Copilot setup: The 2025 admin checklist for a secure and successful roll‑out

Step 1 – Check licensing prerequisites

Copilot is sold as an add‑on license on top of a base Microsoft 365 subscription. To be eligible, users need one of several Business or Enterprise licenses, such as Microsoft 365 E5, E3, F3 or Business Premium.

Education faculty and higher‑education students aged 18+ can also purchase Copilot with A3 or A5 licenses. The Copilot license activates Copilot features across Word, Excel, PowerPoint, Outlook, Teams and other apps once assigned.

• • Review your existing plan. Start by checking our license guide for Microsoft Copilot. Check your organization’s current Microsoft 365 subscription to ensure it’s on the eligible list. If not, upgrade to a supported plan or purchase a new plan via the Microsoft 365 admin center.
  • Purchase the add‑on. Copilot licenses are purchased via the Billing > Purchase services section in the admin center or through your reseller. Copilot may soon become bundled into broader licenses, but at the time of writing (Sept 2025) it’s still a separate add‑on for most plans.
  • Assign licenses. Using the Microsoft 365 admin center or PowerShell, assign Copilot licenses to individual users or groups. After assignment, Copilot appears within 24 hours in users’ apps and may require a restart.

Step 2 – Prepare a test and pilot environment

Don’t enable Copilot for everyone at once. A controlled pilot lets you validate policies, network settings and training. Microsofts setup guide recommends:

• • Create a test environment. Set up a tenant or test group with the necessary licenses to validate configurations and run scenarios. Test features like Word drafting, Excel analysis and Teams meeting summaries.
  • Conduct pilot testing. Start with a cross‑functional cohort – IT, HR, comms and a few business units – to gather feedback. Identify which workflows benefit most from Copilot and where prompts need refinement.
  • Develop a communication plan. Outline how you’ll explain Copilot’s capabilities, training opportunities and known limitations to employees. Communicate why only select users have early access and when others will be included. Use both email and internal social channels to build excitement.
  • Review conditional access policies. Ensure that existing conditional access policies don’t inadvertently block Copilot. SharePoint Online supports tenant‑level conditional access policies.
  • Use SharePoint Advanced Management (SAM). SAM allows you to manage content lifecycle and limit oversharing. Implement restricted SharePoint search so Copilot can’t discover sensitive content before you’re ready.

This guide of Microsoft fits well within step 1 and 2 of our 5 step Microsoft Copilot Implementation Guide, based on our rollouts in 50+ SBM organizations.

Step 3 – Update Office channels and apps

Copilot uses features that ship with the latest versions of Microsoft 365 Apps, so your update channel matters. According to Microsoft’s setup guidance:

• • Choose a production channel. Copilot is available in all update channels except the Semi‑Annual Enterprise Channel. The Current Channel delivers the newest app features as soon as they’re ready, giving users the best experience. The Monthly Enterprise Channel offers predictability, releasing new features on a monthly cadence.
  • Preview channels for validation. Current Channel (Preview) and Beta Channel allow IT teams to test features before broad deployment. Use these for your pilot group.
  • Manage update channels. Use the Office Deployment Tool or Microsoft 365 Apps admin center to change users’ update channels. Ensure devices have auto‑updates turned on.
  • Run the Office Feature Updates task. This scheduled task is required for core Copilot experiences to run properly. Allow it to run and access the network resources it needs.

Step 4 – Configure network access

Copilot’s AI capabilities rely on cloud services; blocking the wrong domains will break functionality. Microsoft lists specific network requirements:

• • Allow Microsoft 365 endpoints. Make sure the worldwide Microsoft 365 URLs and IP address ranges aren’t blocked.
  • Permit Copilot domains. Copilot needs access to copilot.microsoft.com, *.copilot.microsoft.com, *.bing.com and *.bingapis.com. These domains enable richer web‑based experiences such as Bing grounding and Copilot Chat.
  • Support WebSockets (WSS). Copilot uses WSS connections; confirm your network allows WSS to domains like *.cloud.microsoft and *.office.com. Network devices that block WSS or perform TLS inspection can cause application failures.
  • Prepare for the cloud.microsoft domain. Microsoft plans to consolidate Copilot services under the *.cloud.microsoft domain. Add this wildcard to your allowed list to avoid future issues.
  • Follow Microsoft 365 network connectivity best practices. Evaluate network performance and location; route traffic directly to Microsoft’s network to reduce latency.

Step 5 – Review privacy and connected experience settings

Privacy settings in Microsoft 365 affect whether Copilot appears for users:

• • Enable third‑party cookies in Word Online, Excel Online and PowerPoint Online so Copilot can function.
  • Review the Microsoft 365 Copilot and privacy controls for connected experiences. Data that flows through Copilot is subject to Microsoft’s privacy commitments; prompts and responses aren’t used to train foundation models or shared outside your organization. Let your data protection officer know.

Step 6 – Enable app experiences across the suite

Copilot appears in many Microsoft 365 apps once licenses and network settings are in place. Additional steps vary by app:

• • Word, Excel, PowerPoint & OneNote: When creating a new document, users will see the Copilot button or dialog. The file must be editable (not read‑only), and they must be signed in with their work account.
  • Outlook (new & classic): Copilot works in both the classic and new Outlook clients. Users may need to switch to the new Outlook by selecting “Try the new Outlook” in their existing client.
  • Teams meetings: To enable Copilot in Teams to reference meeting content after meetings end, you must turn on transcription or meeting recording. For PSTN calls, you need a Teams Phone license, a calling plan and a Copilot licence.
  • Teams channels & chat: Once Copilot is enabled, users will see a Copilot icon in chat and channel posts. Administrators can manage settings via the Copilot Control System.
  • Loop & Whiteboard: To use Copilot in Loop and Whiteboard, ensure these apps are enabled for your tenant.

Step 7 – Implement security measures

Because Copilot operates on your business data, strong security controls are non‑negotiable. Microsoft recommends:

• • Multifactor authentication (MFA). Enable MFA for all users; use Conditional Access policies to enforce MFA based on risk, location or device compliance. Educate users about MFA and why it matters.
  • Audit logging. Turn on unified audit logging to capture user and admin activities. Configure retention policies based on regulatory requirements and monitor logs regularly.
  • Restrict sensitive information. Identify the top 100 most‑used SharePoint sites, assess oversharing using SAM permission state reports and Purview DSPM assessments, and then restrict access to overshared sites. Apply sensitivity labels and DLP policies to prevent Copilot from surfacing restricted content.
  • Proactive monitoring. Disable “Everyone except external users” sharing at the tenant level and use Purview audit to monitor Copilot interactions.

Step 8 – Configure and manage Copilot settings

Once licenses and security are in place, use the Copilot Control System in the Microsoft 365 admin center to adjust settings:

• • View the status of license assignments and verify who has access.
  • Manage data security and compliance settings. For example, decide whether Copilot can use web results for grounding; restrict or enable plugins that connect to other applications.

Step 9 – Roll out in phases and measure adoption

A phased roll‑out ensures you can manage capacity, gather feedback and refine policies:

• • Pilot: Assign licenses to a small, cross‑functional group. This group will surface early issues and help refine training materials. Identify champions who can share prompts and success stories with their peers.
  • Deploy: Expand to larger groups once the pilot group confirms that network, privacy settings and policies work as expected. Use adoption kits from the Microsoft Copilot adoption hub for user onboarding.
  • Operate: Monitor usage, support users and adjust configuration as new features roll out. Use metrics like active Copilot users, top features used and time saved to quantify ROI.