Less than a year after generative AI (genAI) made a splash with the public launch of OpenAI's ChatGPT 3.5, Microsoft is about to make its Copilot assistant available within its ecosystem of productivity and collaboration applications. The rollout begins Nov. 1.

But while Microsoft has moved quickly to incorporate genAI into tools such as Word, Excel, and Teams, many Microsoft 365 customers are expected to take a cautious approach to deploying Copilot within their organizations. This means a focus on internal trials to identify use cases, and bolstering data security practices to mitigate the risks of connecting large language models to corporate systems. 

"I would think that 2024 is a year of experimentation, as opposed to volume procurement or volume deployment," said Matt Cain, a vice president and distinguished analyst at Gartner. 

M365 customers that access Copilot will be required to procure a minimum of 300 Copilot seats, which is "still a bit of a steep hill to climb. But I think most organizations are willing to treat it as speculative capital and say, 'Okay, let's see if this can really do anything for us.'"

Perhaps the most pressing issue for businesses looking to deploy Copilot involves data security. Microsoft already has security controls in place as part of its Azure Cloud, but the power of large language models (LLMs) will put any data management shortcomings into sharp focus.

The trade-off: productivity vs. security concerns?

Just as the M365 Copilot can help employees access information relevant to their roles, it could equally return sensitive and confidential files that haven't been properly categorized and protected - anything from customer or research-and-development information to HR and payroll data.

Copilot makes it a lot easier to access this information.

Microsoft's Copilot for the Field Service app in Outlook. (Click image to enlarge it.)

"It's just another level," said Rob Young, CEO of Infinity Group, a UK-based Microsoft consultancy. "All of a sudden, it's a lot easier to surface data by asking questions. 'How much does John Doe get paid?' Instead of going through all of the records to find it, [the Copilot will reply] 'John Doe, pay slip - there you go.'"

The introduction of Copilot highlights the importance of data management. "That's the first thing that people need to focus on and get on with. It's not to be scared of the technology, it's just to get your foundations in place," said Young.

Microsoft has tools that can help secure data, including its Purview Data Protection data governance tool and the ability to categorize data within SharePoint, said Young. 

The reality, however, is that most businesses have significant gaps in their data management strategies, according to Matt Radolec, vice president for incident response and cloud operations at data security software vendor Varonis. 

A 2022 report published by Varonis claimed that one in 10 files hosted in SaaS environments is accessible by all staff; an earlier 2019 report put that figure - including cloud and on-prem files and folders - at 22%. In many cases, this can mean organization-wide permissions are granted to thousands of sensitive files, Varonis said.

"You don't realize how much you have access to in the average company," said Radolec. "An assumption you could have is that people generally lock this stuff down: they do not. Things are generally open."

In Radolec's view, very few M365 customers have adequately addressed the risks around access to data within their organization at this stage.

"I think a lot of them are just planning to do the blocking and tackling after they get started," he said. "We'll see to what degree of effectiveness that is come November 1 [the M365 Copilot launch date]. We're right around the corner from seeing how well people will fare with it."

Trialling Copilot internally

With significant interest in the possibilities of genAI in the workplace, many M365 customers will, as Cain noted, be keen to try out the technology - even if it's not deployed fully across their organization.

This will generally mean testing it first with smaller numbers of employees to identify where Copilot will be most effective. 

French IT service provider Orange Business was one of hundreds of businesses that took part in a paid early access program (EAP) for Microsoft's Copilot in recent months. This would help both to build experience to advise its clients on how to implement Copilot, and, potentially, pave the way for a wider deployment across Orange Business' workforce and that of its parent company - telecom firm Orange.

With genAI largely untested in the workplace, the aim was to find out firsthand how staff wanted to use the Copilot, said Marie-Hel