Microsoft 365 Copilot, ready for GxP and client data.
Copilot shows each person only what they can already open. In a pharma, biotech or CRO tenant that has grown over years, that can include client compound data, unpublished study results and GxP documents shared far wider than anyone intended. We fix that before Copilot goes wider: sensitivity labels, data loss prevention, permission cleanup and GxP sites kept out of Copilot's reach, mostly with the Business Premium licenses you already have.
What goes wrong when Copilot arrives before the controls.
Oversharing becomes searchable
Old "Anyone" links, organization-wide access and forgotten Teams channels were a quiet problem. With Copilot, their content can turn up in an answer.
Client data has no label
Without a Client restricted label and rules behind it, nothing stops sponsor data being emailed out or pasted into a public AI tool.
GxP documents get re-versioned
A default label applied to a controlled document creates a new version. GxP locations need their own settings, agreed with quality.
Agents spread before anyone approves them
Staff can build and share agents that read whatever they can open. Without settings and an approval route, nobody knows which agents exist.
The controls a GxP tenant needs before Copilot goes wider.
Sensitivity labels
Public, Internal, Confidential and Client restricted, with a client sub-label only where a contract needs file-level separation. Labels work in Office on Windows, Mac and the web.
Data loss prevention
Client content goes only to approved client domains, and confidential content sent outside shows a warning. Rules run in test mode before they enforce.
Oversharing cleanup
Anyone links, organization-wide links and broad access removed from client, GxP, HR and finance sites and from OneDrive, with site owners confirming who should have access.
GxP and client sites out of Copilot search
Restricted Content Discovery keeps sensitive sites out of company-wide search and Copilot, and Restricted Access Control limits GxP sites to GxP staff. Changes to GxP locations go through your change control.
Agents and public AI tools
Agent use and company-wide sharing limited to approved people, named public AI sites blocked or warned on managed devices, and new tools routed through an approval form.
Audit and handover
Copilot activity searchable by named roles only, and a runbook your IT team can follow for new client sites, new joiners and new AI tool requests.
What Business Premium covers, and what an add-on changes.
Microsoft US list prices per user per month on an annual plan, from Microsoft's pages in October 2026. Your reseller sets the final price. We do not resell licenses.
| License | What it adds for Copilot readiness | US list price |
|---|---|---|
| Microsoft 365 Business Premium | Manual sensitivity labels with encryption, site labels, default and mandatory labeling, DLP for email, SharePoint and OneDrive, Intune, Defender for Business, audit for 180 days and Copilot Chat | $22 |
| Microsoft 365 Copilot Business | Copilot in Word, Excel, Outlook and Teams for up to 300 users; one Copilot license also turns on SharePoint Advanced Management features such as Restricted Content Discovery | $21 |
| Business Premium with Copilot | Business Premium and Copilot Business in one license | $32 |
| Purview suite for Business Premium | Auto-labeling, default labels on document libraries, a DLP rule that keeps labeled content out of Copilot, endpoint DLP and one year of audit | $10 |
| Defender suite for Business Premium | Finds AI tools in use that nobody has reported, and blocks them in one step | $10 |
Rolling Copilot out to German sites.
In Germany, Copilot and the controls around it can monitor staff, so a company with a works council needs its agreement first, and a DPIA is usually needed under GDPR. We prepare the DPIA with your data protection officer, the works council information pack and the technical annexes for the works agreement, and we set the Copilot options the DPIA decides, such as web search and Anthropic models for German users.
Whether Microsoft's EU Data Boundary applies depends on where your tenant is based, so we confirm that first and record it in the DPIA.
From discovery to a measured pilot.
- 01
Discovery
Two weeksA read-only review of your tenant, the oversharing baseline, where GxP and client data live, and a license recommendation. Ends with a fixed price for the rest.
- 02
Controls
About seven weeksLabels, DLP, oversharing fixes, Copilot and agent settings, audit, and a handover to your IT team, each change approved first.
- 03
Pilot
Four weeksCopilot for 20 to 30 people, measured against how long a few of their own tasks take today, then a costed rollout plan.
Sources for the Microsoft facts on this page.
Checked in October 2026. Microsoft changes features and prices often, so confirm with your reseller.
- Microsoft Learn, Microsoft Purview service description (updated August 21, 2026)
- Microsoft, Microsoft 365 Copilot business pricing
- Microsoft, Purview Suite for Microsoft 365 Business Premium
- Microsoft, Defender Suite for Microsoft 365 Business Premium
- Microsoft Learn, SharePoint Advanced Management features in Microsoft Copilot licenses (June 30, 2026)
- Microsoft Learn, Restrict discovery of SharePoint sites and content (October 11, 2026)
- Microsoft Learn, Purview DLP for Microsoft 365 Copilot (October 5, 2026)
- Microsoft Learn, Agent settings in the Microsoft 365 admin center (September 30, 2026)
- Microsoft Learn, Data, privacy and security for Microsoft 365 Copilot (October 8, 2026)
What you have at the end.
A label scheme in use
Including a Client restricted tier and settings agreed with quality for GxP locations.
DLP that lets results reach clients
Client content goes to that client's domains and nowhere else.
Clean permissions
No organization-wide access on client, GxP, HR or finance sites.
Copilot settings decided
Agents, web search and pay-as-you-go billing set on purpose.
About 30 acceptance tests
Run in your tenant and signed by your IT lead.
A costed rollout plan
Waves, license costs and go or no-go criteria from the pilot.
From workflow to working tool in two weeks.
Scope and sign
We define the workflow, the deliverables, and the acceptance criteria, and sign an agreement on them before anything starts.
Build
We build the tool in your environment, with Claude Code and automated evaluation against your own data.
Pay when it works
$10,000, due only after every criterion in the signed agreement is met. Nothing before that.
We start with a two-week discovery and then give you a fixed price for the controls and the pilot. Each phase is paid only after it passes acceptance tests you sign. Microsoft licenses are bought through your reseller.
Tell us the workflow →Questions buyers ask.
Do we need Microsoft 365 E5 to get Copilot ready?
No. Business Premium covers manual labels, encryption, site labels and DLP for email and files. The Purview suite for Business Premium adds auto-labeling and a cleaner way to keep labeled content out of Copilot, at $10 per user per month at US list price.
Does Copilot see data a user cannot open?
No. Copilot only uses content the signed-in person already has permission to open. The risk is content that is shared far wider than it should be, which is why permission cleanup comes before a wider rollout.
How do we keep GxP documents away from Copilot?
Keep GxP sites out of company-wide search with Restricted Content Discovery, limit them to GxP staff with Restricted Access Control, and write the boundary into your AI policy. Any change to settings on GxP locations should go through your change control.
What does Microsoft 365 Copilot cost for a business?
At Microsoft US list prices in October 2026, Copilot Business is $21 per user per month for up to 300 users, and Business Premium with Copilot is $32, replacing Business Premium at $22. Your reseller sets the final price.
Can we block ChatGPT and other public AI tools?
Yes. On managed Windows and Mac devices, named AI sites can be blocked or warned on with Defender for Business. Finding AI tools nobody has reported needs the Defender suite for Business Premium.
Is Copilot allowed in Germany?
Yes, with the right steps. Plan for a DPIA with your data protection officer, and at a company with a works council, a works agreement before Copilot and the related controls go live there.
Ready to ship AI that actually works?
Send us the workflow. We return a fixed scope, price, and acceptance criteria in 48 hours. You pay $10,000 only after it works.
Tell us the workflow →Past the stall: Why M365 Copilot rollouts plateau and the governed path through
Why Copilot pilots stall, and the governed path from pilot to measured adoption.
Read it free →