Before we start: what this course is
This course is independent of Microsoft. Microsoft does not endorse or review it, and it reproduces none of Microsoft's documentation. Everything here is our own explanation in our own words. Microsoft changes the Copilot admin screens, role names, licence names and limits often, sometimes several times a quarter. So we have one working rule for the whole course:
Every console path, role, licence name and limit you act on must be checked against Microsoft's current documentation on the day you use it, and you write that date in the ticket.
Where something is preview or unconfirmed, we say so. Here is an example of how fast things move. As of late October 2026, Microsoft's own pages call the app "Microsoft Copilot" (it used to be the "Microsoft 365 Copilot app") and give its main web address as copilot.cloud.microsoft. Older screenshots in your knowledge base may already be wrong.
The one-page picture
Think of Copilot as a research assistant who uses the user's own ID badge. The assistant reads what the badge opens, writes a draft and hands it back. It never gets a master key.
Here is the path a prompt takes. Learn it, because almost every ticket in this course sits at one stop on it.
[1] APP / SURFACE User clicks the Copilot button in Word, Outlook, Teams,
or opens copilot.cloud.microsoft and types a prompt.
|
[2] ORCHESTRATION Copilot works out what the user is asking and what
(Copilot service) context it needs: the open document, the meeting, the thread.
|
[3] GROUNDING It searches Microsoft Graph (mail, files, chats, meetings,
Microsoft Graph + calendar) AS THE SIGNED-IN USER. The semantic index helps it
semantic index find relevant items by meaning, not just keywords.
Only items this user can at least VIEW are returned.
(Web search via Bing too, if the tenant allows it.)
|
[4] MODEL (LLM) The prompt plus the grounding data goes to a large language
model, which writes the answer.
|
[5] SAFETY + RETURN Filters check for harmful content and prompt-injection
attempts, citations are attached, and the answer is shown
in the app. The prompt and response are saved as the
user's Copilot activity history.
One point that trips up new support staff: step 3 is not the same for everyone. A user with the paid Microsoft 365 Copilot add-on gets automatic grounding in their work data through Graph. A user with only the included Copilot Chat works mainly from the web and from files they upload or have open. Which Copilot a user actually has is the subject of the next level. For now, just remember that "Copilot" can mean different things on two desks side by side.
Map the ticket to the stop
This is the habit that will save you the most time. Before you touch anything, ask which stop the ticket is about.
Ticket wording -> Most likely stop
----------------------------------------------------------------------------
"There's no Copilot button in Word" -> [1] app/surface (version,
channel, sign-in, licence)
"Copilot says it can't find my Q3 deck" -> [3] grounding (permissions,
where the file lives, index)
"Copilot showed me HR's salary file!" -> [3] grounding: it only showed
what the user can already open.
That is OVERSHARING, so escalate
"The summary invented a figure" -> [4] model (verify, report it)
"It refused to answer / blocked my prompt" -> [5] safety filters
"Will my prompts train the AI?" -> [5] data handling (privacy answer)
Gotcha: the salary-file ticket feels like a Copilot bug. It almost never is. Copilot respects the permissions that already exist. If it surfaced the file, that user already had access through a sharing link, a broad group or an open site. Copilot just made the file easy to find. Treat it as a data exposure. Don't "fix" it by switching Copilot off for that user.
Gotcha: some tenants turn off Microsoft 365 Apps' privacy setting for "connected experiences that analyse your content". When that setting is off, Copilot features are unavailable in Word, Excel, PowerPoint, Outlook and OneNote. A missing button can be a privacy setting, not a licence.
A first read-only check
You'll learn the full licence checks later. Here's a safe first look, to show the read-only-first habit. It changes nothing.
# Read-only: list what licences a user holds (Microsoft Graph PowerShell)
Connect-MgGraph -Scopes "User.Read.All" # read scope only
Get-MgUserLicenseDetail -UserId "sam.lee@contoso.com" |
Select-Object SkuPartNumber # SKU names, e.g. E3/E5 plus any Copilot SKU
# Note the date and the result in the ticket before you change anything.
Explaining Copilot to a user, in plain words
Users don't need the diagram. They need a few honest sentences. Here is a script you can adapt:
- What it is: "Copilot is an AI assistant inside your Microsoft 365 apps. It drafts, summarises and answers questions using the web and, depending on your licence, the work content you already have access to."
- What it is not: "It isn't a search engine with a master key. It can't open anything you can't open yourself. It isn't always right either, so check figures and names before you send anything."
- Your data: "Your prompts and its answers are stored like your other Microsoft 365 work content. Microsoft states they aren't used to train its foundation AI models."
Write these explanations yourself. Don't paste Microsoft's pages into a reply. Wording you've written yourself is easier for users to follow, and it doesn't go out of date when Microsoft edits a page.
Best practice: when you do point to a Microsoft statement, link to it and add the date you checked it: "Per Microsoft's privacy page, checked 3 Nov 2026."
Key takeaways
- A prompt goes app → orchestration → Graph and the semantic index (as the user) → model → safety checks → back to the app.
- Map every ticket to one stop: a missing button is usually the app or surface; "can't see my file" is grounding; an "invented" figure is the model.
- Copilot only surfaces content the user can already view. An unexpected file in an answer points to oversharing, which you escalate. It isn't a Copilot bug.
- Microsoft states that prompts, responses and Graph data are not used to train foundation models.
- This course is independent of Microsoft and copies none of its documentation. Check every screen, role and limit against current Microsoft docs and date it.