Over the last few days I've run into the same surprise in several tenants. The newly renamed Microsoft 365 Copilot app suddenly shows a prominent "Copilot Chat" button in the navigation. The reason is simple enough. As of 15 January 2025, Microsoft 365 Copilot Chat is available to all users with Entra ID, and no additional Copilot licence is required. At first glance that looks like a big free upgrade for every Microsoft 365 tenant, but as usual the details matter. Admins and security leads need to know what users actually get, how it differs from the paid Copilot licence, and which settings deserve a closer look.

Copilot Chat combines web grounding with enterprise data protection and agents

The version of Microsoft 365 Copilot Chat that every user now gets is a chatbot grounded only in public web content, with full enterprise data protection (commercial data protection) in place. User conversations and data are not used to train AI models, and nothing leaves the Microsoft-secured environment. The part I find more interesting is the new option to add your own Copilot agents, which now comes with a pay-as-you-go model. If you want to use an agent (with Graph access, workflows or custom data connectors), you can enable this tenant-wide and bill it through an attached Azure subscription. That makes Copilot Studio relevant for a lot of organisations that never had a large Copilot budget.

Public web grounding, optional agents and a clear separation from tenant data together raise plenty of questions from privacy officers and works councils. What has worked for me is to state the boundaries plainly and show the technical controls, above all the separation between web and tenant data. Microsoft documents the differences between Copilot capabilities here.

Unlicensed users get web answers but no tenant data

In practice, users without a Microsoft 365 Copilot licence can open Microsoft 365 Copilot Chat directly in the Microsoft 365 Copilot app, but it only uses public web grounding (Bing search, publicly available content). It has no access to internal organisational data from Exchange, SharePoint or Teams, and there's no tenant Graph grounding unless someone provisions a specific Copilot agent for those users via Copilot Studio with pay-as-you-go enabled. The line between licensed and unlicensed Copilot use has never been this clear.

If you want to enable or pin Copilot Chat for your users, the setting sits in the Microsoft 365 admin center under Copilot → Settings → Pin Copilot Chat. You can switch the feature on or hide it for the whole organisation, which helps if you're still waiting for the works council or internal communications to sign off.

A tip from practice. You can configure which web content Copilot Chat can reach in the admin center (Copilot → Settings → Web Content). If you don't want internal users to accidentally send sensitive queries to Copilot Chat, check these controls. In many tenants the defaults are still far too open.

Users also need to hear, in so many words, that Copilot Chat is not a place for company or personal data unless they have a licence.

Pay-as-you-go agents are billed through an Azure subscription

With pay-as-you-go licensing, admins can now offer Copilot agents without buying volume licences. The setup isn't complicated. As a global admin or Copilot Studio admin, open Billing in Copilot Studio and pick the Azure subscription that should be charged. For each agent you then decide who may use it and whether it gets access to tenant data or custom connectors.

This simple flow diagram shows how Copilot Chat, agents and pay-as-you-go billing fit together:

flowchart TD
    U["User (no licence)"] --> C["Copilot Chat (Web)"]
    U --> A["Copilot Agent (optional)"]
    A --> B["Pay-as-you-go billing (Azure Subscription)"]
    C -- "no tenant data" --> W["Web search"]
    A -- "if enabled: tenant data" --> T["Internal data"]

Figure: How Copilot Chat, agents and pay-as-you-go billing interact.

Microsoft's admin guidance on enabling and billing agents is in the official pay-as-you-go overview.

The full licence still wins on tenant data access

The biggest difference remains access to tenant data. Without a Copilot licence, questions about your own emails, Teams chats, OneDrive files or SharePoint sites go unanswered, because Copilot Chat only works with the web. Organisational knowledge only comes into play with assigned licences (or a specifically enabled agent). The deeper integrations are missing too. Use inside the Office apps, drafting emails, meeting summaries and similar features stay reserved for full licence holders.

One more thing from the field. Copilot Chat may be visible everywhere now, but I wouldn't expect usage across the company to shoot up overnight. Once people notice it only knows the web out of the box, the initial enthusiasm usually cools off. In a few projects I saw real value when targeted agents were rolled out for specific workflows, and that's where users actually felt a difference.

My playbook relies on clear communication and governance

For admins, transparency matters more than anything else here. Clear intranet posts, targeted messages to users and an open conversation with the works council prevent a lot of confusion. I recommend keeping an FAQ that covers these points:

  • What data does Copilot Chat use without a licence?
  • How can I enable or disable Copilot Chat for my users?
  • When do agents come into play, and what do they cost?
  • What happens to my chat prompts?

The technical details, including the web content controls, are in the Microsoft 365 admin center under Copilot → Settings. Larger organisations should write their own governance guidelines for Copilot agents and keep an eye on usage at regular intervals. If you want to go further into tracking usage and licence ROI, have a look at my post Copilot usage reports: Tracking adoption and licence ROI.

For me, this is an important step for AI in the enterprise. It's also a reminder to tackle data protection, governance and actual business value directly. If that doesn't happen, Copilot Chat may end up as just another chat icon in the app drawer.