Microsoft 365 and Copilot: What Small Businesses Should Actually Do

Short answer: most small businesses are on the wrong Microsoft 365 plan and have never turned on the security features they are already paying for. Fix that first. Copilot is genuinely useful for some roles and a waste of money for others — buy it for a handful of people who write and analyze all day, not for everyone.

Which plan you actually need

The plan names are deliberately confusing, so here is the practical version for a business under about 300 people.

• Business Basic. Web and mobile apps only, no installed desktop Office. Fine for frontline or shared-device staff. Not fine for anyone who lives in Excel.
• Business Standard. Adds the installed desktop apps. This is where most small businesses land, and where most of them stop.
• Business Premium — Standard plus the security and device-management layer. That means Intune for managing company devices, conditional access for rules about who can sign in from where, advanced threat protection, and data loss prevention to stop sensitive files leaving. This is the one most businesses should be on and are not.

The gap between Standard and Premium is a few dollars per user per month. What it buys you is control. Require multi-factor authentication properly. Wipe a lost laptop from your desk. Block sign-ins from countries you do not operate in. Stop someone who is leaving from walking out with the customer list. Businesses routinely pay for third-party tools that duplicate what Premium already includes.

The settings almost nobody turns on

A fresh Microsoft 365 tenant is not secure by default. It is functional by default, which is a different thing. The items below take an afternoon and prevent the overwhelming majority of what actually happens to small businesses:

• Multi-factor authentication for every account, including admins. Especially admins. This single change stops most business email compromise outright.
• Disable legacy authentication protocols. Old protocols bypass MFA entirely, which makes MFA decorative if you leave them enabled.
• Audit logging on, with a retention period long enough to be useful. After an incident you cannot retroactively create logs you were not collecting.
• Mailbox forwarding rules restricted. The first thing an attacker does after taking a mailbox is set a hidden rule forwarding everything to themselves.
• Conditional access policies. Block sign-ins from regions you never operate in, and require compliant devices for access to company data.
• Separate admin accounts. Your day-to-day account should not be a global administrator. When it is, one phishing click compromises the entire tenant.

None of this is expensive. Most of it is included in what you already pay. It simply requires someone to sit down and do it.

What Copilot actually does

Microsoft 365 Copilot is an AI assistant embedded across Word, Excel, Outlook, Teams and PowerPoint, with access to your organization’s own documents and email. It licenses per user, per month, and the price is not trivial for a small business.

Where it earns its cost, in our experience:

• Summarizing long email threads and meetings. This is the most consistently valuable thing it does. Teams meeting recaps genuinely save time.
• First drafts of documents and proposals. Not finished work, but a starting point beats a blank page.
• Finding things across your own files. It searches meaning rather than filenames, which is how people actually remember documents.
• Excel analysis for people who are not Excel experts. Describing what you want instead of writing the formula.

Where it does not:

• Anyone whose day is mostly in field software, a trade, or a specialist application Copilot does not touch.
• Highly regulated output where every sentence needs checking anyway — verification can cost more time than drafting saved.
• Businesses with disorganized file storage. Copilot answers from your data; if your data is a mess across personal OneDrives, the answers will reflect that.

The prerequisite nobody mentions

Copilot inherits your existing permissions. Copilot can only see what the person asking already had permission to open. That sounds safe, and it is exactly where this goes wrong. In most small businesses that grew a bit at a time, permissions are looser than anyone realises. Copilot will happily surface a document to someone who technically had access but was never meant to go looking. Salary spreadsheets in an over-shared HR folder are the classic example.

This is not a Copilot flaw. It is an existing problem that Copilot makes visible. But it means the honest sequence is: tidy permissions first, then deploy Copilot. Doing it the other way round is how businesses discover their access model was never as tight as they assumed.

Our recommendation

Get onto Business Premium if you are not already. Spend an afternoon turning on the security features you are paying for. Sort out your file structure and permissions. Then buy Copilot licenses for the three or four people who write, analyze and sit in meetings all day, run it for a quarter, and ask them honestly whether they would give it up. Expand from there if the answer is no.

What we would not do is buy it for everyone on day one because it is the thing to do this year. It is a per-user recurring cost, and per-user recurring costs are how software budgets quietly double.

Ask us to review your Microsoft 365 setup — we will tell you which plan you should be on and what you are currently leaving switched off.