Kesslernity · M365 Copilot Field Guide
Copilot Chat — What It Actually Sees
Your licence determines the data. Your permissions determine the result.
"Copilot didn't mention that email." "Why does my colleague get a different answer?" "Why does it know this sometimes and not others?" These are licence and permission questions, not prompt questions. This guide explains what Copilot Chat can and cannot see, and why.
Seat threshold applies
In tenants with more than 2,000 M365 seats, Copilot Chat is not available inside Word, Excel, PowerPoint, or OneNote without a paid M365 Copilot licence. Those apps show an upgrade prompt instead of a Copilot response. Copilot Chat within Outlook is unaffected — inbox and calendar grounding remain available to all M365 users at no extra cost. Microsoft labels the two tiers "Copilot Chat (Basic)" and "M365 Copilot (Premium)." (MC1253858)
What's new — June/July 2026
June 17, 2026 — June 16 GA wave: Copilot Cowork is now generally available worldwide, a new
Copilot Credits usage-billing meter has gone live ($0.01 per credit, off by default), and the
Work IQ APIs reached GA on June 16, 2026. None of this changes what Copilot Chat
sees — your licence still determines the data and your permissions still determine the result — but it does change
which surfaces draw a usage charge when they reach into your M365 data. The two new sections below ("Work IQ — the context layer underneath the data scope" and "When access to your data is metered") explain how that fits the data-scope picture in this guide.
July 2026 governance additions: Purview controls now cover Cowork interactions, including sensitivity label inheritance, audit logging, DSPM activity, Insider Risk Management, eDiscovery, and Communication Compliance, all rolled out in June. Copilot-generated files automatically inherit the
highest sensitivity label found in their source data, and users are notified if a label cannot be applied. A Purview DLP control to
exclude external-sender emails from Copilot grounding is in public preview, with general availability targeted for July. Microsoft is also extending
Purview DLP for M365 Copilot into government clouds, letting admins block Copilot and agents from returning a response when a prompt contains sensitive data (Rolling Out, Roadmap 561892).
Licence required before you start
The features in this guide require the Microsoft 365 Copilot paid add-on. They are not available on standard M365 plans (E3/E5) or free Copilot Chat (except Copilot Chat within Outlook, which retains inbox and calendar grounding for all users). Verify your licence under Settings → Subscriptions or contact your Microsoft admin or check your organisation's licence portal.
What each tier can access
| Data source |
Free (E3/E5 included) |
M365 Copilot paid add-on |
| Outlook email (received) |
Copilot Chat in Outlook only · inbox grounding · standalone Chat has no access |
Up to 10 results per query · recency-weighted |
| Outlook calendar |
Copilot Chat in Outlook only · calendar grounding · standalone Chat has no access |
Yes — meetings, invites, attendees |
| Teams chat messages |
No access |
Last 30 days · current thread only (in Teams app) |
| Teams channels |
No access |
Channels you are a member of only |
| OneDrive files |
No access unless you upload the file manually |
Yes — files you have access to · @mention to reference explicitly |
| SharePoint documents |
No access |
Yes — sites and files your permissions allow |
| Meeting transcripts (Teams) |
No access |
Yes — meetings you attended where transcription was enabled |
| Web (Bing search) |
Yes — primary data source |
Yes — Web/Work toggle controls which is queried |
| Files uploaded to chat |
Yes |
Yes |
| Copilot Notebooks |
No access |
Yes — grounded in references you pinned |
| SAP · Primavera · external systems |
No access |
No access without a custom connector. Federated connectors for third-party apps (Canva, HubSpot, Notion, Linear) in Public Preview as of February 2026. |
How to confirm which tier you have: open Copilot Chat. If you see a Web / Work toggle in the interface, you have the paid add-on. If you see web results only with no toggle, you are on the free tier.
How the permission model works
1
Your identity, your data
Copilot queries Microsoft Graph using your identity. It can only retrieve content you already have permission to access. No new access is created. If you cannot open a SharePoint file, Copilot cannot see it either.
2
Permissions are enforced at retrieval
The semantic index that powers Copilot retrieval enforces your access controls at query time, not at index time. Content is filtered before it reaches the model — the model never "sees" data it could not surface to you.
3
Sensitivity labels are respected
Emails and files encrypted with Purview sensitivity labels are subject to usage rights. If your rights do not include content extraction, Copilot will not surface that content even if you can open the file.
4
Overshared content is visible
Copilot surfaces everything your permissions allow — including files shared too broadly. If a SharePoint site grants view access to everyone in the organisation, Copilot can retrieve its content for any user. This is a governance issue, not a Copilot issue.
Work IQ — the context layer underneath the data scope
🧠
What Work IQ is
Everything described in the scope table above — retrieving your email, your Teams threads, your SharePoint files through your permissions — runs on Microsoft's context layer for M365 Copilot, now branded Work IQ. Work IQ has three parts: Data (the permission-trimmed retrieval over Microsoft Graph), Memory (what Copilot retains across sessions), and Inference (how it reasons over what it retrieved). It is the same mechanism this guide has always described — the permission model and recency windows below all live inside Work IQ Data.
🔌
The Work IQ APIs reached GA on June 16, 2026
As of June 16, 2026, the Work IQ APIs are generally available (A2A and remote MCP are GA; a REST API is "coming soon"). This lets custom and third-party agents ground in the same permission-trimmed M365 context that Copilot Chat uses — they see only what the signed-in user can see, exactly as described in the permission model above. The data-scope rules in this guide therefore apply to those agents too, not just to Copilot Chat.
When access to your data is metered
The scope table answers what Copilot can see. The June 16 GA wave adds a second question for some surfaces: does reaching into that data draw a usage charge? Microsoft's new consumption meter is Copilot Credits ($0.01 per credit on pay-as-you-go; commit-for-discount tiers also exist). Credits are off by default — admins switch them on and set spend limits and usage alerts at tenant, group, or user level, with reporting in a new Cost Management dashboard in the M365 admin center.
✓
Pre-built Microsoft Copilot agents — not separately metered
Microsoft's own pre-built Copilot agents, used under an existing M365 Copilot licence, are not separately metered. Your $30/user/month add-on remains the access gate, and using those built-in agents over your M365 data does not draw Credits on top.
$
Custom & third-party agents via Work IQ — metered
When a custom or third-party agent (built in Copilot Studio, Microsoft Foundry, or directly on the Work IQ APIs) accesses your M365 data through Work IQ, that usage is metered in Copilot Credits. A task's cost reflects model use, context retrieval, tool calls, and runtime. The licence is still the gate; the Credits meter applies on top.
$
Unlicensed Copilot Chat — a metered surface
Unlicensed Copilot Chat draws Copilot Credits — it is one of the surfaces the meter covers. This does not widen what it can see: the free tier remains web-grounded (plus inbox/calendar grounding inside Outlook), exactly as the scope table shows. Metering governs cost, not data scope.
i
Scope first, cost second
Credits never grant access your permissions don't already allow. Work IQ still trims every retrieval to what the signed-in user can see. Read the scope table to know what an answer can contain; read this section to know what it costs to produce.
Sources: Copilot Cowork is now generally available ·
Announcing the new Work IQ APIs ·
Usage-based billing with Copilot Credits
Why two people get different answers to the same prompt
📧
Different email and Teams histories
Each user's Copilot query runs against their own inbox, their own Teams threads, their own calendar. If User A is on a project email chain and User B is not, they return different results from identical prompts. This is correct behaviour — the answers reflect reality for each person.
🔒
Different SharePoint and OneDrive permissions
A document visible to a project manager may not be visible to a team member not added to that SharePoint site. Copilot returns what each user can see. Two people asking "what does the project charter say" get different answers if only one of them has access to the charter.
⏱
Different recency windows
Copilot prioritises recent content. If User A received a relevant email yesterday and User B received one three months ago, the same prompt surfaces different content — not because the data is missing, but because recency scoring ranks it differently. The hard email cap of 10 results per query amplifies this effect.
Why Copilot ignored that message
Six specific reasons — with what to do about each
1
Most common
You are using standalone Copilot Chat on the free tier
Standalone Copilot Chat (at m365.cloud.microsoft or in Office apps) accesses web data only on the free tier. It cannot see Teams messages, SharePoint, or OneDrive. Exception: Copilot Chat within Outlook provides inbox and calendar grounding for all M365 users, even without the paid add-on — but only when accessed inside Outlook itself.
What to do
For email queries, open Copilot Chat inside Outlook — it has inbox access without the paid add-on. For Teams, SharePoint, and cross-app queries, the paid M365 Copilot add-on is required.
2
Hard limit
The email cap returned other messages first
Copilot returns a maximum of 10 emails per query, ranked by relevance and recency. If your query matches 50 emails, 40 are silently dropped. An important but older message may never appear — not because Copilot cannot access it, but because it ranked below the cut-off. This limit is not displayed in the interface.
What to do
Narrow the prompt: add a specific sender, date range, or subject keyword to push the relevant email into the top 10. "Emails from [name] in March about [topic]" outperforms a broad summary request.
3
Common
The Teams message is older than 30 days
When using Copilot inside Teams, the default search window for chat messages is the last 30 days of the current thread. Messages outside that window, or from other chats and channels, are not searched unless you specify a date range explicitly in the prompt.
What to do
Include the date range in the prompt: "from December 2025" or "in Q4 last year." Copilot can search further back when instructed explicitly.
4
Common
You are not a member of that Teams channel
Copilot only accesses Teams channels and group chats you are a member of. A message posted in a project channel you were not added to is invisible — even if colleagues tell you it exists. Private channel messages are also restricted to members of that private channel.
What to do
Ask a channel member to forward the message or share the file directly with you. Once it is in your scope, Copilot can reference it.
5
Frequent in large teams
The file is on SharePoint but you lack access
An email may reference a SharePoint document, but if you were not granted access to that document or site, Copilot cannot retrieve its content. The email itself may appear in results, but the document it references remains inaccessible. Copilot cannot escalate permissions or prompt you to request access.
What to do
Request SharePoint access through the site owner. Once granted, Copilot will include the document in future queries. No re-indexing required — access is checked at query time.
6
Less common
The content has a sensitivity label that restricts extraction
Files and emails classified with Purview sensitivity labels may have usage rights that block content extraction. Copilot respects these rights — it will not surface the content of a document marked "Confidential — No Copy" even if you can open it in Word. The file exists in your scope; the content does not reach the model.
What to do
Check the sensitivity label on the document. If the label is the constraint, contact your Information Protection admin — the label configuration, not Copilot, is the control point.
Common false assumptions
Assumption
The Copilot Chat included in my M365 E3 or E5 licence searches my work emails and Teams messages.
Reality
Partially. Standalone Copilot Chat (free tier) is web-only — no Teams, SharePoint, or OneDrive access. However, as of early 2026, Copilot Chat within Outlook provides inbox and calendar grounding for all M365 users without the paid add-on. The paid add-on is still required for Teams data, SharePoint, and the full Copilot feature set.
Assumption
Copilot searches my entire email history. If I ask about a project from two years ago, it will find the relevant emails.
Reality
Copilot returns at most 10 email results per query, ranked by recency and relevance. Older emails may rank below the cut-off. Narrow the query with a sender name, date, or subject keyword to improve retrieval.
Assumption
Copilot in Teams searches all my Teams conversations — channels, group chats, and direct messages.
Reality
Within the Teams app, Copilot searches the current chat thread only, defaulting to the last 30 days. To search across channels and messages, use Copilot Chat at m365.cloud.microsoft/chat with the Work mode active.
Assumption
My prompts and Copilot's responses are used to train Microsoft's AI models.
Reality
No. Microsoft explicitly states that prompts and responses from M365 Copilot are not used to train foundation models, including Microsoft's own. Your organisational data does not leave your M365 tenant to train AI.
Assumption
Copilot can access any SharePoint content in my organisation — including sites I have not visited.
Reality
Copilot accesses only what your permissions allow. If you do not have access to a SharePoint site, Copilot cannot retrieve content from it. Overshared sites are the exception — if a site grants everyone access, all users can retrieve its content via Copilot.