Copilot Governance on Business Premium vs E5: Which Controls You Get

The license question, control by control

Buyers ask some version of "do we need E5 for Copilot, or is Business Premium enough?" in Microsoft's Q&A forum and on Tech Community. The answer depends on which controls your compliance lead will want in place before Microsoft Copilot (formerly Microsoft 365 Copilot) reaches the whole company, so this post goes control by control. Business Premium is sold for organizations with up to 300 users, and Microsoft's license options page sets the same limit for Copilot Business, so above that size the comparison is E3 against E5.

Microsoft's list prices and a worked 200-user example are in our earlier post on Copilot on Business Premium and what it costs. This one covers the controls, read from Microsoft's documentation in October 2026. The agent controls that sit on top of these licenses are in the paper Copilot after rollout.

The table draws on Microsoft's Purview service description, its page on SharePoint Advanced Management in Copilot licenses and the Agent 365 service description, and rows marked "confirm" are ones those pages do not settle.

What Business Premium already does

Business Premium covers a careful pilot. Its DLP reaches files shared in Teams because they are stored in SharePoint and OneDrive, and Audit (Standard) includes Copilot interactions once Copilot is licensed and in use, per Microsoft's Copilot audit documentation. For a company under 300 users that has cleaned up its permissions, that is enough to start. The gaps show up at company-wide scale. Labels depend on people and defaults, and DLP does not reach Teams chat or devices. The rule that keeps labeled files out of Copilot answers, which compliance leads ask us about first, is missing too.

Keeping labeled content out of Copilot

Microsoft's mechanism is a DLP policy on the location named "Microsoft 365 Copilot and Copilot Chat" that uses sensitivity-label conditions, set out in its DLP for Copilot documentation. A label alone does not stop Copilot. The policy needs E5-level rights, which come with Microsoft 365 E5, the Purview Suite (formerly E5 Compliance) or the Purview Suite for Business Premium. Matching files can still be listed as citations, but their content is left out of the answer. Test it in your own tenant first, because Microsoft's licensing pages do not always agree on suite names.

Two related controls need no upgrade. DLP for prompts that contain sensitive information, such as card numbers, is available to all Copilot and Copilot Chat users, though blocking those prompts is still in preview at the time of writing, and blocking web search for them is available now. On any plan, encryption is the hard backstop: Copilot needs both the view right and the extract right (permission to take content out of the file) to use an encrypted file, per Microsoft's Purview guidance for AI, so a label that withholds extract keeps that file out, at the cost of stopping those users from copying from it.

Oversharing tools arrive with the Copilot license

Microsoft Learn says one Copilot license in the tenant brings the SharePoint Advanced Management features for a Copilot deployment. They include Restricted Content Discovery, which hides named sites from company-wide search and Copilot without changing permissions, along with Restricted Access Control, site access reviews and the data access governance reports. Restricted site creation by apps still needs SharePoint Advanced Management Plan 1, and the report built on sensitivity labels needs E5. The page does not name Copilot Business, so confirm in your admin center if that is your license.

These SharePoint tools switch on for the whole tenant with one Copilot license, but Purview features are licensed per person. Microsoft's Purview service description expects the users who benefit from a Purview service to be licensed for it, with rules that vary by feature. Automatic labeling or the Copilot exclusion across the company therefore means licensing most of the company, and the license plan should count those seats before the CFO signs.

Audit, retention and eDiscovery

Every Copilot interaction is logged as a CopilotInteraction record that names the agent used and the resources it read, with their label IDs, according to Microsoft's audit documentation. The record holds message IDs, not the prompt text. Business Premium keeps it for 180 days. Audit (Premium), with E5 or the Purview Suite for Business Premium, allows up to a year, but its default one-year policy covers Exchange, SharePoint, OneDrive and Entra records, so Copilot records need a custom audit retention policy, and records of users without the upgrade stay at 180 days, per Microsoft's audit retention page. Our guide to AI agent audit trails covers what to keep and for how long.

Retention and eDiscovery, the search and preservation of electronic evidence for legal matters, are where the licensing pages are least clear. Retention policies for Copilot interactions are licensed to E3 or E5 with Copilot, and Business Premium is not named. Content search, legal hold and export of Copilot interactions come with E3 plus Copilot, while premium eDiscovery needs E5 or the Purview Suite with Copilot. If legal holds matter to you, get the answer for your plan in writing from Microsoft or your reseller before you buy.

Agents and shadow AI

The agent inventory in the Microsoft 365 admin center, with blocking, deletion, approval and owner reassignment, is included in every Microsoft 365 plan, according to the Agent 365 service description. Monitoring of what agents do, Conditional Access for agents (rules on when an agent may sign in to company systems) and Purview audit and DLP for agents need Microsoft Agent 365, a separate per-user license that has been generally available since 1 May 2026. It needs a qualifying base license, which Microsoft's Agent 365 licensing FAQ gives as E5, or for smaller companies Business Premium with the Defender and Purview suites. Agent 365 is also included in Microsoft 365 E7, and your reseller can confirm eligibility.

Defender for Cloud Apps finds the AI apps people use outside Microsoft and lets admins mark unsanctioned ones for blocking, but Business Premium alone does not include it. The Defender Suite for Business Premium is one route, per Microsoft's Defender service description.

When the Purview Suite for Business Premium is enough

For a company under 300 users, the Purview Suite for Business Premium closes most of the gap. It adds automatic labeling and the DLP rule that keeps labeled files out of Copilot, and it allows audit retention of up to a year. On E3 the choice is between E5 and the Purview Suite on top of E3, both listed in Microsoft's Purview licensing guidance. The suites are tied to their base plans, so do not assume the enterprise add-on fits Business Premium. For life-sciences companies, our page on Copilot readiness for GxP teams maps the same licenses to regulated content.

E5 does not fix oversharing

There is a case against leading with the license comparison at all. Moving to E5 buys better detection and longer records, but it removes no company-wide grant on a payroll site. The permission cleanup and Restricted Content Discovery work the same on every plan, and they come with the Copilot license. A company that buys E5 first and fixes permissions later has paid for controls that sit on top of the problem.

Our order runs the other way. Fix access first, run the pilot on Business Premium or E3 with encryption on the few files that must not leak, and buy the upgrade once the rollout plan shows which controls the full rollout needs. A company whose client contracts or auditors demand the Copilot exclusion needs E5-level rights from the first day, and for it the decision is quick.

Where QueryNow fits

QueryNow sets up these controls on the plan you already have, as the data part of our Copilot AI Foundation service, and tells the decision group which upgrade the full rollout needs before anyone buys it. The license plan we hand over maps each control to the license it needs, and IT also gets the test that shows each one works. We are a Microsoft Solutions Partner, and the controls stay with your IT team.