Microsoft Copilot in the UK Public Sector

Microsoft Copilot can help UK public sector staff draft briefings, summarise meetings and long email threads, and find information spread across SharePoint and Teams, using the Microsoft 365 licences many councils, agencies and public bodies already hold. Copilot Chat is included with eligible Microsoft 365 plans at no extra cost, while the paid Copilot licence works from each user's own email, files and meetings. The work to do first is on permissions, records management and data handling, because Copilot surfaces whatever a user already has access to.

What does Microsoft Copilot do in a public sector organisation?

There are two levels to understand before anyone writes a business case.

• Copilot Chat is included for users with eligible plans such as Microsoft 365 E3, E5, F1 and F3, and Office 365 E1, E3 and E5. It answers from the web and from documents a user uploads, and when staff sign in with their work account their prompts and responses are covered by Microsoft's enterprise data protection commitments.
• The Microsoft Copilot licence is a paid add-on. It grounds answers in the user's own email, calendar, chats, meetings and the files they can access, and puts Copilot into Word, Excel, PowerPoint, Outlook and Teams. It also includes the Researcher and Analyst agents and the ability to build agents in Copilot Studio for use in Copilot, Teams and SharePoint.

Microsoft 365 E7, which became generally available on 1 May 2026, includes Copilot alongside the E5 security and compliance features. Microsoft has also started shortening the product names to Microsoft Copilot and Microsoft Copilot Chat in its documentation.

Realistic use cases for councils and public bodies

The tasks that suit Copilot are the ones where an officer spends a long time assembling or rewording information that already exists, and can check the result quickly. Examples we see a lot are:

• drafting a committee report or ministerial briefing from earlier papers, notes and email
• summarising a Teams meeting, with actions and owners, when transcription is on
• catching up on a long Outlook thread before a meeting
• comparing a draft policy against the current version and listing what has changed
• pulling together the background for an FOI response or a complaint from documents the officer can already see
• asking questions of a spreadsheet in Excel, such as spend by service area, without writing formulas

Copilot can be wrong, and it can sound confident when it is, so anything that goes to members, the public or a minister needs to be read and checked by a person. We would also keep it away from decisions about individuals, such as eligibility or enforcement, unless there is a clear process and accountability around it.

What has to be sorted before you roll out Copilot?

Copilot only shows a user content they have at least view access to. Public sector tenants have often grown through reorganisations, shared services and mergers, so there are SharePoint sites shared with everyone, Teams that outlived the project they were set up for, and sharing links that were never removed. If an officer can open a file through an old link, Copilot can find it and summarise it.

The steps we would take first are:

• run the SharePoint data access governance reports to find sites shared with everyone, sharing links and broken inheritance (SharePoint Advanced Management is included with Microsoft Copilot licences)
• change the default sharing link if it is set to Anyone, and review external sharing and guest accounts
• use Restricted Content Discovery on sensitive sites, such as HR, legal and social care, while permissions are reviewed
• if your sensitivity labels already map to OFFICIAL and OFFICIAL-SENSITIVE, use Microsoft Purview data loss prevention for Copilot to keep labelled content out of Copilot's answers
• archive inactive sites and Teams so Copilot isn't drawing on out-of-date material

Restricted SharePoint Search, which some organisations used as a stopgap, is being retired and can't be newly switched on from 31 July 2026. Microsoft points customers to Restricted Content Discovery instead.

Data residency, records and information governance

These are the questions information governance and security teams usually ask first, and the answers are better than many people expect.

• Training: Microsoft states that prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation models used by Copilot.
• Where data is stored: for tenants that signed up in the United Kingdom, Microsoft Copilot is covered by the data residency commitments in Microsoft's Product Terms, and the Advanced Data Residency add-on extends this. Note that this covers data at rest. Microsoft says customers outside the EU may have their queries processed in the US, the EU or other regions, so check that against your own data protection impact assessment.
• Records: Copilot prompts and responses are stored, and Microsoft Purview retention policies can apply to them. Your records manager should decide how they are retained, in the same way you would for Teams chats.
• Meetings: Teams lets you choose whether Copilot works only during a meeting, using temporary speech-to-text data, or during and after it using a saved transcript. Agree a default for sensitive meetings before rollout.

How is Microsoft Copilot licensed?

Copilot Chat comes with eligible Microsoft 365 and Office 365 plans. The paid Microsoft Copilot licence is an add-on to a qualifying plan, including Microsoft 365 E3, E5, F1 and F3 and Office 365 E1, E3 and E5, and it is included in E7. Users without a Copilot licence can still use agents in Copilot Chat, but agents that work from your SharePoint content or connectors are charged on consumption in Copilot Credits through Copilot Studio. Public sector pricing depends on your agreement, so get a current figure from your reseller.

A phased approach works well. Get Copilot Chat in front of everyone with clear guidance, licence a group of officers with heavy drafting and meeting loads for a few months, and measure what changes before scaling. Our related post on government efficiency with Microsoft Copilot covers some of the same ground.

Frequently asked questions

Is Microsoft Copilot safe to use with OFFICIAL data?

Copilot works inside your Microsoft 365 tenant, respects existing permissions and is covered by Microsoft's enterprise data protection and UK data residency commitments for data at rest. Whether it is suitable for a particular classification is a decision for your security team, and sensitivity labels with Purview data loss prevention let you keep the most sensitive content out of Copilot's answers.

Does Copilot Chat cost anything?

Copilot Chat is included at no extra cost for users with eligible Microsoft 365 or Office 365 plans. Agents that use your organisation's SharePoint content or connectors are billed on consumption for users who don't have a Microsoft Copilot licence.

Where is Copilot data stored for UK organisations?

For tenants that signed up in the UK, the content of Copilot interactions is covered by Microsoft's data residency commitments for data at rest. Processing of queries can take place in other regions, which Microsoft documents, so include that in your data protection impact assessment.

What should we fix before rolling out Copilot?

Start with oversharing: sites shared with everyone, Anyone links, old guest accounts and broken permission inheritance. Then agree retention for Copilot interactions, a default for Copilot in Teams meetings and an acceptable use policy for staff.

If you would like an independent view of whether your tenant is ready before you commit to licences, our AI readiness assessment covers permissions, sharing, governance and where Copilot is likely to pay back. Get in touch to talk it through.