Preparing a Microsoft 365 Tenant for Copilot in Late 2026

A Swelling Mass of Microsoft Copilot Licenses

In their FY26 Q4 results, Microsoft reported that “over 30 million” people have paid for Microsoft 365 Copilot licenses, or just about 6.75% of the Microsoft 365 installed base. Although Copilot users still represent a small percentage of the Microsoft 365 installed base, the numbers show that customer adoption is accelerating 42 months after the March 2023 launch.

Microsoft 365 tenants were unprepared for AI when Microsoft announced Copilot. Digital debris had happily accumulated over years, permissions were an unmanaged jungle, dead and dying sites were endemic, and security happened through obscurity rather than well-planned protection. It’s fair to say that the technical landscape is very different now. A range of tools and functionality is available to tenants considering Copilot deployments. But because it’s hard to keep track of the changes pushed out to tenants, it’s worth asking what steps organizations should take today to prepare for Copilot. This article summarizes my best advice about:

1. Securing confidential and sensitive information.
2. Tightening management of access to files held in SharePoint Online and OneDrive for Business.
3. Limiting AI access to information that the company is happy for AI to process and reuse.

All the actions listed below can be put in place before a full Copilot deployment commences. In fact, clearing up SharePoint Online is an excellent project for any Microsoft 365 tenant, even if you never think that Copilot will be used.

Licensing

The first thing to do is to buy a small number of Microsoft 365 Copilot licenses to use for testing, early deployment, and for tenant preparation. The presence of a single Copilot license liberates a bunch of SharePoint Advanced Management functionality that you’ll want to use right from the start.

Another licensing consideration is to review your licensing mix. Office 365 E5 or its Microsoft 365 E5 (or E7 if you must) equivalent are generally better for Copilot deployments, especially in terms of compliance where features like auto-label policies, default labels for sites, longer audit retention, and DLP for Teams become available.

Cleaning up SharePoint Online

Mismanagement of SharePoint Online is responsible for many data leaks. Microsoft’s insistence on using OneDrive for Business as the repository for files generated from Microsoft 365 apps can also lead to the accrual of a great deal of digital dross. AI cannot distinguish between authoritative information and outdated, inaccurate, or duplicated content. Files are files, and if the information in Microsoft Search and the semantic index leads Copilot to a file, it will use it to generate responses to user prompts. This is why much of the work to prepare a tenant revolves around SharePoint Online.

Use the data access governance reports available for SharePoint Online to highlight problems that might exist with oversharing and permissions (Figure 1). The key point to remember is that Copilot is extremely good at finding information that the signed-in user has access to, even if the user has completely forgotten that someone shared a site with them sometime in the past.

Another goal is to reduce the use of Anyone sharing links as much as possible. Again, it’s all about restricting Copilot access to information you want it to use rather than anything that Copilot can find.

Site Architecture

Since the launch of Microsoft 365 Groups in 2015 (then Office 365 Groups) and especially since Teams came along in early 2017, tenants have experienced an explosion in the number of sites. Carefully-planned site architectures went out the window as users created teams which created sites, many of which became defunct in a short period.

• Use Restricted Content Discovery to protect sites containing confidential and sensitive information.
• Identify and mark authoritative sites that you want Copilot to use. Guardrails are always useful.
• Identify sites to archive with Microsoft 365 Archive. Even though they use cheaper “cold” storage, Purview solutions like eDiscovery can access the content of archived sites. However, Copilot is excluded from using archived content, so it’s an excellent way to keep information for extended periods while blocking access to Copilot (and external AI connectors from Claude and ChatGPT). In preview but expected for general availability soon, you can also amend retention policies and labels to move files into Microsoft 365 Archive before the end of their retention period.

An advantage of E5 licenses is that you can use auto-label policies to apply retention and sensitivity labels to files. Default labels for document libraries help to make sure that files are labelled correctly, but given the millions of files stored by tenants, automatic processing is helpful. E5 also includes the use of trainable classifiers in auto-label policies. Trainable classifiers are useful to identify specific file types like invoices, proposals, and so on.

Use Data Loss Prevention

Microsoft has invested heavily in building out data loss prevention (DLP) capabilities to keep Copilot in check. DLP rule conditions and actions are available to stop Copilot processing:

• Files with specific sensitivity labels.
• External email.
• Web searches.
• Prompts containing sensitive information types like credit card numbers.

You might not need every Copilot-related DLP control, but I recommend protecting sensitivity-labelled files and screening prompts that contain sensitive information types. Those controls usually deliver the biggest risk reduction with the least disruption to users.

An Improving Infrastructure

It’s the nature of software to improve over time. Forty-two months ago, Copilot was really only safe for use in carefully curated environments where the source information was prepared for AI use. The infrastructure surrounding Copilot is very different today.

If Microsoft stays still, customers might be tempted to look elsewhere. That’s why updates continually arrive to preserve Microsoft’s edge over competition like ChatGPT Enterprise.

Incidentally, although the license remains Microsoft 365 Copilot, Microsoft appears to be quietly dropping the “365” branding elsewhere. The unified Copilot app for work and personal users, the Copilot hub, and much of the newer documentation (like for Copilot Chat) all emphasize “Microsoft Copilot” rather than “Microsoft 365 Copilot.” Simplification is welcome, even if the latest branding exercise creates extra work for documentation produced outside Microsoft, including the Microsoft 365 for IT Pros eBook.

---

Learn how to use Microsoft Copilot and to exploit the data available to Microsoft 365 tenant administrators through the Microsoft 365 for IT Pros eBook. We love figuring out how things work.