Microsoft 365 & Copilot in the Enterprise · Chapter 7 of 12
Microsoft 365 Copilot — how it actually works
The request path, what the semantic index is, what happens to your data, and the three-tier structure most coverage still gets wrong.
First, disambiguate. Microsoft has attached the word Copilot to several unrelated products. This chapter is about Microsoft 365 Copilot — the assistant inside Word, Excel, Outlook and Teams, grounded in your organisation's own documents and email. It is not GitHub Copilot, which lives in a code editor and is covered elsewhere on this site, and it is not Copilot Studio, which is chapter 9.
What the semantic index actually is
Ordinary search matches words. A semantic index stores meaning: each piece of content is converted into a long list of numbers — an embedding — positioned so that things about similar subjects sit near each other. Ask about ‘the Q3 shortfall’ and it can find a document that never uses those words.
Microsoft describes billions of vectors layered over its existing keyword index. Two levels exist: a tenant-level index built automatically for every subscription — Microsoft's phrasing is that it requires no administrative involvement — and a user-level index over your personal working set of mail and documents.
It lives in an isolated container in your own tenant, in your SharePoint home region; for customers under the European Union Data Boundary it sits in an EU or EFTA datacentre. It cannot be switched off — administrators can only exclude individual sites.
What happens to your data
Microsoft states this identically across several documentation pages, so it is worth quoting the substance: prompts, responses, and data accessed through Microsoft Graph are not used to train foundation language models, including those used by Copilot. Optional product-improvement feedback is excluded too, and Copilot has opted out of the human-review abuse-monitoring programme that the underlying platform otherwise runs.
Two 2026 developments that complicate the neat version
Flex Routing. From 27 March 2026, inference — the model call itself, not stored data — can run outside the EU Data Boundary during peak demand. It is on by default for tenants created after 25 March 2026.
OpenAI as a subprocessor. Added 23 June 2026, available 9 July, and automatically enabled for all eligible commercial customers on 24 July 2026, with opt-out. This is architecturally new: Microsoft's earlier position was that Azure-hosted models do not interact with any services operated by OpenAI.
Neither is hidden, and both are administrator-toggleable. But both default to on, both landed inside four months, and the general overview page had not caught up with the first of them when this chapter was researched. If you have data-residency commitments, these are the settings to check rather than assume.
The three tiers — and why the free-versus-paid framing is wrong
Most coverage describes a simple split: free Copilot Chat, or paid Copilot. Microsoft's own current structure has three tiers, and the difference between them is grounding itself.
| Tier | Cost | What it can see |
|---|---|---|
| Copilot Chat (Basic) | Free with a qualifying licence | Web data only. To use company content you must paste or upload it manually. |
| Microsoft 365 Copilot (Basic) | Free, in-app | Also web only, with capacity-limited standard access. |
| Microsoft 365 Copilot (Premium) | $30 per user / month | Automatic grounding in Microsoft Graph, the semantic index and Work IQ, plus priority access. |
That is the actual product boundary. The free tiers are a competent web assistant. The thing people mean when they say Copilot — it knows about my organisation — is the paid tier only. A pilot run on the free tier does not test the product you are considering buying.
Work IQ is described as an intelligence layer letting agents reason over organisational data, content and tools. It is separately switchable — off means no Graph enrichment even for paid users.
Licensing details worth knowing
- Launched 1 November 2023 at $30 per user per month with a 300-seat minimum. The minimum was removed on 15 January 2024 — Microsoft's own words: we are removing the 300-seat purchase minimum. There is no seat minimum today, and plenty of writing still says there is.
- Qualifying base plans now include Microsoft 365 E3, E5 and E7, Business Basic, Standard and Premium, F1 and F3, and the Office 365 equivalents. E7 is new enough that most secondary coverage still lists only E3 and E5.
- For Business customers it is also sold bundled: Business Standard with Copilot at $23.50, Business Premium with Copilot at $32.00, both permanent SKUs from 1 July 2026.
Which model is answering
Model routing is real and documented. The default Auto mode chooses between a fast high-throughput model and a slower reasoning model that plans before answering. Choosing a model does not change your security or compliance settings. The specific model versions turn over every few months, which is precisely why this chapter names the mechanism and not the version.
Check yourself