AI and Microsoft 365.

What Microsoft’s built-in AI does today

Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot, though licences may still show the old name (Microsoft Learn). Free Copilot Chat comes with eligible Microsoft 365 subscriptions but is “primarily web grounded”: without a licence it does not search your organisation’s files, apart from limited inbox and calendar grounding in Outlook (Copilot Chat overview). A licence adds Work IQ grounding in company data, Copilot inside the Office apps and Teams, and the Researcher and Analyst agents.

NZ prices on 19 October 2026, per user per month paid yearly and excluding GST: the Copilot Business add-on lists at NZ$34 (NZ$29.14 for the first year on commitments made by 31 December 2026), Business Standard with Copilot NZ$38, and Business Premium with Copilot NZ$51.80 (Microsoft NZ). Microsoft says prompts, responses and Graph data are not used to train foundation models.

Integration routes and when to use each

Work IQ API access “is independent of Microsoft 365 Copilot licensing” and billed by usage through Copilot Credits (Work IQ); its retrieve tool was still in public preview on 14 October 2026.

Automation 1: policy and project answers with citations

Inputs

A staff question, plus two or three SharePoint libraries named by their owners (for example HR policies and project standards).

Retrieval

Graph search and file reads with a delegated token, so results are trimmed to what the asking person can open.

Model step

Answer only from retrieved passages, quote the clause, and link each source by webUrl with its last-modified date. Say “not covered” rather than guess.

Human review

No per-answer approval; owners review a weekly sample and every answer marked unhelpful.

Write-back

None. The assistant reads only.

Measures

Answers with a valid citation, “not covered” rate, owner corrections per week.

If you copy content into your own search index for speed, store each chunk’s drive item ID, eTag and permissions, and re-check access with the user’s token before showing it. An index without permissions is a leak waiting to happen. Our guide to building private AI search covers that design.

Automation 2: contract change summaries for owners

1. Subscribe. Create a Graph change notification on the contracts library. The subscription expires in under 30 days, so renew it on a schedule.
2. Compare. When a file changes, fetch the new and previous versions and have the model list changed clauses, dates and amounts.
3. Approve. The contract owner reviews the summary in Teams or email and accepts or corrects it.
4. Record. On approval, write the summary to a “Change summary” column in the SharePoint list, with the version number it describes.

Permissions, scopes and approval design

Use delegated access wherever a person is present. Microsoft’s own documentation says a delegated application “can never exceed the current user’s existing permissions”, while application-only access is “considered higher risk” (Selected permissions). For background jobs, avoid tenant-wide Files.Read.All or Sites.Read.All. Use Sites.Selected or Lists.SelectedOperations.Selected, which give no access until a site or list owner explicitly grants the app a read or write role on that resource. Grant read to the retrieval service and write only to the step that runs after approval. Log the user, query, files returned and answer. Our agent permissions and approvals guide covers action tiers.

Costs and limits

Graph applies a global limit of 130,000 requests per 10 seconds per app, with lower, service-specific limits for SharePoint and Outlook; throttled calls return HTTP 429 with Retry-After (throttling limits). The cost comparison is usually licences against usage. Illustrative example: 25 staff on the Copilot Business add-on at list price is NZ$850 a month before GST. A custom policy assistant handling 1,500 questions a month at 8,000 input and 600 output tokens each on Claude Sonnet 5.5 (US$2 and US$10 per million tokens, 19 October 2026) costs about US$33 a month in model fees, plus build and support. The licence buys breadth; the custom build buys one task done precisely.

Where it goes wrong

• Oversharing surfaces. AI makes old sharing mistakes searchable. Audit “everyone” links on HR, finance and board sites first.
• Stale indexes. Drive item notifications average under a minute but can take up to six hours, so show each source’s modified date.
• Data location. Data can be stored in New Zealand, but Microsoft says queries outside the EU may be processed in the US, the EU or elsewhere, and New Zealand is not on its in-country processing roadmap. Anthropic models in Copilot are excluded from in-country commitments.
• Encrypted files. Labelled or encrypted documents may be unreadable to your app; treat “could not read” as an explicit result, not an empty answer.
• Manual recovery. If a subscription lapses, run a delta sync of the library before resuming, and tell owners which summaries were missed.

For Teams-specific assistants see AI and Microsoft Teams, and for document libraries see AI and SharePoint. We design and build these retrieval systems as part of our AI integration services.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.