Set up Microsoft 365 Copilot admin guide

2025-05-20
Applies to: ✅ Microsoft 365 Copilot

Microsoft 365 Copilot is an AI-powered productivity tool that uses large language models (LLMs). It integrates with your data, with Microsoft Graph, and with Microsoft 365 Apps.

Copilot works alongside popular Microsoft 365 Apps, like Word, Excel, PowerPoint, Outlook, Teams, and more. Copilot provides real-time intelligent assistance, enabling users to enhance their creativity, productivity, and skills.

As part of your Microsoft 365 Copilot adoption, use this article to enable some security features, configure the update channel, and assign Copilot licenses to users.

This article provides guidance for administrators on preparing their organization for Microsoft 365 Copilot. It covers foundational implementation and readiness activities, licensing, and steps to ensure a secure and compliant deployment.

Prerequisites

This article uses the following admin centers. These admin centers require a specific role to complete the tasks in the article.
- Microsoft 365 admin center: There are different roles depending on the task you need to complete. To learn more about roles, see Commonly used Microsoft 365 admin center roles.
- SharePoint admin center: Sign in as the SharePoint administrator.
- Microsoft Purview portal: There are different roles depending on the task you need to complete. To learn more, see:
  - Permissions required to create and manage sensitivity labels
  - Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview
Make sure you have an appropriate subscription plan to purchase Microsoft 365 Copilot. Microsoft 365 Copilot licenses are available as an add-on to other licensing plans. To learn more, see Microsoft 365 Copilot license options.

You can purchase Microsoft 365 Copilot licenses through the Microsoft 365 admin center (Billing > Purchase services), Microsoft partners, or your Microsoft account team.

More licenses might be required to use some of the features describes in this article, like Microsoft Purview and Microsoft SharePoint Premium - SharePoint Advanced Management overview.
Step through and configure the Microsoft 365 app and network requirements for Microsoft 365 Copilot.

Readiness activities

To ensure a smooth transition to Microsoft 365 Copilot, admins should undertake the following readiness activities:

Set up a test environment - Establish a test environment with necessary licenses to validate configurations and test scenarios.
Conduct pilot testing - Perform pilot testing with a select group of users to identify any issues and gather feedback.
Develop a communication plan - Create a communication plan to inform users about the upcoming changes and provide them with the necessary resources and support.
Review Conditional Access policies - Ensure that conditional access policies are appropriately configured. Microsoft 365 Copilot supports tenant-level Conditional Access Policies in SharePoint Online. To learn more, see Conditional Access.
Review SharePoint Search and Advanced Management Policies - Use SharePoint Advanced Management (SAM) to control access to content, prevent oversharing, and manage content lifecycle. For detailed steps, see Get ready for Microsoft 365 Copilot with SharePoint Advanced Management (SAM). Additionally, consider implementing restricted SharePoint search to limit the discoverability of sensitive content. To learn more, see Address internal oversharing concerns in Microsoft 365 Copilot deployment blueprint.
Ensure network compliance - Review and ensure that your network meets the requirements for Microsoft 365 Copilot services. To learn more, see Microsoft 365 Copilot network requirements.

Security measures

To ensure a secure and compliant environment for Microsoft 365 Copilot, it's crucial to implement robust security measures. Some key components are Multifactor authentication (MFA), audit logging, and restricting sensitive information. These measures help protect against unauthorized access and provide visibility into user and admin activities.

Multifactor authentication (MFA)

Multifactor authentication (MFA) is a critical security measure that requires users to provide two or more verification factors to gain access to a resource such as an application or online account. Implementing MFA helps protect against unauthorized access and enhances the security of your organization's data. To learn more, see Microsoft Entra multifactor authentication.

Steps to implement MFA

Enable MFA for all users - Ensure that MFA is enabled for all users in your organization. You can use the Microsoft 365 admin center. To learn more, see Set up multifactor authentication for Microsoft 365.
Configure Conditional Access policies - Set up Conditional Access policies to enforce MFA based on user risk, location, and device compliance. For a tutorial, see Secure user sign-in events with Microsoft Entra multifactor authentication.
Educate users - Provide training and resources to help users understand the importance of MFA and how to use it effectively.

Audit logging

Audit logging is essential for tracking and monitoring activities within your Microsoft 365 environment. It helps administrators detect and respond to potential security incidents and ensures compliance with regulatory requirements. To learn more, see Audit logging and monitoring overview.

Steps to implement audit logging

Enable unified audit logging - Turn on unified audit logging in the Microsoft Purview portal to capture all user and admin activities.
Configure audit log retention - Set up retention policies to ensure that audit logs are retained for the required period based on your organization's compliance needs.
Monitor and review logs - Regularly monitor and review audit logs to identify any suspicious activities or potential security threats.

Restrict sensitive info from Copilot

To protect sensitive information during the deployment and use of Microsoft 365 Copilot, follow these steps to identify, assess, and mitigate oversharing risks. These measures help maintain data security and compliance within your organization:

Identify most popular sites and assess oversharing - Export the top 100 most used sites from the SharePoint admin center and run the SharePoint Advanced Management (SAM) permission state report. To learn more, see Secure by default with Microsoft Purview and protect against oversharing.
Grant Copilot access to popular, low-risk sites - Cross-reference the report results from SAM and the Microsoft Purview Data Security Posture Management (DSPM) Oversharing posture assessment with the top 100 used sites.
Turn on proactive audit and protection - Disable everyone except external users (EEEU) at the tenant level and enable Purview Audit to monitor Copilot interaction activity. To learn more, see Protect your sensitive data with Microsoft Purview.
Implement access controls and labeling - Initiate SAM Access Review for all sites that are overshared and apply SAM restricted access control on business-critical sites. To learn more, see Get ready for Microsoft 365 Copilot with SharePoint Advanced Management (SAM).

For detailed steps, see Address internal oversharing concerns in Microsoft 365 Copilot deployment blueprint.

Get started and deploy

Step 1 - Update channels

✅ Use the Current Channel or Monthly Enterprise Channel to update apps

Microsoft 365 Copilot follows the Microsoft 365 Apps standard practice for deployment and updates. It's available in all update channels, except for Semi-Annual Enterprise Channel.

Your options:

Production channels include Current Channel and Monthly Enterprise Channel.
- Current Channel provides your users with the newest Microsoft 365 app features as soon as they're ready. It provides the best experience for a fast-moving product, like Copilot.
- Monthly Enterprise Channel gives more predictability of when these new Microsoft 365 app features are released each month. It's a good option for organizations that want to validate the new features before they're released to the Current Channel.
Preview channels include Current Channel (Preview) and Beta Channel.

Preview channels are a great option to validate the product before rolling out to the rest of organization. To learn more, see Overview of update channels and Microsoft 365 Insider channels.

There are multiple ways you can manage channels for user devices. To learn more, see Change update channel of Microsoft 365 to enable Copilot.

Step 2 - Provision Microsoft 365 Copilot licenses

✅ Assign Copilot licenses using the Microsoft 365 admin center

Before you assign Copilot licenses, make sure that you provision users and assign Microsoft 365 licenses to users in your tenant. Your options:

Use the Microsoft 365 Copilot setup guide in the Microsoft 365 admin center
Use the Microsoft 365 admin center features to Add users and assign licenses.
Use PowerShell to assign Microsoft 365 licenses.

Next, assign Copilot licenses so users can start using it. You can manage Microsoft 365 Copilot licenses in the Microsoft 365 admin center. You can assign to individual users or to groups of users, and also reassign licenses to other users.

Sign in to the Microsoft 365 admin center and go to Billing > Licenses.
Select Microsoft 365 Copilot.
In the product details page, assign licenses to users and manage their access to Copilot and other apps and services.
To check if a user is added, go to Users and then Active Users. The user and any active licenses are shown.

When licenses are assigned, Copilot shows up in your Microsoft 365 apps, like Word and Excel. For some apps, users might need to wait up to 24 hours for Copilot to appear, and they may need to restart or refresh the app. Once enabled, Copilot appears across the apps.

To use Copilot, users sign into the app with their work or school account and the file must be editable (not read-only). In some experiences, like Word, a Copilot dialog shows when you create a new document. In other experiences, Copilot is accessible on the Ribbon.

Note

It's not supported to assign Copilot licenses to cross-tenant users, including guest users.
For Education customers, the Copilot license is listed under Microsoft 365 A3 Extra Features for faculty or Microsoft 365 A5 Extra Features for faculty.

To learn more, see:

You can assign licenses in bulk to groups of users through the Azure admin center or assign licenses to users with PowerShell. For more information, see Assign Microsoft 365 licenses to users.
You can also manage licenses from the Copilot page in the Microsoft 365 admin center. To learn more, see Microsoft 365 Copilot scenarios in the Microsoft 365 admin center.

Step 3 - Configure settings for Copilot

✅ Configure more Copilot features

You can manage settings using the Copilot Control System, which provides centralized access to admin features and controls that benefit your organization.

To access it, go to the Microsoft 365 admin center> Copilot.

With the Copilot Control System, you can:

View the status of Copilot license assignments
Access the latest information on Copilot
Manage data security and compliance controls
Submit feedback on behalf of users
Configure plugins and permissions
Enable the use of web data as grounding data in Copilot

To learn more, see Manage Microsoft 365 Copilot scenarios and configure the Microsoft 365 Copilot app.

Step 4 - Deploy to some users and measure adoption

When you're ready to assign Copilot licenses to your users, there are three phases that you can follow:

Pilot: Assign licenses to a small group of users to test the deployment and gather feedback.
Deploy: Assign licenses to a larger group of users.
Operate: Monitor usage and adoption, and make adjustments as needed.

To learn more about these phases, and possible actions you can take in each phase, see the Microsoft deployment blueprint to address oversharing in Microsoft 365 Copilot.

Pilot

✅ Create a group of early adopters

There are many uses of Microsoft 365 Copilot across the various Microsoft 365 productivity apps. And, there are opportunities for users to find value in different ways.

To help drive adoption, create a group of early adopters. This group can help you understand how users are using Copilot and how it's valuable to them.

Identify users across various business groups in your organization, ideally with high usage of existing Microsoft 365 features. You can identify these users by reviewing usage metrics in the Microsoft 365 admin center.
Assign these users Microsoft 365 Copilot licenses and onboard them using the resources available at the Microsoft 365 Copilot adoption hub, including the user onboarding kit.
As these users get more comfortable with using Copilot, they can speak to how they use it best, and where it's most valuable for them. This information provides you with product champions that can help other users adopt and use Copilot across your organization.

With your established community of early adopters or Champions, they can better speak to their peers within their organization and contextualize the value of Copilot to best suit their needs. This framework also provides IT departments with a scalable way to handle questions through Champions, developing a team of experts across your organization.

To learn more about driving adoption, visit the Microsoft 365 Copilot adoption hub.

Deploy

✅ Fully deploy Copilot licenses to all users in your organization

To deploy Copilot licenses to all users in your organization, follow these steps:

Use the Microsoft 365 admin center to assign licenses to individual users or groups of users, depending on your needs.
Make sure that all users have the appropriate licenses assigned to them before you begin using Copilot. This step makes sure that everyone has access to the features they need and can participate fully in the Copilot experience.

During this phase, you might also want to:

Focus on preventing oversharing by limiting external sharing, restricting access to certain files or folders, and setting up alerts to notify you of any unusual activity. To learn more, see Site governance, permission, and sharing for site owners.
Use sensitivity labels to classify and protect sensitive information. These labels allow you to automatically encrypt files containing sensitive data or restrict access to files marked as "confidential." To learn more, see Get started with sensitivity labels.

Operate

✅ Get insights and user sentiment

To measure the impact of Copilot on your organization, use the Copilot Dashboard from Viva Insights, and the Microsoft 365 usage reports in the admin center. These tools provide organizational leaders and IT decision makers with insights into readiness, adoption, impact, and user sentiment.