What Information Can Microsoft Copilot Access?
Microsoft Copilot can research public information, analyze a document you provide, or work with information from across your company’s Microsoft 365 environment. Those may look like variations of the same chat experience, but they rely on different data sources and do not necessarily come with the same licence.
The old “Work” and “Web” labels made the difference easier to see. Microsoft’s terminology and interface have since changed, but the underlying question is still relevant: What information can Copilot use when responding to your prompt?
The answer depends on the Copilot experience, the user’s licence, the organization’s settings and the information the user already has permission to access. Some work-related capabilities are included in a paid Copilot licence. Others may be available through agents that use metered, pay-as-you-go billing.
What Does “Web” Mean in Microsoft Copilot?
Web-grounded Copilot uses publicly available online information to help answer a question. When web search is enabled, Copilot can identify parts of a prompt that would benefit from current information, create a search query and retrieve relevant results through Bing Search.
A user could ask Copilot to research an industry, compare publicly available product information or explain a recent development. The response may include citations so the user can review the sources behind it.
This does not give Copilot access to private company information. A document stored on a public website and a document stored in a private SharePoint site are separate sources, even if they contain similar information.
Web grounding can improve the currency and relevance of a response, but it does not remove the need to verify the result. Copilot can still rely on an outdated webpage, interpret a source incorrectly or produce a response that lacks necessary context. Microsoft recommends checking citations and confirming critical details before sharing or acting on the information.
What Does “Work” Mean in Microsoft Copilot?
Work-grounded Copilot can use organizational information the user is authorized to access.
Depending on the available Copilot capabilities, this can include emails, calendars, meetings, Teams conversations, OneDrive files, SharePoint content and other information connected to the user’s work. Microsoft describes this grounding through Microsoft Graph and Work IQ.
The value is not simply that Copilot can open an internal document. It can potentially connect information spread across several Microsoft 365 applications and use that context to respond.
Consider this prompt:
Prepare me for tomorrow’s meeting with Contoso.
A web-grounded response could research Contoso using public information.
A work-grounded response could draw from the user’s calendar, recent email discussions, previous meeting content and relevant documents the user is allowed to access. If web search is also enabled, the response could combine internal account context with current public information.
That is a considerably different task from asking a general AI tool to create a meeting agenda. Copilot is not only generating text. It is using the employee’s work context to determine which information is relevant.
Microsoft describes Work IQ as a workplace intelligence layer that enables Copilot, agents and other applications to reason across organizational data, business systems and workplace activity. It assembles permission-aware context from sources such as mail, calendars, files, people, chats and SharePoint sites.
Uploading a File Is Not the Same as Accessing Work Data
Copilot Chat users can upload or attach a file and ask Copilot to work with it. For example:
Summarize the attached proposal and identify the services included in the price.
In this scenario, the user has provided the source material directly. Copilot does not need to search the company’s Microsoft 365 environment to find it.
Now compare that with:
Find the latest proposal for this client, compare it with our recent email discussions and identify anything that still needs approval.
That request requires Copilot to locate and connect information across multiple work sources. The response may depend on access to Outlook, SharePoint, OneDrive or other organizational data. It also depends on the user’s licence, available Copilot experience, tenant configuration and existing permissions.
This is one source of confusion for businesses testing Copilot. An employee may be able to analyze a document they upload without having the broader work-grounded experience that can retrieve relevant information across Microsoft 365.
The first use case is based on content supplied in the prompt. The second relies on organizational context that Copilot has been authorized to use.
What Is Included with Copilot Chat?
Microsoft Copilot Chat is available at no additional cost to Microsoft Entra account users with a Microsoft 365 or Office 365 subscription. Available capabilities can vary based on licensing, administrative settings and the Copilot experience being used.
Copilot Chat provides a secure AI chat experience with web grounding and enterprise data protection. It also supports capabilities such as file uploads, image generation and access to certain agents.
For many users, that is enough to research a topic, improve a draft, summarize a document or analyze a file they provide directly. However, having Copilot Chat does not automatically mean a user has access to the full work-grounded experience across company email, meetings, chats and files.
Microsoft’s current licensing guidance describes Copilot Chat as including web-based chat, with optional access to certain work-based scenarios through usage-based billing. The Microsoft Copilot add-on includes both web- and work-grounded chat and provides embedded Copilot capabilities across Microsoft 365 applications.
What Does the Paid Copilot Licence Add?
The paid Microsoft Copilot experience is designed for users who need Copilot to work with organizational context and assist them within Microsoft 365 applications.
Depending on the eligible Microsoft 365 plan and current product offering, the add-on can provide:
Work-grounded Copilot experiences using organizational data
Copilot inside applications such as Outlook, Teams, Word, Excel and PowerPoint
Priority access to Copilot capabilities
Use of work-grounded agents without the metered consumption charges that can apply when Copilot Chat users access shared organizational data
Separate costs may still apply when an organization develops, hosts or manages custom solutions using Copilot Studio, connectors, APIs or other external services.
Microsoft requires an eligible underlying subscription before a Copilot add-on can be assigned. Businesses should always verify current licensing requirements, pricing and included capabilities before making a purchasing decision, as Microsoft periodically updates its licensing model.
The value of the paid licence is not simply access to AI chat. It is the additional organizational context Copilot can use and its integration with Microsoft 365 applications.
For example, a user who regularly needs to catch up on email, prepare for meetings and locate information across several Microsoft 365 services may have a stronger case for a paid licence than someone who only occasionally needs help researching a topic or rewriting content.
How Microsoft 365 Permissions Affect Copilot
Copilot does not give an employee access to information they were not already authorized to see.
When Copilot uses organizational data, it follows the user’s existing Microsoft 365 permissions and the organization’s security and governance controls. If an employee cannot access a SharePoint site or document directly, Copilot should not use that content to answer the employee’s prompt.
For many organizations, the larger concern is not whether Copilot respects permissions, but whether existing permissions are still appropriate. Employees may have access to Teams, SharePoint sites or shared folders that were never reviewed after they were created, and those permission decisions become more visible when information can be accessed through natural-language prompts.
Before expanding work-grounded Copilot, organizations should review:
Broad access groups and shared SharePoint sites
OneDrive links that provide wider access than intended
Access retained by employees after changing roles
Sensitive information without appropriate labels or controls
Old, duplicate or conflicting versions of documents
Agents and connectors that can reach organizational data
Retention and deletion policies for information Copilot may retrieve
Copilot is not a substitute for data governance. It uses the information environment that already exists.
Before purchasing licences across the organization, businesses should identify the use cases, review Microsoft 365 permissions and clean up important information sources. Organizations that take those steps are generally in a better position to get value from Copilot than those that start with licensing alone.
