When Microsoft 365 Copilot is enough and when your own AI assistant pays off

When is Microsoft 365 Copilot enough?

Copilot is enough when the people who will use it spend their day in Outlook, Teams, Word, Excel and SharePoint, and the questions they ask can be answered from those sources. Typical tasks are summarising a long mail thread, preparing notes from a Teams meeting, drafting a letter from a template, finding the latest version of a document or turning a spreadsheet into a short commentary. For this kind of work Copilot sits inside the tools people already use, signs in with the existing Microsoft account and works with the permissions the company has already set. Building the same thing yourself rarely pays off.

Many companies start here. In Bitkom's study report on AI in Germany (fieldwork 2025), 70% of the companies that use AI used ChatGPT and 28% used Copilot. Bitkom's president Ralf Wintergerst added a warning in September 2026 that applies to any licence: "Wer nur eine Lizenz kauft, hat KI eingekauft, aber noch nichts verändert" (whoever only buys a licence has bought AI but not yet changed anything). Whether Copilot pays off depends on whether people use it for work that matters, so measure that with a small group before you roll it out to everyone.

• The knowledge people need is in mails, chats, meetings and Office documents
• The tasks are general: writing, summarising, searching and preparing
• The data may be processed in Microsoft's cloud under your existing Microsoft contract
• Permissions in SharePoint, OneDrive and Teams are in order, or you are ready to fix them first

When does your own AI assistant pay off?

Your own assistant pays off when the value lies in data or processes that Copilot does not reach well. By your own assistant we mean a chat interface or agent that runs in your own cloud account or on your own servers, uses the model you choose and reads your systems with their permissions. Five situations come up again and again:

• Data outside Microsoft 365: the answers depend on SAP or another ERP, a DMS such as d.velop or ELO, a ticket system, a product database or file servers that were never moved to SharePoint. Microsoft offers connectors and agents built in Copilot Studio to bring other sources in, so check for each system whether a connector exists, how current it keeps the data and whether it carries the permissions over
• Data that may not leave your own servers: Copilot runs in Microsoft's cloud. If contracts, customer requirements or your own risk assessment say that certain data stays in your data centre, the assistant has to run there too, with an open-weight model, which is a model whose weights you can run on your own servers
• Permissions beyond Microsoft: who may see which customer, cost centre or personnel file is often defined in SAP roles or DMS access lists, which Microsoft 365 knows nothing about. Your own assistant can filter every search by the identity of the person asking, using the access lists of the source system
• Per-seat cost at scale: Copilot is licensed per user. If many people would use an assistant only now and then, a shared assistant billed by actual model use can cost less in total once build and operation are counted. Do the sum with your own numbers
• A specific process: checking incoming invoices against orders, preparing quotes from past offers and ERP prices, or sorting customer requests into a ticket system is more than chat. It needs an agent, a program that carries out steps in your systems and puts results to a person for approval, tested on your own cases

Most companies have not reached this point yet. In the IAB establishment panel published in May 2026, 90% of the establishments that use AI used free tools, 16% used purchased models trained on their own data and 6% used their own models. The gap between using a chat tool and having AI that knows your documents and systems is where your own assistant earns its keep.

How do Copilot and your own AI assistant compare?

The table compares the two options on the questions that usually decide it. Read each line as a tendency and check it against your own systems and contracts.

Can Copilot expose sensitive data?

Yes, if permissions are too broad, and the same is true of any assistant you build. Copilot shows a user only content that the user is already allowed to open. The problem is that in many tenants too many people are allowed to open too much: sites shared with the whole company, links that work for everyone in the organisation, old project folders nobody cleaned up. Before, nobody found those files. An assistant that searches everything a user may see finds them in seconds. This is called oversharing.

IT leaders ask about this directly. One webinar question collected by Syskit reads: "What would be your approach if a business asked to turn on Copilot immediately for an organization with over-permissioned identities, over-shared resources, and no data classification, ownership, or lifecycle management in place?" Microsoft's own Zero Trust workshop guidance treats oversharing as part of getting ready for AI. The answer is the same in both cases: permissions first.

1. 1

   Find what is shared too widely

   List sites, teams and folders that are open to the whole company or to anyone with a link, and the sensitive content in them, such as personnel, salary, contract and customer data.

2. 2

   Give every site an owner

   Someone has to decide who should have access. Sites without an owner are where oversharing survives.

3. 3

   Remove broad access and label sensitive content

   Take away company-wide access where it is not needed, and mark sensitive content so that it can be excluded or handled separately.

4. 4

   Test as real users before go-live

   Ask the assistant questions with the accounts of people from different departments and check that each sees only what they should. Keep these test questions and repeat them after every change.

For your own assistant the work is the same, plus one step: the permissions of each source system have to be copied into the search index and checked on every query. RAG means answers drawn from your own documents, with the source shown. Our guide to keeping document permissions intact in RAG describes how to do that and how to test it with users who should be refused.

What does each option cost?

The two are priced differently, so compare the total for your own users rather than list prices. We do not quote Copilot prices here: they and their promotions change, and the sources we checked disagree on them. Ask your Microsoft partner for the current offer, then compare the cost lines:

• Copilot: one licence per user, whether that person uses it every day or rarely, plus the work of cleaning up permissions and training people
• Your own assistant: building the interface, the connections to your systems and the permission filter, then running it with updates and tests after each change, plus model use, billed per request in your cloud account or covered by your own hardware
• Both: the time people spend checking answers, and the work of getting people to use the tool at all

Two patterns tend to tip the result. If most staff use the assistant a lot and mostly on Microsoft 365 content, per-user licences are easy to plan. If many people use it only occasionally, or a few teams need deep access to ERP or DMS data, a shared assistant billed by use can come out cheaper. One administrator on administrator.de describes building a front end of their own on pay-as-you-go model access because it was "deutlich günstiger als personalisierte Zugänge" (clearly cheaper than personal licences). That is one company's experience. Our guide to the full cost of an AI workflow shows how to calculate the cost per handled case for either option.

Can we use Copilot and our own assistant together?

Yes, and for many companies that is the honest answer: Copilot for everyday office work, your own assistant or agent for the processes and data that Copilot does not reach well or that may not leave the house. The two do not compete for the same tasks. Ask first which tasks matter most and where their data lives, then choose the tool per task.

If you run models yourself, put an LLM gateway in front of them: one controlled access point to all models, with keys, budgets and logs. It lets you change models without changing every application, and it shows which team uses what. Our LLM gateway guide explains what it does and when you need one, and our guide on self-hosted AI or a managed API helps decide where each model should run.

How do we decide without locking ourselves in?

Decide task by task, on your own data and measured results, and keep the exit open whichever way you go:

1. 1

   List the tasks first

   Write down the tasks where people lose most time today, with the systems and documents each one needs.

2. 2

   Mark where the data lives and where it may go

   For each task, note whether the data is in Microsoft 365 or elsewhere, and whether it may be processed in a public cloud. Your data protection officer should see this list.

3. 3

   Check permissions

   Run an oversharing check in Microsoft 365 and note where other systems define who may see what.

4. 4

   Pilot on real work and measure

   Test the option that fits each task with a small group on their real cases, and measure time per case and quality before and after. Decide the rollout on these numbers, not on a demo.

5. 5

   Keep the exit open

   Whatever you build, keep code, prompts, tests and data in your own accounts, and use a gateway so that models can be changed. Our build or buy guide covers what to settle before you sign.

If you want a second opinion on your own situation, talk to an engineer: a free 30-minute call that needs no access to your systems or data. If you already pay for Copilot, ChatGPT or similar licences, the free AI usage review puts spend and quality on one page, built from exports you choose to send.

Enterprise AICompany knowledge assistantKnowledge assistants (RAG)