Turning on Copilot is quick. A good start does call for a few deliberate choices. In this guide we walk you through ten first steps that we see matter again and again in practice. You will read how Copilot works and which licenses are available. You will also read what to watch for around data and costs, and how to get real value from Copilot step by step.

These are considerations from our practice. They are not requirements and not a complete checklist. You will find the full disclaimer at the bottom of this article.

The ten steps at a glance

Step	Consideration	Why
1	Appoint an owner	Someone needs to keep track of settings, choices and changes [19].
2	Decide on processing outside the EU	This choice affects models, web search and flex routing [18][23][24].
3	Map oversharing	Copilot finds everything an employee is allowed to open, including content that is shared too widely [5][20].
4	Protect sensitive information	With labels and DLP rules you decide what Copilot may not use [16].
5	Update privacy and policy	Your documentation should match the way you use AI.
6	Consider the AI disclaimer	Employees see right away that AI output can be inaccurate [21].
7	Record settings and choices	So you can explain later what you chose and why.
8	Keep control of agents and costs	Paid features use credits on top of the license [4][12][25].
9	Train employees hands-on	Copilot only creates value once people use it in their own work [22].
10	Review periodically	Features and default settings change regularly.

Part 1. Understand what you turn on

How does Copilot work?

Copilot answers based on context. That is the document you are working in, supplemented with data retrieved through Microsoft Graph [1]. Copilot only sees what the employee is allowed to see. It gives no one extra permissions, but it does reveal what is shared too widely [2]. Just like with a colleague: the better the question and the source, the better the answer. That is why setup and training come back together throughout this guide.

Which license fits your organization?

Option	What you get	Cost
Microsoft 365 Copilot Chat	Secure chat based on web information, with file uploads and Pages [10].	Included with almost every Microsoft 365 subscription.
Microsoft 365 Copilot	Through Microsoft Graph, Copilot also works with your own files, mail, chats and meetings. You get Copilot in Word, Excel, PowerPoint, Outlook and Teams, plus Researcher and Analyst [10][11].	Fixed price per user per month.
Copilot Credits	Heavier AI features and agents on top of or alongside the license [12].	Pay as you go or prepaid.

💡 Tip: consider giving the paid license first to people who work a lot with documents and meetings. Then expand based on actual usage.

What are Copilot Credits?

Copilot Credits are the shared currency for AI features that are billed by usage. How much you use depends on how heavy a task is. Credits are shared across the organization. You pay up front or afterwards based on usage [12][27]. Good to know: a Copilot license does not include any credits itself.

Feature	What it does	Note
Cowork	Carries out tasks in Microsoft 365 on behalf of the employee, such as research, creating documents and scheduling meetings, with fixed approval moments [13].	Requires a Copilot license and uses credits. You manage access through a spending policy [12][14].
Autopilot	An agent announced by Microsoft that works independently and continuously, with its own identity within the tenant.	In preview at the time of writing. Availability and price may still change.
Code	Builds apps from plain language.	Billed by usage and requires a Copilot license. Currently available through the Frontier program [12].
Copilot Studio	Lets you build your own agents and workflows that use data and take actions [27].	Managed and billed separately through the Power Platform [27].

Note: this guide does not cover Copilot Studio. Copilot Studio runs through the Power Platform and calls for its own choices, such as environments, connectors, DLP policies and billing plans.

Part 2. Organize the basics

Step 1. Appoint an owner

A good start begins with ownership. Agree on who manages Copilot, internally or through your IT partner. Consider a limited role such as AI Administrator instead of broad admin rights. People who only need to look along can get the Global Reader role [19].

Step 2. Decide on processing outside the EU

A few settings in the admin center determine whether data can also be processed outside the EU. These three deserve attention in any case:

Setting	What it means
AI subprocessors	According to Microsoft, Anthropic's models fall outside the EU Data Boundary and are off by default in the EU [18]. According to Microsoft, OpenAI's models fall within the EU Data Boundary, with a few exceptions, and have been on by default since July 24, 2026 [23].
Flex routing	During peak demand, Microsoft can temporarily process requests in the US, Canada or Australia [24].
Web search	Copilot sends a shortened search query to Bing, without the full prompt and without files. These queries are not covered by Microsoft's DPA and EU Data Boundary [7].

Turning these settings off can reduce the risk of data transfers. You do give up features, freshness and sometimes speed. No single choice is right for every organization. So record what you choose and why.

Part 3. Protect your information

Step 3. Map oversharing

Copilot uses the permissions that already exist. With the paid license, Copilot searches files, mail, chats and meetings through Microsoft Graph [1][10]. Anything an employee is technically allowed to open, Copilot can find and summarize within seconds. That includes information the employee would never have found on their own. A salary list in an open folder used to be hidden. Now one question can be enough.

That makes cleaning up oversharing more important than ever. Start with these points, for example:

Check which sites and folders are open to the whole organization.
Review the default link type, external sharing, link expiration and who the site owners are.
Clean up or archive outdated versions.
Use Microsoft's guidance and tools, such as SharePoint Advanced Management [5][20]. With Restricted Content Discovery you can temporarily make sites harder to find. The permissions themselves do not change [17].

Step 4. Protect sensitive information

Because Copilot combines many sources in a short time, it can pay to decide in advance what Copilot may not use. With sensitivity labels and Microsoft Purview DLP rules you can, for example, prevent Copilot from processing prompts that contain credit card or passport numbers. You can also exclude files and emails with a specific label [16].

💡 Tip: first decide which information needs protection and test your rules before turning them on broadly.

Step 5. Update privacy and policy

Consider updating your privacy statement and internal policy for the use of Copilot. Also have someone assess whether a DPIA is needed. That is a privacy risk assessment you carry out in advance. According to Microsoft, prompts, responses and Graph data are not used to train the underlying models [2].

Part 4. Set up management smartly

Step 6. Consider the AI disclaimer

This setting is off by default. When you turn it on, Copilot shows employees that AI output can be inaccurate, with a link to your own AI policy [21]. It is a small setting that helps set the right expectations.

Step 7. Record settings and choices

Go through the Copilot settings in the admin center one by one [3][19]. Most settings link to Microsoft's documentation. For each decision, note the date, the owner and the reason. That helps with management and with questions from an auditor, a customer or your data protection officer.

These settings deserve extra attention:

Setting	What to watch for
AI subprocessors	This lets Copilot also use models from Anthropic (Claude) and OpenAI. Each model has its own strengths, so Copilot can use the best model for each task, for example in Researcher and Cowork. You decide per provider whether this is on [18][23].
Flex routing	Keeps Copilot fast during peak demand by temporarily processing requests outside Europe. On newer tenants this is on by default [24]. With a strict EU data policy, you can consider turning it off.
Agent settings	Decide who may use agents, which types are allowed and who may share agents with the whole organization [4].
Billing policy	Features such as Cowork and Code are billed in credits through Copilot Cost Management. Consider a spending policy with a monthly limit, a per-user limit and alerts [12][26]. The option that automatically adds new services to a policy is on by default [12]. If you want to review new services yourself first, consider turning that option off.

Step 8. Keep control of agents and costs

Agents and features such as Cowork use Copilot Credits on top of the license [12][14]. A few agreements up front prevent surprises:

Decide in the admin center which agents are available and who may install, build and share them [4].
Set limits and alerts in Copilot Cost Management before you open up paid features [12][25].
Don't want a group to have access to Cowork? Then exclude that group from every policy that includes Cowork [14].
Start with a pilot group and a hard limit. Review usage weekly during the first weeks.

Read more about credits and pricing models in Copilot Credits and pay as you go: how Microsoft Copilot pricing works in 2026. Which kind of agent fits your organization is covered in Copilot Agents and Copilot Studio: which one do you choose?

Part 5. Get real value from Copilot

Step 9. Train employees hands-on

A license on its own delivers little. In practice we often see the same pattern: people try Copilot a few times, get a mediocre answer and give up. That is usually not Copilot's fault, but the question, the app or the source. Hands-on training changes that. Employees practice with recognizable tasks from their own work, see right away what it delivers and learn where the limits are. That builds confidence and makes Copilot part of the daily routine.

In addition, Article 4 of the EU AI Act requires organizations that use AI to ensure a sufficient level of AI literacy [22].

From first question to your own agent

You get more out of Copilot as you use it more broadly and more smartly. A logical progression could look like this:

Level	Where	Practical value
Basics	Copilot Chat	Asking questions, drafting text, developing ideas and summarizing information. This is also where you learn to prompt well: goal, context, desired format and source.
Mail and meetings	Outlook and Teams	Summarizing long email threads, writing draft replies, summarizing meetings and listing action items.
Documents	Word	Creating a first draft from existing documents, rewriting text and summarizing long documents.
Numbers	Excel	Analyzing data, spotting trends, having formulas explained and creating overviews.
Presenting	PowerPoint	Setting up a presentation from a document and adapting existing slides.
Finding knowledge	SharePoint	Asking questions about documents and quickly finding the right information. The better your information is organized, the better the answers.
Going deeper	Researcher and Analyst	Doing more extensive research across multiple sources and diving deeper into data [15].
Follow-up sessions	Agents, Cowork, Code and Autopilot	Building your own agents for recurring tasks, discovering how Cowork carries out tasks and exploring new developments. These features often use credits and are partly still in preview. So take care of steps 7 and 8 first.

Tips for training that sticks

Work with your own tasks. Recognizable examples from people's own roles work better than generic demos.
Choose the right mode. Show when to use Quick Response or Think Deeper [10].
Learn to prompt well. Microsoft also offers a free learning path for this [8].
Keep checking. Copilot can make mistakes. The employee remains responsible for what they use or send.
Build together. Have each team pick a few recurring tasks and build a shared prompt library.
Grow step by step. People who master the basics get more out of agents and Cowork later on.

Step 10. Review periodically

Copilot is not something you set up once and then leave alone. Microsoft changes features and default settings regularly. So review the Message Center, the Copilot settings, the audit logs and the retention periods every quarter, for example. Measure usage through the usage report and the Copilot Dashboard [6][9]. Plan an evaluation after a few weeks so you can adjust. How to measure what Copilot delivers is covered in Calculating Copilot ROI: what does Microsoft 365 Copilot really deliver?

Five pitfalls to avoid

Pitfall	Better
Handing out licenses without training	Train up front and offer guidance
Turning on paid features without a limit	Set budgets and alerts first
Starting without reviewing permissions	Clean up oversharing before you roll out
Presenting Copilot as flawless	Stress that you always check the output
Not measuring	Measure from the start so you can evaluate properly

In closing

A good start with Copilot comes down to three things: knowing what you turn on, having your information in order and bringing employees along from the start. Get that right and you lay the foundation for Copilot to really work. A good start also takes less time than fixing a bad one.

How AmeCoda can help

AmeCoda helps organizations use Microsoft 365 Copilot more smartly, more effectively and responsibly. Read more about our services on amecoda.com.

What we help you with	What we don't help you with
Workshops and training on every Copilot topic, from the first steps to follow-up sessions on agents and Cowork	Setting up, configuring or managing your Microsoft 365 environment, admin center or security
Advice and thinking along about the considerations in this guide, for example in a partner program	Making final decisions about settings, policy and privacy

You always make final choices together with your IT administrator and the person responsible for legal or privacy matters. Need help with the technical setup and security? We are happy to put you in touch with an IT company from our network that can take care of this for you.

Get in touch for a short introduction. We are happy to look together at where you stand and how Copilot can help your organization move forward.

View our services

From advice to workshops and e-learning: this is how we help you move forward with Microsoft Copilot.

Disclaimer

This article has been compiled with care based on best practices and public information from Microsoft, as available at the time of publication. Microsoft regularly changes features, settings, license types and prices. Some features are in preview or only available through the Frontier program. Information may therefore differ over time.

The steps and settings mentioned are considerations, not requirements. The overview is not exhaustive and topics that matter for your situation may not be covered here. Depending on the environment, licenses, region, sector, customer contracts and organization size, other or additional settings and measures may be needed. The management environment and the available settings can also differ per organization. Larger organizations, for example, often work with several admin portals, such as Microsoft Entra, Microsoft Purview, the SharePoint admin center and the Teams admin center.

The content is intended as general information and not as legal, tax or technical advice for a specific situation. This also applies to documents and considerations we share with you within partner programs. No rights can be derived from this article. AmeCoda accepts no liability for damage resulting from the use of this information or from decisions based on it. The choice of settings, licenses and policies remains the responsibility of the organization itself. Always consult Microsoft's official documentation and your own agreements. Consult your IT administrator and the person responsible for legal or privacy matters when making choices.

Microsoft, Microsoft 365, Copilot and other product names mentioned are trademarks of Microsoft Corporation. AmeCoda is an independent Microsoft Copilot specialist offering training, e-learning and advice to businesses. AmeCoda operates independently and is not affiliated with Microsoft.

Copilot Start Guide: how to get started well with Microsoft Copilot