permission Problems Before Copilot Goes Live
Before you flip the switch, walk through your tenant. Look at it with fresh eyes. Ask yourself: who can see this file, and should they? Most Christchurch SMBs we work with find at least one of these issues. They are often sitting quietly in their environment:
- Old “anyone with the link” sharing on sensitive SharePoint documents.
- Staff who changed roles but kept access to their old team’s files.
- Shared mailboxes with far more members than they need.
- Guest accounts from contractors who finished work months ago.
- Broad “Everyone” or “All Company” groups applied to finance or HR sites.
Any one of these turns Copilot into a data exposure risk. It changes it from a helpful assistant. And the risk isn’t just hypothetical. It becomes a compliance and privacy problem the moment someone runs the wrong search.
Here’s the thing. A tidy licence spreadsheet tells you nothing about your actual exposure. You need a proper look at your permission structure. That means across SharePoint, OneDrive, and Teams. Not just a count of who has a Copilot seat.
This is exactly the kind of gap we find during a security assessment. We map out who has access to what. Then we flag anything that looks stale or too broad. We tighten it all up before Copilot goes anywhere near your data. It’s a straightforward job for us. We’ve done managed IT and cyber security work across Christchurch since 2005. But it’s easy to overlook if you are not doing this daily.
One more thing worth knowing: fixing permissions after Copilot has already indexed your content still helps. But doing it beforehand saves you from awkward conversations about who saw what. Get the access model right first. Then the licence earns its keep.
If you’re planning a Copilot rollout, it’s worth getting a proper look at your permissions and data governance first. Book a free IT and security review with our team on 0800242206, or get in touch through our website. We will tell you exactly what’s sitting exposed before you switch anything on.
Is Your Business Ready? A Quick Scenario Check
Most Christchurch business owners don’t know if they’re ready for Copilot. Not until someone turns it on and nothing works properly. We see this a lot. A client calls excited about AI, tries the trial, and gets vague answers. Or blank responses. The groundwork wasn’t done first. So before you commit, run through a few real scenarios. They will tell you more than any checklist ever could.
Scenario one: the 40-staff firm on old licensing. Say you run a professional services business. It’s in central Christchurch with 40 staff. You use Microsoft 365 Business Standard. You’ve heard Copilot will save your team hours each week. But Business Standard doesn’t support Copilot. Not the way Business Premium or E3 does. Without the right licence tier and proper identity setup in Entra ID, you can buy the add-on. You will still get patchy results., this is the part most people overthink. It is also the single most common gap we find during readiness reviews.
Scenario two: the trades business with messy file storage. Picture a construction or trades company. They still store job files on a local server. Or in a jumble of shared drives. Some synced, some not. Copilot draws its answers from your organisation’s data in SharePoint and OneDrive. If your files aren’t there, or permissions are a mess, Copilot either can’t find the right information. Or worse, it surfaces something it shouldn’t. And that is a real risk if old contracts or wage details are sitting in folders with loose access rules.
Scenario three: the accounting firm worried about compliance. An accounting or financial services firm often asks us the same question. Will Copilot leak client data? Fair question. The honest answer is it depends entirely on your existing data governance and sensitivity labelling. If that hasn’t been set up, Copilot can’t tell the difference. It won’t know between a public newsletter draft and a confidential client file.
Here’s a quick self-check. Answer these:
- Are you on Microsoft 365 Business Premium, E3, or E5? Not just Business Standard or Basic?
- Is most of your team’s work already stored in SharePoint or OneDrive? Not local drives or USB sticks?
- Do you have multi-factor authentication switched on for every user?
- Has anyone reviewed who has access to sensitive folders in the last 12 months?
- Do you know what “oversharing” means inside your own SharePoint sites?
If you answered no to two or more of those, you’re not alone. Most businesses we assess land here on their first pass. That’s not a failure. It’s just where the work starts.
We run these scenario checks with clients across Christchurch every week. We often find the same three or four gaps. Regardless of their industry. The pattern is consistent enough that we built a proper readiness process around it. If you want to see where your business stands, it’s worth getting a straight answer rather than guessing. Call us on 0800242206.
Related reading
- Do you really need Microsoft Copilot?
- Copilot licensing tiers and pricing
- What an AI readiness audit covers
- What AI governance means
Frequently asked questions
You can check some things yourself, but a professional review catches issues you might miss. You can look at licence tiers and multi-factor authentication on your own. Finding stale permissions, old sharing links, and messy SharePoint structures takes a trained eye. Many Christchurch business owners think their setup looks fine until someone maps every folder and access point. That's when the real problems show up. If you want peace of mind before switching Copilot on, a proper assessment against a Copilot prerequisites checklist is worth the time.
The biggest misconception is that buying a Copilot licence means it's ready to use. Copilot only reads and organises what's already inside your Microsoft 365 tenant. It cannot fix messy files, wrong permissions, or weak security on its own. We've seen offices with active licences for months where Copilot barely worked, because the groundwork underneath was never done. Think of the licence as the key, not the whole car. You still need the engine tuned before it drives properly.
Older shared drives make Copilot less useful because it can't search them properly. Copilot pulls information through Microsoft Graph, which works with SharePoint and OneDrive, not old network drives. Plenty of Christchurch businesses still store years of documents on legacy shared folders from previous office setups. If that's where your files sit, Copilot has little to work with when staff ask it questions. Moving files into SharePoint with clean structure gives Copilot something solid to search and summarise.
Microsoft Entra ID is the identity system that controls who can log in and what they can access. It used to be called Azure Active Directory. Copilot needs each user set up with their own named account inside Entra ID. It won't work properly on shared or generic logins. Small Christchurch teams sometimes share one account to save time. This causes Copilot to behave oddly or refuse to switch on. Individual accounts, set up correctly, are a basic prerequisite.
Copilot shows files people shouldn't see because it follows your existing permission settings, not new rules of its own. If an old "anyone with the link" share or an outdated group permission exists in SharePoint, Copilot will surface it during a normal search. This isn't a fault in Copilot. It's a sign your data governance needs attention before rollout. Reviewing permissions across SharePoint, OneDrive, and Teams first stops this kind of accidental exposure from happening once staff start using Copilot daily.
