Deploying Microsoft 365 Copilot in five chapters

Deploying Microsoft 365 Copilot: A next-generation business tool

Welcome to the new era of productivity

Generative AI has captured the world’s attention, and businesses are taking notice.

According to our Work Trends Annual Report, 70% of people would delegate as much work as possible to AI to lessen their workloads.

Capitalizing on this trend will mean the difference between surging ahead or getting left behind, including here at Microsoft, where we’re the first enterprise to deploy Microsoft 365 Copilot fully.

“I’m inspired by the transformative power of AI,” says Andrew Osten, general manager of Business Operations and Programs in Microsoft Digital, the company’s IT organization. “I’ve been impressed with how quickly our employees have put it to work for them.”

He would know. His team is responsible for driving usage and adoption of Copilot and any new features to more than 300,000 employees and vendors across the world.

“Customers are looking to us to share what we’ve learned as the first enterprise to deploy Copilot,” Osten says. “Our team has a unique opportunity to help them deploy and get to value as quickly as possible.”

Meet Microsoft 365 Copilot

Copilot combines the power of large language models (LLMs) with your organization’s data to turn your employees’ words into some of the most powerful productivity tools on the planet—all within the flow of work. Employees can access intelligent assistance through Microsoft 365 Copilot Chat or the apps they use every day, including Word, Excel, PowerPoint, Outlook, Teams, and more, to provide real-time intelligent assistance. It also forms the foundation for new, agentic capabilities that apply the power of Copilot orchestration to more specific knowledge sources and tasks.

According to our Work Trends annual report, employees who use AI are seeing significant benefits.

Organizations like ours that are unlocking AI assistance within employees’ everyday workflows are poised to gain a distinct advantage in terms of productivity, engagement, and innovation.

“We’re using it to reduce our IT expenses and enhance our productivity,” Osten says. “We’re also excited by its potential to create a lasting competitive advantage for us here at Microsoft and for our customers.”

Our mission in Microsoft Digital is to empower, enable, and transform the company’s digital employee experience across devices, applications, and infrastructure. We also provide a blueprint for our customers to follow in the form of this guide for deploying and adopting Copilot.

“The contents of this guide are based on the lessons we’ve learned deploying Copilot,” Osten says. “The tips and ideas you’ll read here will help you accelerate your own time to value with Copilot so you can realize the same benefits as our employees.”

Chapter 1: Getting governance right

Maintaining privacy, security, and compliance while respecting regulatory frameworks.

Before you begin your Microsoft 365 Copilot implementation, you’ll want to consider how this tool impacts your data. Copilot employs LLMs that interact with data and content across your organization. It uses information your employees can access to transform user prompts into personalized, relevant, and actionable responses throughout Microsoft 365 apps.

Giving your employees this level of access means proper data hygiene is essential. At Microsoft Digital, we use sensitivity labeling to empower our employees with access while also protecting our data. Our colleagues on the product side designed Copilot to respect labels, permissions, and rights management service (RMS) protections that block content extraction on relevant file labels. By implementing effective sensitivity labeling practices, you can rest assured that anything you intend to remain private or confidential will stay that way.

Pick the governance path that’s right for you

This chapter outlines the highly robust, best-case scenario we created at Microsoft, but we know not every organization has a fully deployed data governance system and strategy. If you’re in that position, don’t worry! You can use techniques like Restricted SharePoint Search that provide value and protection without exposing Copilot to your internal resources.

Laying the groundwork with proper labeling

Throughout our internal governance efforts within Microsoft Digital, we’ve developed four labeling practices that make up our foundation for appropriate policies and settings.

Self-service with guardrails

The data hygiene practices we outlined above form a foundation for compliance and security, but backstopping those efforts through Microsoft 365 features adds an extra layer of protection. That’s a core principle of Zero Trust.

At Microsoft Digital, we use Microsoft Purview Data Loss Prevention (DLP) policies to define the rules and actions for detecting and protecting sensitive data across Microsoft 365, SharePoint, OneDrive, and Teams. DLP policies support vulnerable data types and scenarios that require protection. Those include any kind of information that might introduce inappropriate access to company data or intellectual property. Examples include access to credentials like keys or tokens, personally identifying information, financial data, or non-public source code.

Sign-in information, reports, and dashboards are available via Purview to help our team monitor and analyze content activity and compliance across the organization. They also provide insights into the volume, location, and usage of sensitive data, as well as any incidents and alerts that indicate potential data breaches or violations.

For example, an employee might label something as “General,” but it contains credentials or other sensitive end-user identification information (EUII). In those instances, Purview will automatically block the file from access beyond its owner or reapply a more appropriate label.

Between proper labeling and backstopping self-service through DLP guardrails, we’re able to keep Copilot Chat from surfacing documents it shouldn’t share in the wrong context or to the wrong people. Using Purview and other tools at our disposal, the five practices below help us keep our employees and our company’s data safe.

International compliance: No size fits all

Europe has extra requirements in the form of EU Data Boundary regulations and works councils, internal organizations that provide employee co-determination on workers’ rights or regulatory issues, including performance management or monitoring. Our Copilot deployment meant we needed to partner closely with our Microsoft works councils when launching AI technology with complex data and privacy implications.

Your experience will vary depending on your industry and where you operate, but we’ve learned that it’s best to work closely with local subsidiaries to ensure you have a complete picture of a region’s regulatory situation. Local insiders are poised to liaise with their works councils, as we’ve done at Microsoft, or other bodies through direct relationships. Start the process early so you can manage feedback cycles effectively, make adjustments, synthesize any answers that works councils need, and resolve any concerns through configurations that make sense for your employees.

Learning from Microsoft’s governance, security, and compliance practices

Chapter 2: Implementation with intention

Building a strategy for licensing, administration, and rolling Microsoft Copilot out to different groups within your organization.

Implementing Microsoft 365 Copilot isn’t as easy as just turning on licenses and alerting your users. It takes organizational partnerships, early assessments of your concrete business needs, and careful planning.

Design for the “who”

Copilot is a new concept in business software. At the time of our implementation, we were the first company to roll it out anywhere in the world, and our Microsoft Digital implementation team had to choose from countless ways to approach a licensing strategy—different mechanisms of licensing, automation, management, and the list goes on. Regardless of your overall approach, we’ve learned from experience that it almost always makes sense to start with pilot groups who can validate the tool and enable the rest of your organization.

For us, that looked like this:

Scaling out your licenses

After you decide on the general shape of your rollout, you can begin building your licensing strategy. Fortunately, if your organization uses Microsoft 365, you’ll already have access to most of the apparatus you need. The inherent flexibility of Microsoft 365 licensing means you can easily adjust your strategy as you progress based on scale, organization changes, or any other factors.

At Microsoft Digital, we started with individual licenses at the single-user level. As our implementation scaled, we tied licensing automation to Microsoft 365 security groups to implement targeted licensing changes at scale. Those groups could include tailor-made subsets of employees or entire organizations within Microsoft, and we keyed our automation logic to their expanding and contracting eligibility.

We highly recommend defining a phased rollout strategy and structuring your groups accordingly. That creates accountability and gives your IT admins a crucial point of contact for understanding the licensing needs of different groups within your organization.

Based on our implementation experience, there are three main benefits to using security groups:

Pre-adoption communications

Given the excitement around AI tools, one of the biggest challenges during our phased implementation was support requests from employees outside our initial pilot groups. Most of our support requests at this stage were essentially asking, “Where’s my license?” It was a key learning for our Microsoft Digital implementation team.

You can easily avoid the issue through clear and honest communication. For example, when you alert your initial implementation groups about their Copilot access, you could simultaneously deploy “Coming soon” emails to the rest of your organization. That will help you avoid any confusion while simultaneously generating excitement and boosting general adoption when the time comes.

In the end, what’s most important is building a strategy for getting all users access to Copilot, structuring your rollout, and helping people build the daily habit of using AI. While leadership sponsorship is especially important in later phases of adoption, it’s also crucial here as a way of identifying who should be part of pilots and subsequent cohorts. Leaders can help communicate those decisions.

The bottom line is that your IT implementation team can’t work in isolation. Communication—especially from organizational leadership—will be a key part of your licensing and implementation strategy.

Learning from our implementation 

Chapter 3: Driving adoption to capture value

Effective adoption: From readiness to empowerment

The fact that your employees are excited to try out a powerful new technology platform isn’t enough. We found that you need strategic, coordinated change management efforts to drive Microsoft 365 Copilot adoption.

That way, you can be sure to get your employees onboard at the right time in the ways that you want. The idea is to give them the freedom to be themselves with proper guardrails.

Consider breaking your company-wide adoption into cohorts, for example, subsidiaries or business groups. We divided our adoption along two vectors: internal organizations like legal or sales and marketing, and regions like North America or Europe. Different cohorts have different focuses, but the strategy is similar.

Microsoft 365 Copilot change management

Effective change management needs careful planning. Our adoption efforts took inspiration from the Microsoft Engagement Framework, which we’ve developed specially for driving adoption of our products. If you’re an adoption specialist or change manager, you might notice similarities with Prosci’s ADKAR model, which progresses through awareness, desire, knowledge, ability, and reinforcement.

Whichever framework you choose, the techniques we use here at Microsoft will apply. Either way, the process starts with your people.

Begin by working with your company-wide adoption leads, then identify members of your target cohorts who will support the adoption, including change managers, leadership sponsors, and employee champions.

Champions boost adoption by filling several important roles:

• Pinpointing key usage scenarios for Copilot based on their cohort’s culture or processes.
• Deciding on the best methods of communication.
• Providing insights that help adoption leaders build out their rollout plans.
• Extending the reach of our adoption team through peer-to-peer support and guidance.
• Most importantly, demonstrating the value of Copilot and showing their peers how powerful this tool can be in their day-to-day work.

When champions socialize their tips and tricks, our experience at Microsoft Digital has revealed that it’s best to share specific prompts and the value they provide as a concrete entry point for users. For example, a champion could say, “I saved three hours drafting this sales script in Microsoft Word using this prompt,” then share their Copilot prompt as a place for peers to start. You’ll find advice below for how you can effectively incorporate champs into your adoption efforts.

Works councils also play a key role at this stage. They offer the benefit of local cultural expertise and can help you identify challenges employees face in their jurisdictions. Even something as simple as understanding proper modes of address helps smooth the road to adoption through effective communication.

Each of these sets of stakeholders has a role to play in your rollout. We recommend using Microsoft Copilot adoption resources to build out your adoption plan.

At Microsoft, we implemented this phase across each adoption cohort. Because every group will have its own champions and leadership sponsors, it’s important to treat each of them as its own organization, with its own unique adoption needs.

In advance of our general rollout, we deployed jump-start communications with links to learning opportunities:

• Localized training took the form of Power Hours in different languages and time zones. These training sessions demonstrated key Copilot scenarios across Microsoft 365 apps.
• Self-learn assets included user quick-start guides, demo videos, and the Microsoft Copilot Academy to accommodate different learning styles and preferences.

From our experience at Microsoft Digital, pre-rollout communications fulfill two needs. First, this messaging is a great opportunity to launch your champion communities because early access to Copilot licenses and learning material helps peer leaders build their expertise. Second, these communications build your general adoption population’s desire and excitement for their incoming Copilot licenses, then prepare them to hit the ground running when they finally get access. Clear messaging also helps ward off questions from eager employees asking why they don’t have licenses yet.

After your Copilot licenses are live, your launch-day welcome communications are relatively simple. Just invite employees to access Copilot, play with this new tool, and start to experiment with how it can fit into their daily workflows. It’s also helpful to include information about where employees can get support. There are many possible vectors for deploying these communications, but a multi-pronged effort that includes Microsoft Viva Amplify will deliver the maximum impact.

For support in building out your own communication plan, our adoption team has created a user onboarding kit for Copilot. These ready-to-send emails and community posts can help you onboard and engage your users.

After everyone has access, it’s time to promote Copilot usage and ensure your employees are getting the best possible experience and the most value. For Microsoft’s cohorts, employee champions and leadership sponsors were essential levers.

It’s important to remember that Copilot isn’t just another tool. It introduces a whole new way of working within employees’ trusted apps. At Microsoft Digital, we took great care to encourage employees to be adventurous and lean into a mindset shift to see it as part of their daily work—not just something they play with when there’s time.

Microsoft Viva Engage or a similar employee communication platform is a helpful forum for peer community support. In our case, it provided an organic space for champions to share their expertise and change managers to provide further recommendations and adoption content. For employees who explore best on their own, Copilot Lab provides in-the-flow learning opportunities to build their prompt skills.

Meanwhile, leadership sponsors diversified our communications strategy by deploying and amplifying messaging through executive channels like org-wide emails or Microsoft Viva Amplify. Because we broke our adoption out by both organization and region, employees benefited from two sets of communications, each focusing on the scenarios that are most relevant to them.

Finally, successful adoption depends on measurement, feedback, and listening.

Understanding overall usage patterns and impact is crucial to optimizing adoption. Our Microsoft Digital team employed a combination of controlled feature rollout (CFR) technology while tracking usage through Microsoft 365 Admin Center, the Copilot Dashboard, and Viva Insights. Together, these tools gave us the visibility and tracking we needed to establish and communicate adoption patterns. Meanwhile, IT admins and user experience success managers accessed simple in-app feedback through Microsoft 365 admin center. But to really maximize value, our Microsoft Digital employee experience teams conducted listening sessions and satisfaction surveys.

All of these insights are helping us establish a virtuous cycle to drive further value and better adoption for future rollouts, extend usage to new and high-value scenarios, incorporate Copilot into business process transformation, and understand custom line-of-business opportunities.

Driving user enablement with Microsoft Viva 

We used Microsoft Viva to help enable our 300,000+ global users. Microsoft Viva is an Employee Experience Platform that brings communication and feedback, analytics, goals, and learning into one unified solution. Our team in Microsoft Digital used Viva across a range of change management scenarios, including building awareness, communicating with our employees, providing access to readiness and learning resources, and measuring the impact of our deployment. 

Consider these examples:

• A human resources professional might use Copilot to create job descriptions by prompting it to suggest essential skills, qualifications, and responsibilities for a prospective role.
• A salesperson could ask Copilot to generate a table comparing their company’s flagship product with a competitor’s to address customer questions more efficiently.
• A finance professional might prompt Copilot to review and summarize a new contract to reduce the time it takes to search for key data.

Any single approach would never be adequate to address every different discipline and use case. With the rise of agents, specialized AI-powered assistants that customize and focus the capabilities of Copilot, certain roles derive the most value from tailored assistance for specific tasks.

So, we created a playbook that our employees can use to construct their own role-based scenarios according to their individual teams’ unique needs.

We designed it to help adoption professionals accomplish the following objectives:

1. Understand the top responsibilities, challenges, needs, and wants of prioritized roles.
2. Articulate and communicate hero scenarios by clearly depicting how Copilot can enable them.
3. Share deliverables that include roles, scenarios, and prompts with the wider organization to drive awareness, adoption, engagement, and value.

Through internal testing and scenario crafting, we developed a four-part framework for creating, delivering, and socializing hero scenarios across any organization. These are the steps you can follow to create Copilot support content for adoption efforts tailored to specific roles.

Learning from our adoption of Copilot

Chapter 4: Building a foundation for support

Setting your Support team up for success

Empowering employees means making sure they have access to the right support channels, especially if they have concerns with a new technology. The fact that Microsoft 365 Copilot operates across a wide spectrum of Microsoft 365 apps adds complexity to your support apparatus.

As a result, it’s important to give your support teams early access along with your earliest pilot implementations. For Microsoft Digital, that included members of our internal support teams who help Microsoft employees when they run into technical issues, as well as our Customer Experience and Support team that engages with external customers to troubleshoot problems with new Microsoft products. We also invited subject matter experts for Microsoft 365 apps featuring Copilot experiences, including Teams, Outlook, and more.

A small group of users across both internal and external support teams, as well as our Microsoft 365 subject matter experts, gained access at first, and we encouraged them to experiment and try to break features. This was a crucial learning phase for Microsoft Digital because it surfaced interesting issues that wouldn’t come up if our teams didn’t have access and an opportunity to experiment.

Building insights and product experience was step one, but we needed to collect that knowledge so it would be actionable in real situations. To accomplish that, we created a special Teams channel where our support team members collaborate with pilot users of Copilot and representatives of the product group. From there, we worked with marketing and communications professionals to start building our support team’s knowledge base, which would also serve as the foundation for our user-facing content.

Eventually, the time came to provide access to our wider support team. At that point, our support pilot members operated as learning leaders. When it came time to share their knowledge, it took the form of informal brown-bag sessions. We also engaged in shadow/reverse-shadow role-playing exercises so our support agents could practice addressing common issues.

Principles of good support

Strategizing for support

Building experience and knowledge is one thing, but coming up with your approach to support requires planning and a strong idea of your users’ ideal experience. At Microsoft Digital, we take a “shift-left” approach. That means we save our human support staff time by attempting to create excellent self-service options for our users. As a result, they won’t need to access a human agent unless they’re at a genuine impasse.

Shift-left principles can apply to many different support contexts, but with Copilot, we’ve found that the most important upfront action is ensuring your employees have accessible self-service support channels and communicating their availability. That might come through in-app support or access to knowledge bases.

Work with your adoption teams to ensure they include those self-service support vectors in their rollout communications. For us, self-service was able to answer many of our users’ questions, and for any extra-tricky issues, we had them access human-led support.

Seven things we learned preparing our Microsoft 365 Copilot support

Common questions, issues, and resolutions

As the first enterprise organization to go through the Copilot deployment process, we’ve identified a few challenges and questions you might have. Feel free to add these to your support knowledge base and employee-facing communications.

We’re getting questions about why particular employees don’t have licenses.

Ideally, your adoption communication waves solve this issue by alerting employees when to expect their licenses and when they receive them. Otherwise, consider having a readily available link that answers licensing questions for users or directs them to their relevant managers or admins. You can also automate this process.

Users are coming to us with questions that would be better served by adoption and employee material, and that isn’t our role as support.

Work with your adoption team to preempt these issues with proactive communications. Update your self-help content and provide your support agents with ready access to different employee education resources, including your user-facing knowledge base, self-help videos, and Viva Engage communities focused on Copilot.

Teams are looking for integration support. Where do I send them?

Share this list of pre-built connectors to help your users integrate various data sources into your Microsoft Graph. This list shares the types of content supported.

Can employees put confidential information into Copilot?

As long as your employees are signed in to Copilot with their Entra ID, they can enter confidential information.

My organization has concerns about who owns the IP that Copilot generates. Does the Microsoft Customer Copyright Commitment apply to Copilot?

Microsoft does not own the IP generated by Copilot. Our universal terms state, “Microsoft does not own customers’ output content.” Those terms also include our Customer Copyright Commitment.

What’s the best way to verify the accuracy of the information Copilot provides?

Where possible, Copilot is transparent about where it sources responses from. It answers complex questions by distilling information from multiple web sources into a single response. Copilot provides linked citations to these answers so the user can verify further. 

Chapter 5: Extending Copilot through agents

Unlocking more tailored experiences by enabling employees and teams to create agents

As organizations and employees have matured with respect to AI, agentic extensibility is expanding the frontiers of this technology. By using and even creating agents that surface knowledge, take actions, and reinvent workflows, employees can personalize AI’s capabilities to fulfill more specific needs.

At Microsoft, we’re leaning into the agentic future by empowering employees and teams to create agents of their own. Agents and their capabilities are incredibly varied. They range from pre-made out-of-the-box agents in Microsoft 365 embedded directly into Copilot Chat; to straightforward agents that employees create themselves using a simplified process also available through Copilot Chat; to Copilot Studio agent builder or SharePoint agent builder; all the way up to complex agents that can take action on behalf of users, designed using tools like Microsoft Copilot Studio and Azure AI Foundry.

Our goal has been to provide access and enable their use at appropriate levels for our employees and the company as a whole. To make that happen, we’ve adopted a maturity model for agentic AI deployment. Early phases focus on using Copilot, grounded in enterprise data, to enhance knowledge discovery and retrieval. Later phases will enable our employees to act on that knowledge and even fully automate business workflows.

Phases of maturity

Each of these levels of agentic capability requires different tools to create and depends on different policies to govern. In the simplest terms, this involves three levels of agent, each of which can handle progressively more complex tasks:

While the third level of maturity is still in its initial stages, our employees and teams are already creating retrieval agents and knowledge and action agents. Because retrieval agents don’t require special tooling, we allow employees to create them at will through Copilot Chat and simplified agent builders in Copilot Studio and SharePoint.

For more complex agents intended to meet enterprise needs across lines of business or the company as a whole, our developers use more full-featured tools like Copilot Studio or Azure AI Foundry. For these kinds of agents, we apply the same rigor, reviews, and software development lifecycle (SDL) we use as part of our standard internal app development.

As you explore the different kinds of agents available to your users and decide how and where to enable them, adoption.microsoft.com provides an excellent place to start. It provides three different approaches to creating agents: Microsoft 365 Copilot, Azure AI Foundry, and Copilot Studio. Once you determine who should have access to each of these creation methods, you can follow our advice on driving adoption for this new practice.

Of course, all of this choice adds complexity, so maintaining visibility and control over the agents your employees create can be a challenge. As a result, we take a matrixed approach to creating and governing agents based on different parameters. They include the type of agent, how the user creates it, its knowledge sources, the need for custom tooling, sharing and publishing permissions, and more. It will be helpful to review our strategy in full to help you think through the different parameters behind your agents, in addition to the processes and policies you’ll need to put in place to govern them.

Keeping agents safe and effective through good governance

As you enable your employees and teams to create and use agents, you’ll need structures in place to govern these tools. At Microsoft, we incorporated elements of our tenant’s minimum bar for governance into our policies for managing agents. These measures include Microsoft Information Protection, a functional inventory, activity logging, lifecycle management, and the ability to properly isolate agents against crossing data boundaries.

Our general governance strategy operates at the container level, but agents bring extra functionality to the table. To govern these capabilities, we introduced further controls like sharing limits, breadth of knowledge sources, agent metadata, and information about an agent’s behaviors. The result is a proactive approach to governance backstopped by reactive structures that catch any issues.

As you think about governing your own agents, consider the four core principles we’ve established at Microsoft Digital.

Once you have your governance policies and procedures in place, you can begin your rollout to users through many of the same strategies and processes we’ve discussed in this guide.

Learning from our experience with agents

Applying our deployment lessons at your company

You’ve learned from our Copilot deployment. It’s time to get started on yours.

Embarking on your Microsoft 365 Copilot deployment journey might seem daunting, but by capitalizing on the lessons that we’ve learned during our internal deployment, you can both speed up the process and avoid any pitfalls.

By anchoring your work in careful planning and using the steps and resources provided in this guide, you can unleash a new era of productivity through Copilot.

You’re not in this alone. If you’re looking for support or knowledge on any aspect of your deployment, reach out to our customer success team.

For inspiration around ways that Copilot can become your employees’ AI assistant at work, read stories about how we’re using AI within Microsoft Digital and Microsoft as a whole.

“Deploying Copilot internally has inspired us to dive deeper into the power of AI assistance, which is enabling us to enhance our employee experience,” says Stephan Kerametlian, a business program management senior director within Microsoft Digital. “With the lessons we learned from our deployment, we’re confident that we can support businesses around the world as they achieve more through the next generation of intelligent experiences.”