Microsoft 365 Copilot or a custom assistant: how a small firm should decide
Copilot helps each person with their own work; a custom assistant does one job for the business. How to tell which you need, and what to check first.
Small firms on Microsoft 365 often ask whether they should buy Copilot or have something built. The question treats them as two versions of the same thing. They do different jobs, and plenty of businesses end up using both. The useful question is which problem you have.
What Copilot reads
Microsoft 365 Copilot is licensed per person. It sits inside Outlook, Word, Excel, PowerPoint and Teams, and it answers using the mail, files, chats and meetings that the signed-in person already has permission to open. Microsoft is clear that it works within each user's existing access, so it can't show someone a file they couldn't open themselves.
That sounds reassuring, and it is. It also means Copilot is only as tidy as your sharing settings. In most small firms, permissions have grown by accident. There's a folder shared with everyone for one project, a salary spreadsheet sitting in a team site, a link set to "anyone in the organisation" years ago. Nobody found those files because nobody went looking. An assistant that searches everything a person can open will find them for anyone who asks the right question.
Jobs that suit an assistant for each person
Copilot earns its licence when the time is spread across many people doing their own writing and reading. Think of drafting replies, summarising a long email thread before a call, writing up a Teams meeting, or pulling a first draft of a proposal from last year's. Each person saves a little time many times a week.
The value depends on use. A licence for someone who writes two emails a day buys very little. A licence for a manager who lives in meetings and long threads may pay for itself quickly. Because it's per person, you can start with the heaviest users and widen it once you've seen what they actually do with it.
Jobs that suit a built workflow
A custom assistant, or a plainer automation, is the right tool when one job repeats and follows rules. It starts because something arrived (an email, a form, an invoice), not because a person opened an app. It does the same steps every time, it can write to other systems such as your accounts package or your CRM, and it keeps a record of what it did.
Take a ten-person accountancy practice as an illustration. Clients email documents to a shared mailbox, and someone files each one to the right client folder and ticks it off a checklist. Copilot could help that person write the follow-up email faster. A built workflow would read each attachment as it arrives, file it, update the checklist and send the reminder for whatever is still missing, without anyone opening the mailbox. A person still checks the exceptions it can't place.
How the two compare
| Microsoft 365 Copilot | A built assistant or workflow | |
|---|---|---|
| Who starts it | A person, inside an Office app | An event, such as an email or a form arriving |
| What it reads | Whatever that person can open | Only the sources it was built to use |
| Does it act the same way every time | No, it follows each person's prompt | Yes, the steps are fixed and tested |
| Record of what it did | Each person's own history | A log of every run, kept for the business |
| How it's paid for | A licence per person per month (check current pricing with Microsoft or your reseller) | A build cost, then running costs that rise with use |
| Who looks after it | Microsoft, plus your own sharing settings | Whoever built it, then whoever takes it over |
Microsoft also sells tools for building agents and flows on top of Microsoft 365, such as Copilot Studio and Power Automate. Those sit in the right-hand column. They're built workflows, and they need the same design decisions about approvals, logs and ownership as anything else built for you.
Check the sharing before either
Whichever way you go, spend an afternoon on permissions first.
- List the folders and sites that hold sensitive material: payroll, HR files, client contracts, board papers.
- Check who can open each one. Look especially for links shared with the whole organisation or with anyone who has the link.
- Tighten anything broader than it needs to be, and move sensitive files out of general team sites.
- Ask one ordinary member of staff to search for something they shouldn't see, such as a salary or a disciplinary note. If they find it, an assistant will too.
Microsoft publishes guidance on finding and fixing oversharing before a Copilot rollout, and your IT provider can run the reports. This step also protects you if you never buy Copilot at all.
How to decide
Three questions settle most cases.
- Is the work started by a person, or by something arriving? People suggest Copilot. Arrivals suggest a workflow.
- Does it have to be done the same way every time, with a record? If so, build it.
- Is the time spread thinly across many people, or concentrated in one job? Spread time suits a licence per person. Concentrated time suits a workflow aimed at that job.
If you don't yet know where the time goes, measure it first. A one-week time audit will tell you whether your hours are in everyone's writing or in one repeated job, and that answer points to the tool.
Questions people ask
Can Copilot see files I can't open?
No. Microsoft 365 Copilot works within the signed-in person's existing permissions. The risk is the files people can open but shouldn't, which is why a sharing review comes first.
Can Copilot run a process on its own?
Copilot inside Word, Outlook and Teams helps a person who asks it something. To have work happen when an email or form arrives, you need an agent or flow built for that job. That might be built in Copilot Studio or Power Automate, or as a custom workflow. That is a build project with its own design and testing.
Is a custom assistant safer than Copilot?
It depends on where it's built. One built inside your own Microsoft 365 tenant uses your sign-in, your permissions and your audit logs, and reads only what it was built to read. One built on someone else's platform depends on that supplier's terms and controls, so ask where the data goes before you sign.
Should a small firm buy Copilot for everyone?
Usually not at first. Start with the few people who write and summarise the most, ask them after a month what they use it for, and decide from that. The licence is per person, so it's easy to widen once you know it earns its keep.