Two in three Copilot licences sit unused

Microsoft 365 Copilot Business lists at about AU $31.40 per user per month ex GST in Australia. Buying it is a five-minute decision. Getting people to use it is the part nobody budgets for, and the numbers on that are not flattering.

That figure holds up across the wider 2026 survey work, which puts median active use among licensed users in the mid-30 percent range. First-year figures below 40 % are normal before anyone intervenes deliberately. This is not a Microsoft problem or a product problem. It is what happens when a licence is treated as the rollout.

Smaller firms are further behind, not further ahead

The intuition is that a small business should adopt faster: fewer people, less politics, no change board. The data says the opposite.

Large firms are not better at this because they are clever. They are better at it because somebody's job is to run the rollout: pick the use cases, fix the permissions, train the people, report the numbers. In a 40-person firm nobody owns that, so the licence lands in everyone's toolbar and the toolbar is where it stays.

What the idle two-thirds actually costs

The arithmetic is unpleasant and worth doing before renewal.

Six thousand dollars a year is roughly a fixed-scope engagement to fix the thing. That is the arbitrage most firms miss: the cost of doing adoption properly is usually less than the cost of not doing it, and it is already being spent.

The blocker is rarely training

When a rollout stalls, the reflex is to book another training session. Sometimes that is right. More often, three other things are in the way.

Permissions, first and worst. Copilot surfaces whatever a person can already open. It does not invent access; it operationalises the permission debt already sitting in Microsoft 365. One assessment puts the average enterprise tenant at 150 to 300 overshared SharePoint sites. The four patterns that cause most of it are the "Everyone except external users" group, broken permission inheritance, anonymous or organisation-wide sharing links, and legacy "All Employees" security groups. Sharing at the file and folder level with "Everyone except external users" is the worst of them, because it does not show up in site-level reports.

The consequence is not usually a breach. It is that somebody asks Copilot a reasonable question, gets back the salary review or the redundancy list, and the rollout quietly dies that afternoon. As one write-up put it, Copilot did not overshare your data, your permissions did.

Second, no use case that survives contact with the job. "Use it for email" is not a use case. "Draft the first reply to a quote request using the price list and last month's similar quotes, then check these three things before sending" is. Three of those per role beats an hour of feature demonstration.

Third, no measurement. If nobody reports active users and hours at week 4 and week 12, the licence renews on hope. Microsoft 365 gives you the usage report; the honest version pairs it with a two-question staff pulse, because seat activity is not the same as value.

The order that works

Permissions, then use cases, then training, then measurement. In that order.

Fixing permissions after training means the first thing people learn is that the tool is unsafe. Training before use cases means people learn features they have no reason to use. Measuring nothing means you find out at renewal.

This is also why "let's do a pilot with the keen people" tends to mislead. The keen people would have adopted anything. The number that matters is what the indifferent majority do in week 12.

If you already pay for it

Three things you can do this month without any help.

Pull the Copilot usage report and get the real active-user count, not the licence count. Run a permissions review of your top ten most-shared SharePoint sites and look specifically for "Everyone except external users" at file and folder level. Then pick one role, write three genuine tasks for it, and measure the time those tasks take today so you have a baseline to compare against.

If active use is under about a third and it has been more than a quarter since the licences landed, the licence is not the problem and another training session will not fix it.

Sources

• Recon Analytics via Redress Compliance, Microsoft 365 Copilot adoption in 2026: the real numbers
• Stackmatix, Microsoft Copilot adoption rate and statistics in 2026
• Otto IT, Microsoft 365 Copilot for Business: Australian pricing
• EPC Group, How Copilot exposes overshared SharePoint data
• Petri, Copilot didn't overshare your data, your permissions did
• Microsoft Learn, Configure a secure and governed foundation for Microsoft Copilot