Getting a Microsoft 365 Business Premium tenancy ready for Microsoft Copilot
Microsoft 365 Copilot answers from whatever a person can already open, so getting ready is mostly permissions and labelling work rather than a licence upgrade. Blue Arc IT Solutions reviews sharing settings, SharePoint site permissions and sensitivity labels in a Microsoft 365 Business Premium tenancy before Copilot is switched on, and says plainly which controls need the Microsoft Purview add-on.
These guides are written for Australian businesses of roughly 10 to 300 staff running Microsoft 365 Business Premium, which is the licence most professional services firms of that size hold. Larger enterprise plans carry more governance features, and we note where that matters, but none of them are necessary to run Copilot responsibly at this size.
Start here
Do sensitivity labels control what Microsoft 365 Copilot can see?
Why does Microsoft Copilot show people files they should not see?
What Copilot can and cannot reach
Copilot works across your tenancy, meaning your organisation's own space inside Microsoft 365: the mailboxes, the SharePoint sites, the OneDrive accounts and the Teams conversations. It reaches that content through Microsoft Graph, the interface Microsoft 365 apps use to read your data, and it respects the permissions already set on each item.
Microsoft's documentation is unambiguous on the point. Purview-supported AI apps use existing controls to ensure data stored in your tenant is "never returned to the user or used by a large language model (LLM) if the user doesn't have access to that data". Its data loss prevention documentation adds that all Microsoft 365 Copilot prompts "run in the security context of the user who initiates the prompt".
In plain terms: Copilot is a very fast search over what each person could already have found by clicking around. It does not widen anyone's access. It removes the friction that was quietly hiding the access you granted by accident years ago. That is why a Copilot rollout so often reads as a data breach when it is really an audit.
What each licence actually changes
The controls unlock in an order that surprises most people, because they come from two different products.
Business Premium on its own includes manual sensitivity labelling, default and mandatory labelling through a label policy, and data loss prevention for Exchange Online, SharePoint Online and OneDrive. It also includes everything that costs no licence at all: tightening the sharing settings, fixing site permissions, and enabling sensitivity labels for files in SharePoint and OneDrive. That last group is the bulk of the real work.
Adding a Microsoft 365 Copilot licence unlocks the SharePoint side rather than the Purview side. Microsoft's documentation states it plainly: "If your organization assigns at least one Microsoft Copilot license to a user, SharePoint administrators get access to the SharePoint Advanced Management (SAM) features that support your Copilot deployment." That brings in the reports that find oversharing, plus Restricted Access Control and Restricted Content Discovery for locking down individual sites. None of it requires an enterprise plan.
Adding the Microsoft Purview Suite for Business Premium is what unlocks automatic labelling, default sensitivity labels on a SharePoint document library, and the data loss prevention rule that stops Copilot using a labelled file at all. Microsoft caps this add-on neatly at the top of our client range: "Add-ons require a Microsoft 365 Business Premium base license and are capped at 300 seats total".
We deliberately do not publish licence prices here, because Microsoft's Australian pricing moves and a figure on a web page ages badly. Ask us for current Australian dollar pricing on the Copilot licence and the Purview add-on and we will quote it against your actual seat count.
The order the work goes in
Sequence matters, because labelling a tenancy with unresolved permissions problems just puts markings on files that the wrong people can still open.
First, tighten the sharing defaults, since SharePoint ships permissive. Second, run the reports and fix the worst sites, starting with anything shared to the whole organisation. Third, restrict discovery on the handful of sites that need more review time than you have. Fourth, enable sensitivity labels for SharePoint and OneDrive and publish a small, usable label set. Only then decide whether the Purview add-on earns its cost in your environment.
The Australian Signals Directorate makes the same argument for the AI tools that act on your behalf rather than just answering questions. Its joint guidance with the United States, Canadian, New Zealand and United Kingdom cyber agencies recommends "never granting it broad or unrestricted access, especially to sensitive data or critical systems". Copilot agents built over a SharePoint site inherit exactly the access that site grants, which is another reason to fix the access first.
How Blue Arc IT Solutions helps
We audit permissions, sharing and labelling before anything gets switched on, so Copilot answers from the right documents rather than from a spreadsheet someone left in the wrong shared folder years ago. We then remediate in priority order, publish a label set your staff will actually use, and tell you honestly whether the Purview add-on is worth it for your business or whether Business Premium already covers you.
Blue Arc IT Solutions has supported Australian businesses since 2004, delivering nationally from Canberra. Our latest client survey recorded 96 per cent satisfaction with response time, 94 per cent with resolution and 97 per cent overall.
If AI adoption raises broader Privacy Act or AML/CTF questions for your business, see our guide to AI for Australian business. If you are weighing what Business Premium covers more generally, see whether Microsoft 365 Business Premium is enough to manage Macs and iPhones.
Last reviewed: 11 September 2026, against Microsoft Learn's Purview and SharePoint documentation for Copilot, including the Purview service description licensing tables, the SharePoint Advanced Management Copilot licence page updated 18 August 2026, and the Copilot information protection considerations page updated 30 June 2026. Restricted SharePoint Search was confirmed as closed to new enablement since 31 July 2026.
Frequently asked questions
Do you need Microsoft 365 E5 to use Microsoft Copilot safely?
No. Every permissions and sharing control that matters most is available on Microsoft 365 Business Premium, and assigning one Microsoft 365 Copilot licence unlocks the SharePoint Advanced Management reports used to find oversharing. Only a smaller set of Purview controls, including automatic labelling and blocking labelled files from Copilot, sits behind the Microsoft Purview Suite for Business Premium add-on.
Will turning on Microsoft Copilot give staff access to files they could not see before?
No. Copilot runs every prompt in the security context of the person asking, so it can only use content that person could already open. What changes is how easily they find it. Copilot surfaces existing oversharing rather than creating it.
How long does Microsoft Copilot readiness work take?
For a business of 10 to 300 staff, Blue Arc IT Solutions usually reports on sharing settings, site permissions and label readiness within a few weeks, then remediates in priority order. The reporting is quick; the time is spent deciding who should keep access to what, which is a business decision rather than a technical one.