Microsoft 365 Copilot for business: what it costs, what it does and is it secure?

Your business runs on Microsoft 365 and Copilot is already in your toolbar. The question is no longer whether you'll deal with it, but whether to buy licences, for whom, and what to sort out first. Because Copilot is only as secure as the permissions in your own environment.

First, the name. Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat. Licences and documentation will use the old names for a while (Microsoft). We use the names on the pricing page.

Which versions of Copilot are there?

There are three levels. The main difference is which data Copilot uses (Microsoft).

• Copilot Chat: included at no extra cost in eligible Microsoft 365 plans. Works with web data. It only uses your own documents if you upload them or have them open, for example in Outlook or Teams.
• Copilot in the apps without an extra licence: standard access in Word, Excel, PowerPoint and OneNote. More limited, and dependent on the capacity Microsoft has available at the time.
• Copilot as a paid add-on: searches your email, files, calendar and Teams conversations by itself, with priority access and the full feature set in the apps.

For organisations with up to 300 users, the add-on is called Microsoft 365 Copilot Business. You add it to Microsoft 365 Business Basic, Standard or Premium, Microsoft 365 Apps for Business or Teams Essentials (Microsoft). Larger organisations take the enterprise version, for example with E3 or E5.

What does Copilot cost for business?

On 17 October 2026, Microsoft's Dutch pricing page lists Microsoft 365 Copilot Business at €18.20 per user per month on an annual plan, excluding VAT. From 1 July to 31 December 2026 there's a promotional price of €15.60, for the first year only. On a monthly plan it's €21.84 per user per month. The add-on is for up to 300 users and requires an eligible Business plan. Prices differ by country, so check the page for your market.

That page doesn't list a price for the enterprise version. Prices and promotions change, so check the page before you do the maths.

And don't budget for licences alone. People need to learn what Copilot is good at and where it falls short, and your environment needs to be in order before you roll out. That takes more time than the purchase.

What about Copilot Pro for business?

Copilot Pro was a subscription for personal use. Microsoft no longer sells it, and support ran until 1 August 2026 (Microsoft). For work with company data, the business add-on is the route: it falls under your organisation's management and agreements, not under one employee's account.

What does Copilot do in Word, Excel, Outlook and Teams?

Microsoft lists, among others, these features per app (Microsoft):

• Word: drafting, rewriting and summarising documents.
• Excel: analysing data and creating formulas and charts.
• Outlook: drafting emails, summarising threads and giving tips on tone and clarity.
• Teams: summarising and transcribing meetings and capturing action items.
• PowerPoint: creating a presentation from a prompt or an existing document.

With the paid add-on, Copilot also uses your own context. "What did we agree with this customer this month?" then works across email, chats and meetings. Without the add-on, you supply that context yourself.

Where Copilot does little: work outside Microsoft 365. It can't see your accounting software, CRM or scheduling system unless someone builds an integration or agent for it.

Is Copilot secure? It comes down to permissions

Microsoft says it plainly: Copilot only shows data the user has at least view access to, and it's up to you to set permissions correctly in SharePoint and elsewhere (Microsoft).

That's reassuring, and it's also the risk. In many environments, folders have been open to everyone in the organisation for years. A salary overview on the wrong SharePoint site, the folder of a director who left, a Teams channel with customer contracts. Without Copilot, nobody found those files. With Copilot, one question is enough. That's oversharing: the permissions were always too broad, and Copilot makes it visible.

What to sort out first:

• Map which sites, folders and teams are open to the whole organisation.
• Lock down sensitive areas: HR, salaries, management, contracts.
• Give documents that shouldn't show up in answers a sensitivity label. Copilot respects the rights such a label grants.
• Roll out in phases, starting with a group whose permissions you know.

Microsoft points to tools such as SharePoint Advanced Management, which helps you find overshared sites and temporarily keep content out of Copilot answers, and Microsoft Purview for labels and reviewing prompts and responses.

Copilot and the GDPR

According to Microsoft, prompts, responses and the data Copilot retrieves from your environment aren't used to train the underlying language models. Copilot is covered by the existing Microsoft 365 commitments, and for EU users the traffic stays within the EU Data Boundary (Microsoft).

Two caveats. Copilot can also use Anthropic's models, and according to the same page those are currently excluded from the EU Data Boundary. Your admin decides whether they're switched on. And Microsoft handling its side doesn't mean your processing is in order. You still need a legal basis, an entry in your record of processing activities and clear rules on which data can go in. High-risk processing needs a DPIA. See AI Act and GDPR: what you need to arrange now.

The EU AI Act also requires you to take measures for your staff's AI literacy, even if you only use Copilot. See the AI literacy requirement. Put the rules in your AI policy.

Copilot or ChatGPT?

If your work lives in Outlook, Word and Teams, Copilot is the natural starting point: it knows your email and your documents. ChatGPT is stronger for open-ended tasks and experimenting. Many businesses use both. The ChatGPT side is covered in ChatGPT for business.

When is Copilot enough, and when isn't it?

Copilot is enough when the work is writing, summarising and finding things within Microsoft 365, and an employee asks the question.

It isn't enough when:

• the work has to start on its own, for example with every new email in a shared mailbox. See automating email processing in Outlook.
• the result has to land in another system, such as your accounting software, CRM or schedule.
• you want a record per action of what happened and who approved it.

Then you need an integration or your own agent. What's possible with your Microsoft data is described under the Microsoft 365 integration. What you can do yourself with Copilot Studio, and where custom work begins, is in building your own AI agent. For fixed steps within Microsoft 365, Power Automate may be enough; see Power Automate or an AI agent.

How do you start?

• Tidy up permissions first and agree which data can go into Copilot.
• Start with a small group that does a lot of email and document work.
• Give that group a hands-on session using their own work, not other people's examples.
• After a few weeks, look at who uses it and for what, then decide on more licences.

Want to get your team going with their own documents and their own questions? The AI workshop is a good place to start. Want to know where Copilot stops and an integration delivers more? We map that out in the AI Opportunity Audit.

Sources, checked on 17 October 2026: Microsoft: Copilot pricing, Microsoft: licence options, Microsoft: what is Microsoft Copilot, Microsoft: data, privacy and security, Microsoft: about Copilot Pro.