Copilot is a family name, not a configuration record. Two colleagues can both say they use Copilot while working in different applications, under different licenses, with different access to organizational information.
Identify the product, account, license, and application before evaluating a workflow. This reference uses Microsoft documentation checked from September 18 to 21, 2026; it is neither a hands-on product review nor a purchase recommendation.
This article provides general operational education. It is not legal advice or a compliance determination. No attorney-client relationship exists, and none of its protections apply.
Name the experience precisely
Distinguish a personal Copilot experience from the work or education experience managed by your organization. Ask the administrator to confirm the account and assigned license in the actual application.
Microsoft's Copilot Chat overview distinguishes chat without the Copilot add-on from the licensed experience with broader organizational grounding.
The overview names 3 in-app labels:
- Microsoft 365 Copilot (Premium) or (Pro): the user holds the Copilot add-on license.
- Microsoft 365 Copilot (Basic): no add-on, with standard access to Copilot in Word, Excel, PowerPoint, and OneNote.
- Copilot Chat (Basic): no add-on, and no Copilot chat in those 4 apps.
Outlook is a separate case. Microsoft says Copilot Chat in Outlook gives eligible users some organizational grounding without the add-on. It names emails, calendar items, meetings, chats, and a bounded set of files. Microsoft also lists Teams among the supported apps. Availability depends on the subscription.
Record the specific app, license, enabled features, and test date. Use the current account's behavior and documentation when planning a workflow.
Permission-respecting can still be overbroad
Microsoft says Copilot surfaces organizational content the user has permission to view. That makes the underlying permissions part of the evaluation.
In a fictional test, an operations user asks for a summary of internal administrative policies. Check which policies appear and whether the user can open them. Include a separate test document outside that user's permitted scope.
If existing permissions are too broad, a permission-respecting system can still reveal more than the team intended. Review access with the information owner before using sensitive material.
Review agents and connections separately
Ask whether the workflow uses only chat or also enabled agents and connections. For each addition, identify its provider, data access, allowed actions, and applicable terms.
Microsoft's data and privacy documentation calls for checking agent terms. It also describes separate handling for web queries. A general product statement cannot answer every connected-service question.
For a drafting task, confirm whether the output stays in a draft or can trigger another action. Check this in the configuration and a permitted test.
Six answers, dated
The evaluation is 6 answers with a date next to them:
- Which account, license, application, and enabled features will the team use?
- Which sources can the test user retrieve, and which must remain unavailable?
- Are any agents or connections enabled, and can they change or send information?
- Which information is approved for this workflow?
- What source evidence will the reviewer see, and what happens when it is missing?
- Who can pause the process and review a configuration change?
An unresolved answer is a finding, not a blocker. Narrow the test to approved synthetic material until the answer exists.
Two colleagues who both "use Copilot" can give different answers to the first question. That difference, rather than any opinion about the product, is what the workflow owner needs on paper. It comes before a review design, a data decision, or a matter-specific judgment. The workflow guide picks up from there. Ortaire's Configure AI Agents work starts from exactly this record: account, license, sources, and actions confirmed before anything is built.
Sources used
- Microsoft Copilot Chat overview, checked September 21, 2026. Account, license, in-app label, and grounding distinctions.
- Data, privacy, and security for Microsoft Copilot, checked September 18, 2026. Permissions, agents, and web-query boundaries.
