Microsoft 365 Copilot has been on the market for a good two years now, and expectations are high. In practice, though, it isn’t the model that determines whether Copilot delivers value, but the groundwork done in your own tenant. This article sets out what Copilot can really do today, where its documented limitations lie, and what an organisation should have sorted out beforehand.
First things first: there is no single “Copilot”
A large part of the confusion arises because very different products run under the same name. Three variants need to be kept apart:
- Microsoft Copilot (Consumer) — free, accesses the internet, doesn’t know your company data. Microsoft explicitly warns against entering sensitive work information here.
- Microsoft 365 Copilot Chat — already included in every Microsoft 365 subscription. Chat with Enterprise Data Protection, ad-free, with file upload. It only accesses your work data to a limited extent, essentially just what you upload yourself.
- Microsoft 365 Copilot (paid licence) — this is where it gets interesting. Copilot grounds its answers in your documents, e-mails, calendars, chats and meetings via Microsoft Graph, and it is embedded in Word, Excel, PowerPoint, Outlook and Teams.
Anyone who says “we have Copilot” often means Copilot Chat. The difference in value is considerable.
What Copilot actually delivers in the applications
Word generates drafts from a prompt, an outline or a referenced file, rewrites selected passages, changes the tone, summarises, and pulls out open points and action items. Changes are made traceably in the original document rather than in extra copies.
Excel creates formulas across multiple sheets, builds charts and pivot tables, sorts, filters, applies conditional formatting and answers questions about the data. There are three modes: edit directly, plan first, or answer only. Recurring workflows can be saved as custom skills.
PowerPoint builds presentations from a prompt, a Word document or a PDF, adds individual slides and rephrases text.
Outlook prioritises the inbox, summarises long threads, drafts replies in the context of the conversation history, gives feedback on tone and clarity, and handles triage tasks via chat. Outlook rules can also be created in natural language.
Teams summarises ongoing meetings, records who said what, suggests action items and answers questions during the meeting, drawing on the meeting chat as well.
The limitations Microsoft documents itself
These points are stated as such in the official documentation and matter more for planning than any demo.
Answers aren’t guaranteed to be correct. Microsoft’s own wording: generative AI doesn’t deliver one hundred percent factually accurate answers, and users should review the output before sharing it further. Copilot is a drafting tool, not an approval authority.
Copilot exposes whatever was already over-shared. It only shows content that the individual user has at least read access to. That’s exactly the point: in many organisations, SharePoint libraries have grown over the years, with broken inheritance and “everyone” links. Copilot reliably surfaces this content — even when nobody wanted it to. Microsoft has its own three-step approach for this: fix oversharing, set guardrails, cover regulatory requirements.
Exchange Online is mandatory. The primary mailbox must sit in Exchange Online. On-premises and hybrid mailboxes are not supported. Archive, group, shared and delegate mailboxes are excluded in Outlook, as are S/MIME and Double Key Encryption messages.
Teams without a transcript is Teams without a recap. If neither transcription nor recording is switched on, Copilot is no longer available after the meeting. Content must be captured before the meeting ends. In meetings hosted by an external organisation, Copilot doesn’t work at all.
Excel has hard technical prerequisites. The file must be in .xlsx format; the “Strict Open XML Spreadsheet” format causes errors. Calculation options must be set to Automatic, otherwise editing doesn’t work. If the organisation requires check-out before editing in SharePoint, Copilot doesn’t work in Excel on Windows or Mac.
Data protection: Switzerland is part of the EU Data Boundary
This is the point most often misrepresented in Swiss advisory conversations. The EU Data Boundary covers the EU member states and the EFTA states — and Switzerland is one of them. EU data traffic stays within this boundary.
Two caveats belong here: models that Anthropic provides as a subprocessor are currently explicitly excluded from the EU Data Boundary. This affects, among other things, Agent Mode in the Office applications. And with Multi-Geo, the storage location follows the user’s preferred data region, not where the document is filed.
The training commitment, by contrast, is solid: prompts, responses and data retrieved via Microsoft Graph are not used to train the base models, including OpenAI’s models. In November 2025, Microsoft also announced local processing for 15 countries, with Switzerland among them, planned by the end of 2026. Whether this is already live by the time of your rollout is something you should check specifically with your licensing partner.
What you should have sorted out before buying licences
Technically, Copilot works fine without any groundwork. Data hygiene isn’t a functional prerequisite, it’s a risk question — and that’s exactly where projects fail in practice. A sensible order:
- Review permissions in SharePoint and OneDrive, fix broken inheritance, disable organisation-wide sharing links.
- Define sensitivity labels and enforce them when new sites are provisioned.
- Exclude sensitive sites from Copilot discovery and set DLP policies for Copilot.
- Clarify retention and logging: how long are Copilot interactions kept, and who can review them?
- Only then: pilot group, training, rollout.
One detail that regularly distorts cost calculations: the Copilot licence is an add-on. A qualifying Microsoft 365 or Office 365 base plan is mandatory and is licensed separately.
Certifications around Copilot and AI
A lot has changed here in 2026. The key points:
- AI-900 and AI-102 were retired on 30 June 2026. Their successors are AI-901 (Azure AI Fundamentals) and AI-103 (Azure AI Apps and Agents Developer Associate). DP-100 is also gone, replaced by AI-300.
- AB-900 is new: Microsoft 365 Copilot and Agent Administration Fundamentals, 45 minutes, currently available in English only.
- AB-620 (AI Agent Builder Associate, Copilot Studio) is generally available and can also be taken in German.
- For end users there is deliberately no certification, just courses — for example MS-4004 on everyday use cases at work.
Organisations rolling out Copilot typically need both: broad, short-form user training and in-depth administration know-how.
In brief
Copilot isn’t a tool you simply buy and roll out. It’s an amplifier: where data is cleanly structured and permissions are well maintained, it saves measurable time. Where that isn’t the case, it makes the mess visible — for everyone, at the same time.
If you’re planning your rollout, get in touch. We train both the user side and administration and governance.
