Microsoft Copilot for Nonprofits: 2026

This guide covers Microsoft Copilot for organizations already on M365 that want to maximize their existing investment. If your organization is considering a local AI approach where model costs and data access stay under your control, visit our Sovereign Stack guide first.

Microsoft quietly changed how Copilot works inside your M365 apps — this is the briefing you probably didn't get. It's written for nonprofit leaders and operations staff, not IT departments — though the IT section is in here too, because some of it will land on your plate either way.

The short version: Copilot is evolving from a chat assistant sitting in a sidebar into an AI agent woven through the apps your organization already uses. Some of it is already live in your tenant for free. Some of it costs real money. And one aspect of it — the part about permissions — is something many organizations aren't thinking about yet but should be.

From Chat Sidebar to Embedded Agent

The original Microsoft 365 Copilot was reactive. You opened a side panel, typed a prompt, got a response. It was useful — roughly the experience of having a capable intern who had read every document you shared with them — but it was fundamentally a question-and-answer tool. You initiated every interaction.

The 2026 update changes the posture. Copilot now surfaces proactively inside applications — suggesting a summary when you open an email thread in Outlook, offering to reformat a table while you're working in Excel, proposing talking points as you build a PowerPoint deck. The sidebar is still there, but the assistant increasingly meets you in context rather than waiting to be summoned.

More significantly, Copilot has gained what Microsoft calls "agentic" capabilities. The old version handled one-off tasks. The new version — through a feature called Copilot Cowork — can execute multi-step workflows: plan a meeting, draft the agenda document, send the calendar invite, and follow up with a summary, all from a single conversational request spanning Teams, Outlook, and Word. It coordinates across applications rather than operating inside one at a time.

Behind the scenes, Microsoft has also made Copilot "model-diverse." Instead of routing every query through a single AI model, it now draws on multiple models — including OpenAI's GPT-5.5 and Anthropic's Claude — selecting the best fit for the type of task. A Critique feature in the Copilot Researcher agent uses one model to draft an answer and a second model to review it for accuracy before it reaches you. For nonprofits doing complex research, grant writing, or policy analysis, this double-check layer matters.

A new intelligence layer called Work IQ gives Copilot awareness of your organization's recent work context — your recent emails, ongoing projects, meeting history — so its answers are grounded in what your organization is actually doing, not just the document you happen to have open.

Two Tiers — One of Which Is Probably Already in Your Tenant

Here is the thing most nonprofit staff don't know yet: if your organization has any Microsoft 365 or Office 365 subscription, you likely already have access to Copilot Chat (Basic). It turned on by default for most tenants. No extra license required.

What Copilot Chat Basic can do:

Web-grounded AI chat — answer general questions using Bing/browser data
Light Outlook integration — query your inbox and calendar, get email summaries
Basic content creation through chat — draft documents, emails, and presentations via the Copilot Chat interface (without in-app editing agents)
Secure AI chat — no data leakage to public AI services; queries stay within Microsoft's compliance boundary

What it cannot do: deeply integrate with documents you're actively editing, access your SharePoint and OneDrive files as a knowledge base, execute agentic multi-step tasks, or use the in-app agents inside Word, Excel, and PowerPoint.

That fuller experience — the one with document grounding, file-aware assistance, and Copilot Cowork — is M365 Copilot (Premium), a paid add-on license.

Tier	Cost	What you get
Copilot Chat (Basic)	Included with existing M365/O365 subscription	Web-grounded AI chat, Outlook & calendar queries, basic content drafting via chat, no in-app agents
M365 Copilot (Premium)	~$30/user/month (enterprise); ~$18–21/user/month (SMB "Copilot Business" add-on)	In-app agents for Word, Excel, PowerPoint, Teams, Outlook; SharePoint/OneDrive document grounding; Copilot Cowork multi-step tasks; full Work IQ context

A note on nonprofit licensing: If your organization receives donated or discounted Microsoft 365 licenses through the Microsoft for Nonprofits program, the Copilot add-on is a separate purchase on top of that base subscription. The nonprofit pricing program does not currently extend to the Copilot add-on. Verify your eligibility and current pricing with your Microsoft account representative or licensing partner before budgeting.

The cost math at nonprofit scale is real. A 20-person organization at $30/user/month is $7,200 per year. A 50-person organization crosses $18,000. Even the SMB pricing at $21/user/month runs $12,600 for 50 users. That is a board conversation, not an IT decision. The question worth asking before that conversation: which roles in your organization stand to benefit most? Start there, not with an org-wide rollout.

Your Data Stays Yours — and a Catch

The data privacy question is the first thing most nonprofit leaders ask when AI comes up, and on this front the 2026 Copilot rollout has genuinely good news. Microsoft built this version of Copilot with what it calls a "trust by design" approach:

No customer data is used to train the AI models. Your prompts, your documents, your responses — none of it feeds back into Microsoft's model training.
Data stays in your tenant's compliance boundary and geographic region. Processing happens in Microsoft's cloud, but it is routed to datacenters matching your tenant's geo. Your European beneficiary data doesn't get processed in the US.
Existing sensitivity labels are honored. If you've marked a document as "Highly Confidential" or set a "do not allow AI" sensitivity label in Microsoft Purview, Copilot will not surface or use that content in its answers.
Existing compliance policies apply. DLP rules, eDiscovery holds, retention policies — the governance your organization already has in place extends to Copilot inputs and outputs.

For nonprofits managing beneficiary records, donor data, or anything touching healthcare, this is meaningful. It means Copilot is not a "new AI vendor" in the compliance sense — it processes data within the same Microsoft tenant boundary you already rely on, under the same data processing agreements. That eliminates the vendor-relationship and Business Associate Agreement (BAA) questions that typically arise when introducing a new AI tool.

The catch — and it's an important one.

Copilot respects your existing permissions exactly as they are. If a staff member has access to a SharePoint library, Copilot will help that staff member find and use content from that library. This sounds correct — and it is — but it creates a problem if your permissions are broader than they should be.

Many organizations have SharePoint sites where most staff have read access to most things, because nobody got around to tightening it up. That arrangement is functionally fine in a world where people navigate SharePoint by clicking through folders. It becomes a different situation when an AI assistant can instantly surface any document a user is technically permitted to see, from any corner of your file structure, in response to a conversational question.

Copilot is a force multiplier for whatever permissions you have in place. Tighten them before you expand Copilot access, not after.

The Audit Limitation Worth Knowing

Microsoft does log Copilot activity — the M365 Admin Center records that Copilot was invoked, which user invoked it, and what types of data sources it accessed. What the logs do not yet capture is the full prompt text and the exact content passages Copilot drew on to produce each response. Microsoft has acknowledged this limitation and signaled that more granular auditing is on the roadmap.

For most nonprofits, this level of logging is adequate. For organizations subject to strict documentation requirements — healthcare nonprofits operating under HIPAA, legal aid organizations, any entity facing formal audit — the current state means Copilot outputs are harder to trace than outputs from more controlled internal systems. This is worth understanding before deploying Copilot in workflows that may need to demonstrate exactly what information was used in a decision.

If this concerns you, the Audit Trail post in our AI & Your Organization series covers this problem in depth — including why cloud-based AI tools have inherent traceability limits, and what organizations have done about it.

What to Do Now

You don't need to make a big decision immediately. Here's a practical sequence:

Find out what your team is already using. Copilot Chat Basic is likely already on in your tenant. Ask a few staff members — especially in program delivery, development, and communications — whether they've noticed Copilot prompts appearing in their M365 apps. Chances are some have been experimenting with it already, informally and undocumented.
Audit SharePoint permissions before going further. Before enabling broader Copilot features, spend an hour with whoever manages your SharePoint or OneDrive setup and ask: is access scoped appropriately by role? Could a general staff member inadvertently surface HR files, board documents, or restricted beneficiary records through Copilot? If the answer is uncertain, this is the moment to fix it.
Check your sensitivity labels. If your organization uses Microsoft Purview sensitivity labels, review whether any label categories should be configured to exclude content from Copilot. Microsoft has introduced a specific "Copilot-prohibited" label option. For data you'd never want AI-surfaced — regardless of who has permission — this is worth setting up before a broad rollout.
Start with a pilot for Premium features. If the Premium experience looks worth evaluating, license it for a small cohort of users in roles where it would have clear impact. Program staff who write narrative reports, development staff who draft grant proposals, or executive leadership who need meeting summaries are common high-value starting points. Measure before scaling.
Brief your board on the data handling story. If board members are asking "where does our data go when we use AI?" — and some are — the answer for M365 Copilot is more reassuring than for standalone AI tools. It's worth being able to give that answer clearly, and worth documenting your organization's decision about AI tool use before someone asks you to reconstruct it later.

The Bigger Picture

Microsoft is making a significant bet with this rollout. The company is signaling that M365 is becoming an AI-powered platform first and a productivity suite second — that Copilot is no longer a feature you add on, but the direction the product is moving. Future releases will almost certainly deepen this integration further, and industry-specific Copilot variants (education, healthcare, government) are already in development.

For nonprofits, this isn't a reason to panic or to rush. Most organizations using M365 today can continue using it exactly as they do, and the new AI features will remain available to adopt at whatever pace makes sense. The free Copilot Chat tier already offers genuine utility without requiring any licensing decision. The Premium tier requires a deliberate cost-benefit evaluation that should be grounded in specific workflows, not hype.

The organizations that will benefit most from this rollout are the ones that go in with their permissions in order, their sensitive data properly labeled, and a clear sense of which staff roles have the most to gain. That preparation is good practice regardless of Copilot — it just becomes more urgent when an AI assistant is ready to surface whatever it can find.