Microsoft 365 Copilot

Copilot is not 'ChatGPT with your files'. It is a retrieval pipeline wrapped around a model, and every capability, limitation and security property falls out of that pipeline. Walk one prompt through it and the product stops being magic.

'Copilot' is one brand across a dozen SKUs, and the 2026 landscape added agents with their own money model. This is the map that stops the licensing confusion that every admin forum thread is made of.

The meeting every admin eventually sits in: 'is our data safe in Copilot?' Here is the boundary, drawn precisely — processing, storage, residency, training — with the proofs, and the places where YOUR configuration decides.

Between your files and the model sits an index that decides what Copilot can find at all. Its refresh cadence, its scope and its blind spots explain the daily mysteries: the missing new document, the ghost of a deleted one.

Your CIO is comparing them on model quality. The real decision axes are grounding, governance surface and identity integration — structural properties that don't change with next month's model release.

'Copilot respects permissions' is true and insufficient. What it respects is your EFFECTIVE access graph — sharing links, group nesting, 'Everyone except external users' — evaluated at query time. Walk the graph like Copilot does.

Every other grounding source lives inside your boundary; web grounding sends something OUT. Know exactly what leaves, who can toggle it, and how to hold a defensible position between 'useful' and 'leaky'.

A connector doesn't let Copilot visit your wiki — it copies the wiki INTO the index, with whatever permission mapping you configured. Ingestion-time decisions become answer-time facts, so make them like an architect.

Copilot increasingly remembers — stated preferences, facts you told it, patterns from your work graph. Useful, and a governance object nobody assigned an owner: where memory lives, who can see it, how it dies.

The #1 Copilot governance incident is not a breach — it is Copilot politely answering with a document the asker could always open. The remediation toolkit (SAM, Restricted Content, labels) is free with your first Copilot seat; the runbook is here.

Microsoft's answer to 'where do I govern all this?' is a named framework spanning three portals. Here is what lives where, what each lever really does, and the gaps the framework doesn't close by itself.

Purview DLP grew a Copilot location: policies that stop labeled content being processed into answers. It is the durable content control — and its honest limits define where the rest of the toolkit must still carry weight.

Labels and Copilot interact in four distinct places — grounding, generation, inheritance and encryption — and each interaction has its own rule. Know the four and every 'what happens if it's labeled' question answers itself.

Microsoft's own guidance says stage it; here is the staged model with actual GATES — the artifacts each stage must produce before the next spend, so the programme survives its first executive challenge.

The richest Copilot surface — and the one with the longest dependency chain: policy, transcription, retention and licence all have to agree before 'what did I miss?' works. The chain is mapped in detail in our Teams curriculum; this is the Copilot-side view.

Four apps, four different Copilots wearing one badge — each grounded differently, each with a capability ceiling users discover by disappointment. Publish the expectations table before they write it themselves.

Copilot Chat is the front door for every employee — included, two-mode, and the place your licensing tiers and agent strategy all converge. Understand the tabs and you understand who experiences what.

The AI era's artifacts: Pages turn answers into durable, co-editable canvases; Notebooks ground Copilot on a curated pile. Both are CONTENT with normal governance — once you know which store they land in.

'Agent' covers three architectures with different hosting, different licensing and different risk. Classify an agent correctly and its governance, cost and review path all follow automatically.

2026 made agents first-class identities: every new Studio agent gets an Entra Agent ID, and Agent 365 is the control plane that treats your agent fleet like a workforce — because that is what it now is.

Studio is Power Platform's child: environments, connectors, DLP and maker culture all apply — plus knowledge, topics, actions and channels of its own. Govern it like Power Platform or relive that movie.

Remove the human turn-taking and an agent becomes a worker: triggered by events, pursuing goals, taking actions at machine speed. The design discipline is bounding what it can do between human checkpoints.

Between 'a maker built it' and 'the company uses it' sits the deployment pipeline: submission, admin approval, and population targeting — the same machinery as Teams apps, now carrying AI.

The extensibility decision tree starts here: if Copilot just needs to KNOW something, a connector beats an agent every time. This is the engineering view of the data-plane concept — building the pipe well.

Actions let Copilot DO things: query live systems, create records, call your APIs mid-conversation. Run-time power means run-time risk — auth on whose behalf, egress to where, and consequences reviewed like the API calls they are.

Four ways to build for Copilot, from a JSON manifest to a full custom engine. Choose by team skill, risk class and where you want the operational burden — not by whichever demo you saw last.

The agent world is converging on open protocols — MCP for tools/context, agent-to-agent patterns above it — and Microsoft's stack has been adopting them. What that buys you, and the governance questions protocols don't answer.

AI added genuinely new attack surface: instructions hiding in content, agents as confused deputies, extraction at conversational speed. The threats have mechanisms; the mechanisms have mitigations — most of them controls you already met in this curriculum.

Every Copilot conversation is a record: stored, searchable, produceable. That settles some disputes and creates others — and legal will meet these records mid-case unless you introduce them first.

Prompts and responses are a NEW record class, and Purview retention has a location aimed at it. Pick the stance deliberately — the default is 'kept indefinitely by inertia', which is a decision too, just nobody's.

Purview's Data Security Posture Management for AI is the dashboard this whole curriculum keeps citing: oversharing risk, sensitive-data-in-prompts, BYO-AI visibility. Read it like a vulnerability scanner — findings, owners, SLAs — not like a poster.

The forum threads repeat the same dozen questions — about trust, cost, reliability and 'why is it disappointing'. Here they are with straight answers, because the person asking next is in your tenant.

The renewal will be decided by two numbers — seats used and value evidenced — and both take a quarter to build. Instrument on day one; narrate with task math, not vibes.

June 2026 settled the argument: Copilot outages are now office-availability incidents. The Teams resilience discipline applies — outage classes, degraded-mode cards, comms — with AI's own twist: quality can fail without availability failing.

Copilot spend has become three meters running at different speeds: per-seat licences, consumption credits, and the agent-governance overlay. Manage each with its own discipline or reconcile them for the first time in a renewal crisis.

No admin setting moves answer quality as much as the user's prompt — and no rollout survives on licences alone. The adoption programme IS a product feature; run it like one.