Copilot in SharePoint begins its general availability rollout on 30 September 2026. For a cloud-only organisation, that may look like another Microsoft 365 feature becoming available. For a hybrid organisation, the decision is more complicated.[1]
Copilot does not move into an on-premises SharePoint farm. The SharePoint Online capability and the connection to SharePoint Server are two different parts of the architecture. Teams need to understand that boundary before they discuss licensing, security or rollout.
What is becoming generally available
Copilot in SharePoint lets licensed users work with SharePoint content through natural-language requests. Microsoft says everyday capabilities remain included with a Microsoft 365 Copilot licence. More advanced work, including larger-scale and multi-step operations, uses Copilot Credits through usage-based billing.[1]
The rollout also changes administration. PowerShell controls used during preview are being retired. Existing settings are honoured until 1 November 2026, which gives administrators a short transition window rather than a reason to enable the feature everywhere immediately.
General availability means Microsoft considers the service ready for supported use. It does not mean every tenant receives every capability on the first day, and it does not mean an organisation is operationally ready.
What this means for an on-premises farm
An on-premises farm does not gain a local Copilot service. Microsoft provides a SharePoint Server connector that indexes supported farm content into Microsoft 365 so that it can become discoverable through Copilot experiences.[2]
That distinction matters. The source content remains in SharePoint Server, but selected documents and site pages are indexed through a cloud service. Deployment requires the Microsoft Graph connector agent, Microsoft 365 administration and configuration on the SharePoint Server side.[3]
This is not a feature switch. It is an integration project.
The permission decision is more important than the licence
The connector offers two access modes. The recommended mode shows indexed content only to people who already have access in SharePoint. This requires local Active Directory identities to be mapped correctly to Microsoft Entra ID.
The other mode makes indexed content visible to everyone in the organisation. That choice is easy to configure and difficult to justify for most production farms.
Microsoft also documents an important limitation. SharePoint Server does not support distribution lists as access control lists in this connector model. Nested distribution lists can therefore create unintended exposure. A permission model that looks acceptable inside the farm may not behave the same way after content is indexed.[3]
The readiness question is not simply, “Do we own Copilot licences?” It is, “Can we prove that indexed content will follow the access boundaries we intend?”
What Microsoft says about data use
Microsoft states that prompts, responses and organisational data accessed through Microsoft Graph are not used to train the foundation models behind Microsoft Copilot. It also says Copilot surfaces organisational content according to the user’s existing permissions.[4]
That addresses one common concern, but it does not finish the compliance review. Copilot interaction data is stored as part of the user’s activity history. Administrators still need to consider retention, eDiscovery, Purview controls, regional processing requirements and any additional terms that apply when optional agents or third-party models are enabled.
The responsible question is not only whether Microsoft trains a model with the content. It is also where content is indexed, which identities can retrieve it, what interactions are retained and how administrators can investigate misuse.
A practical rollout decision
| Readiness question | Pilot is reasonable when | Pause when |
|---|---|---|
| Content scope | A small set of useful sites is identified | The team cannot define which content should be indexed |
| Identity | Active Directory and Entra ID identities map reliably | Orphaned, duplicated or mismatched identities remain |
| Permissions | Access has been reviewed and tested with real role patterns | Broad groups and nested distribution lists are not understood |
| Licensing and cost | Licensed users and credit-backed advanced work are budgeted separately | The business assumes every capability is included |
| Compliance | Retention, audit, eDiscovery and regional requirements are documented | Compliance review begins only after content is indexed |
| Operations | Connector health, failed crawls and access incidents have owners | No team owns the connector after deployment |
For most hybrid organisations, a controlled pilot is more sensible than an organisation-wide rollout. Select content that is useful but not highly sensitive. Test with users who have different permission levels. Include a user who should not see the indexed material. That negative test often reveals more than a successful Copilot demonstration.
What hybrid teams should do now
Start with three inventories: content, identity and authority.
- Identify the sites and document libraries that would create real user value.
- Review how farm identities and groups map to Entra ID.
- Decide who can approve a connector, change its scope and investigate an exposure.
- Separate Microsoft 365 Copilot licence costs from usage-based Copilot Credits.
- Define what evidence a pilot must produce before expansion.
The arrival of general availability creates a decision point, not a deadline to enable the feature. Hybrid teams gain the most when they treat Copilot as a new path to existing information. That path should not open wider than the permissions, content quality and governance behind it.
Architecture: Where hybrid SharePoint content travels
References and further reading
1. Get started with Copilot in SharePoint, Microsoft Learn. GA timing, licensing, controls and Copilot Credits. Reviewed 28 September 2026. ↩
2. Deploy the SharePoint Server connector, Microsoft Learn. Connector roles, prerequisites and deployment. Reviewed 28 September 2026. ↩
3. SharePoint Server connector overview, Microsoft Learn. Indexed content, access modes and limitations. Reviewed 28 September 2026. ↩
4. Data, privacy and security for Microsoft Copilot, Microsoft Learn. Organisational data, model training, interaction storage and compliance controls. Reviewed 28 September 2026. ↩