Microsoft 365 Copilot for small business: what it actually does, what it costs, and whether it's worth it

What Copilot actually does

Microsoft 365 Copilot is a paid AI assistant layered on top of the Microsoft 365 apps you already use. Inside Word, Excel, PowerPoint, Outlook, Teams and SharePoint, it drafts and rewrites documents, summarises long threads and files, spots trends in a spreadsheet, and transcribes, translates and summarises Teams meetings^[1]. It also handles some of the repetitive admin work nobody enjoys - generating a first-draft report, drafting a follow-up email, pulling together a summary of what was decided in a meeting you missed^[1].

What it is not: a separate database, a search engine with its own index of your company, or something that "knows" more than the people using it. It works inside the apps you already have, on the files and messages those apps already show a given user.

Real examples from Microsoft's own case studies give a clearer sense of scale than the feature list does. One marketing team went from three hours to as little as 30 minutes drafting a campaign brief. A customer-feedback review that used to take three or four hours now takes under one. A content team cut production time from weeks to days^[1]. None of those numbers will match your business exactly, but they're the shape of what changes: less time on the first draft, more time on the judgement call that comes after it. The reason that lands is where the week already goes: McKinsey's work on knowledge work put roughly a fifth of the working week into searching for internal information and chasing the colleagues who have it^[2].

What it costs, for a real team

Copilot is not sold on its own any more. It sits on top of a Microsoft 365 Business plan, and for new customers it now only comes bundled with one^[3]:

• Business Standard + Copilot: about $23.50 per user, per month, billed annually.
• Business Premium + Copilot: about $32 per user, per month, billed annually.
• Standalone Copilot Business add-on, for businesses that already hold a qualifying licence: $18 per user, per month, promotionally through 30 September 2026, reverting to $21 after^[3].

For a 10-person team on Standard, that's roughly $235 a month, or about $2,820 a year, on top of whatever the base Microsoft 365 licence already costs. On Premium it's closer to $320 a month. Both bundles cap out at 300 users per tenant^[3] - past that you're into Enterprise licensing, a different conversation.

That's the whole cost. There's no separate infrastructure to run, no server to patch, no consultant needed to "install" it. The only real cost beyond the licence is the one nobody puts in a pricing table: the time it takes your team to actually change how they work.

Why the return varies so much

Forrester's commissioned study of small and medium businesses using Copilot modelled three scenarios over three years: a low-impact case at 132% ROI, a medium case at 243%, and a high case at 353%, based on a survey of over 200 companies with up to 300 employees^[4]. The same study reported new-hire onboarding accelerating by 25%^[4].

Two things are worth being honest about before you take that range as gospel. First, it's commissioned by Microsoft and projected - built from financial modelling across risk scenarios, not measured against actual before-and-after deployments^[4]. Treat it as a framework for what's plausible, not a guarantee for your business. Independent tracking outside the vendor ecosystem points the same way with narrower numbers: Stanford's AI Index finds business adoption climbing fast, and the productivity gains measured in controlled studies real but smaller than vendor projections^[5][6]. Second, and more useful: the range is wide mostly because of adoption, not because of anything the licence does differently at different price points.

Microsoft's own 2026 Work Trend Index, based on a survey of 20,000 full-time knowledge workers across ten countries, found that when a manager actively uses AI themselves and is visibly seen doing it, employees report a 17-point lift in the value they get from it, a 22-point lift in critical thinking about how they use it, and a 30-point lift in trust in agentic AI tools^[7]. Workers whose manager creates space to experiment are 1.4 times more likely to become high-frequency users^[7].

That lines up with what we see on the ground. The businesses that land at the high end of that ROI range are the ones where someone senior actually uses Copilot day to day and says so out loud. The businesses at the low end bought the licences, sent one email about it, and left the team to figure it out alone.

The risk that has nothing to do with Microsoft

The part of a Copilot rollout that goes wrong is almost never Microsoft mishandling your data. Copilot doesn't have its own view of your files - it shows a person exactly what they could already open by browsing to it themselves, using the same SharePoint and OneDrive permissions your business already has in place. If it can't already be opened, Copilot can't surface it either.

Which is exactly the problem. In a lot of small businesses, permissions are looser than anyone realises: the HR folder, the finance folder and the client contracts folder are all visible to "everyone" because nobody ever went back and tightened them after the business grew past a handful of people. Microsoft's own security guidance for Copilot names this directly as a governance problem, building oversharing-detection and policy recommendations into Purview specifically because Copilot makes existing over-permissioning far easier for someone to stumble into^[8]. Independent baselines say the same thing without a product to sell - the CIS Microsoft 365 Foundations Benchmark treats default-open sharing and unreviewed permissions as settings to tighten, not preferences to leave alone^[9][10].

The fix is not complicated, and it is not Microsoft's job to do it for you. Before turning Copilot on for the team:

1. 1Audit existing file permissions in SharePoint and OneDrive - who can actually open the HR, finance, legal and client-data folders today, not who's supposed to be able to.
2. 2Restrict the folders that matter to the people who genuinely need them, before anyone gets a Copilot licence.
3. 3Turn it on for a pilot group of three to five people, not the whole company at once.
4. 4Review what the pilot group actually uses after 30 days, and decide whether to expand from real usage rather than a guess.

None of this is a long project. A permission audit for a 10-person business is a few hours' work, not a few weeks. Skipping it - not the price of the licence - is the mistake that actually costs businesses.

What this actually means for your business

If your team already lives in Microsoft 365, Copilot is very likely worth the cost. The licence isn't the risk. The risk is buying it and letting it sit unused, or switching it on for everyone before checking who can already see what.