The first question we get about Copilot is almost always about speed. How fast can we buy and deploy 500 licences across the team. How much time will this save per employee, and when do we see the return. Can you run a session showing everyone how to write prompts.
They are fair questions. In our experience they are also the wrong ones to open with. Copilot ROI is decided well before any of them get answered, and the distance between what CIOs ask for and what they actually need is where most programmes quietly stall.
The numbers bear that out. Roughly 74% of companies cannot demonstrate measurable AI ROI, while vendor-commissioned modelling points to returns as high as 116%. Both are true at once. Copilot ROI is not decided by the technology. It is decided by what the organisation did, or did not do, before the seats were switched on.
What CIOs ask for, and what they actually need
| Asked for | Actually needed |
| Speed to rollout and licences | Permission cleanup and data governance |
| Time saved per employee, and when | Information architecture and data hygiene |
| A prompt-writing training session | Targeted, persona-driven use cases |
| Structured change management |
Each row is a substitution, not an addition.
Copilot respects existing permissions. If HR reviews, salary sheets or acquisition drafts were ever shared broadly in SharePoint, Copilot will surface them in search recaps and prompt responses on day one.
Copilot relies on context. Where SharePoint is cluttered with duplicate, outdated or poorly titled files, it will generate inaccurate or conflicting answers quickly, and confidently.
Licences without workflow targets become shelfware. What works is naming specific, persona-driven scenarios: automated meeting recaps in Teams, client proposal drafting in Word.
Habit formation takes weeks of contextual guidance and clear guardrails, not a one-hour prompt engineering webinar.
The adoption numbers that belong in your business case
Three figures reframe the conversation:
- 3.3% of Microsoft 365 users have adopted the paid Copilot add-on
- 35.8% workplace adoption, meaning fewer than four in ten employees with a licence actually use it
- 44.2% of lapsed users stopped because they did not trust the answers
That last number matters most. Copilot’s accuracy Net Promoter Score was -3.5 in July 2025, fell to -24.1 by September 2025, and had only partially recovered to -19.8 by January 2026. A persistently negative score means users who try it are more likely to distrust it than recommend it.
You cannot buy your way past that with more licences.
The maths that decides whether Copilot pays
Most business cases assume every seat gets used. They do not.
Buy 1,000 seats at $30 per user per month and you have committed $360,000 a year. If only 550 people engage regularly, your effective cost per active user doubles to roughly $55 a month.
At that rate, each active user needs to save around 45 minutes a week at a $75 loaded hourly cost simply to break even. Telemetry suggests 7 to 10 minutes saved per meaningful interaction, so break-even requires five to six real interactions per user per week, every week.
That is an adoption and workflow problem, not a licensing one. Which is why the fix never starts with procurement.
What the organisations getting returns fixed first
Across the deployments that do produce measurable value, three things were addressed before rollout.
They fixed the data before buying seats
Data governance is the most-cited barrier to enterprise Copilot adoption, and for a specific reason: Copilot answers from whatever your tenant exposes. If permissions are loose, content is duplicated, or ownership is unclear, Copilot will confidently surface the wrong version of the truth. Users notice once, and stop trusting it permanently.
The single most common finding in the tenant assessments we run before a rollout is over-permissioning, and it is worth being precise about why it has gone unnoticed. Before Copilot, most organisations were relying on security by obscurity. A sensitive file buried four subfolders deep was effectively hidden, because nobody was going to manually search for it. Copilot removes that protection in an afternoon.
Three findings come up again and again:
- “Everyone” access on sensitive SharePoint sites. Entire libraries of confidential HR, finance or legal material left at default read or write access for all internal users.
- Broken permission inheritance. Individual folders and files given direct links with broad access, accumulated over years of ad-hoc sharing.
- Unlabelled sensitive content. Microsoft Purview sensitivity labels and DLP rules either absent or applied inconsistently, so nothing automatically blocks or restricts exposure.
Governance work with Microsoft Purview, sensitivity labelling and access hygiene is unglamorous. It is also the single highest-leverage thing you can do, and it has to happen before the seats are switched on, not after the first incident.
None of this needs to be a long programme. A tenant assessment that answers those three questions takes days rather than weeks: run a sharing and permissions report across your highest-traffic SharePoint sites, list every library still open to the whole organisation, and check whether sensitivity labels have been deployed at all or only in pockets. The output is a remediation list you can work through in priority order, and it is the same list that decides whether your first Copilot cohort has a good experience or a memorable one.
The sequencing matters more than the effort. Remediating oversharing after a rollout means doing the same work under pressure, with users who have already seen something they should not have, and with a programme that has spent the goodwill it needed to change how people work.
They funded change management, not just licences
Insufficient change management budget is the second barrier. Copilot changes how people work, and nobody adopts a new way of working from a launch email. The organisations that succeed budget for enablement as a real line item, not a rounding error against the licence spend.
They named champions in each business unit
The third barrier is the absence of internal AI champions who can show non-technical colleagues what good looks like in their workflow. Finance does not learn from a generic demo. Finance learns from someone in finance.
A five-minute readiness test
Before you expand your Copilot estate, answer these honestly:
- Do you know which sensitive data Copilot can currently surface to which users?
- Has anyone audited permissions and oversharing in SharePoint and OneDrive in the last twelve months?
- Do you have named champions per function, or one central IT owner?
- Is there a change-management budget separate from the licence budget?
- Can you name the specific workflows you expect Copilot to shorten, and measure them?
Two or more “no” answers means additional seats will most likely join the 64% that go unused.
Where to start
Start with an honest assessment of your data estate and permission model, not a bigger pilot. Fix what Copilot will read before you widen who can ask it questions. The organisations seeing returns treated Copilot as a data-readiness programme with an AI interface attached, which is precisely what it is.
We would not recommend buying a single additional seat before a permissions audit has been run and acted on. A licence order placed ahead of that work is not an investment in productivity, it is shelfware with a subscription attached, and the first time Copilot surfaces a salary sheet to the wrong person the programme loses the goodwill it needed to succeed. The prompt-writing session can wait. The permissions cannot.
Veratas runs Copilot readiness and AI enablement programmes and the data consulting work that has to come first.
If you cannot yet answer what your Copilot licences returned, talk to our team. We will help you find out, and fix what is blocking it.
Frequently asked questions
Why can most companies not measure Copilot ROI?
Because they measure licences purchased rather than workflows shortened. Without a baseline for the tasks Copilot is meant to accelerate, there is nothing to compare against afterwards.
What is a realistic Microsoft 365 Copilot adoption rate?
Around 35.8% of licensed users actively use it. Planning on 100% utilisation will overstate your business case by roughly a factor of three.
Does Copilot need data governance first?
Yes. Copilot inherits your existing permissions. Poor access hygiene means it surfaces content users should not see, which is both a compliance risk and the fastest route to losing user trust.
How long before Copilot shows value?
For organisations that address governance, enablement and champions up front, meaningful workflow gains typically appear within one to two quarters. Without those foundations, they often never appear at all.
What does a Copilot readiness assessment actually check?
At minimum: which sensitive data Copilot can currently surface and to whom, whether permission inheritance is still intact across your main SharePoint sites, whether sensitivity labels and DLP rules are deployed consistently rather than in pockets, and whether you have named the specific workflows Copilot is meant to shorten.
Is Copilot ROI better with a smaller pilot?
Not automatically. Small pilots often lack the workflow density to produce measurable savings, and they rarely surface the governance problems that appear at scale.
Senior Business Intelligence Architect with 22 years of experience designing enterprise analytics and data platforms. Focus areas include Power BI, real-time analytics, and large-scale BI architecture across the Microsoft data stack.