Can I use Copilot – A simple guide

I often get asked “Can I use Copilot?”  The following is my take on this. (Please note that if you have any questions or concerns – drop me a message/email, also check with your internal compliance team.)

Can I Use Microsoft Copilot at Work?

Imagine this. You’re about to head into a client meeting and need to summarise a long email chain. Someone says, “Just ask Copilot.” Another colleague warns you not to put client information into AI. Then someone else tells you Microsoft Copilot is fine, but other AI isn’t.

What’s the actual position?

The short answer is yes; you can use Microsoft Copilot for work. You just need to make sure you’re using the right version and understand where client information should be stored.

Why does your Microsoft account matter?

When you’re signed into your organisation’s Microsoft 365 account, Copilot works within your organisation’s Microsoft 365 environment. That means it’s covered by the same security, identity and compliance controls that protect your emails, documents and other Microsoft 365 data.

Copilot looks almost identical wherever you open it. You might launch it from Edge, Windows, Word, Outlook or visit copilot.microsoft.com. The important thing isn’t where you open it. It’s who you’re signed in as.

Think about Outlook… When you’re signed into your work account, you see your work emails. Sign into your personal account and you see your personal inbox instead. Copilot works in much the same way.

One of the easiest ways to check you’re using the right version of Copilot is to look for the green shield icon. This is Microsoft’s visual indicator that you’re using Enterprise Data Protection (EDP). In simple terms, this tells you you’re signed in with your organisation’s Microsoft 365 account and are using Microsoft’s enterprise environment, rather than a personal Microsoft account.

When you see the green shield, your prompts and responses are protected by your organisation’s security and compliance controls. If you don’t see it, stop and check which account you’re signed into before entering any client, matter or confidential firm information.

If you’re signed into your organisation’s Microsoft 365 account, you’re working within your organisation’s secure Microsoft 365 environment. If you’re signed into a personal Microsoft account, you’re outside that environment, so you shouldn’t enter client, matter or confidential firm information. This is the same if you are not logged into any account.

Also, recently Microsoft has added the working Basic or Premium next to your name on your chat pane, so you can see 1) if you are logged into your Work account and 2) what version you are using.

• Basic – included in your Microsoft 365 licence.
• Premium – an extra subscription which connects to your work data.

What can I use Copilot for?

Copilot is great for everyday tasks that help you work more efficiently. For example, you can use it to:

• summarise lengthy email conversations before a meeting
• draft or improve emails and documents
• brainstorm ideas
• explain complex information
• help structure reports or meeting notes

Copilot only works with the information you provide during the conversation unless you have a full Microsoft 365 Copilot licence.  If the firm have purchased a full licence for you, you won’t need to upload documents into the chat – Copilot will grab content from the Microsoft 365 areas that you already have permission to access (your emails, OneDrive, SharePoint, etc).

Personal Microsoft Copilot accounts and public AI services must never be used for client, matter or confidential firm information.

Is Microsoft 365 safe?

People sometimes assume that Teams, Loop or OneDrive are somehow less secure because they feel newer than Outlook or Word.

This is not true – they’re all part of the same Microsoft 365 environment managed by your organisation and are protected by the same security, identity and compliance controls.

Where should client information be stored?

Imagine you’ve taken meeting notes in Teams and asked Copilot to produce a list of actions. That’s a perfectly good use of Microsoft 365. Once those notes become part of the official matter record, though, they belong in your practice management system.

A simple way to think about it is this.

Your practice management system is where:

• the official matter record lives
• documents are managed
• workflows are followed
• client records are maintained