Roast & Rise

Published by Roast & Rise

Microsoft 365 Copilot Work

A practical plan for using Copilot inside daily work, preparing better company context, and building your first governed agent.

Most teams buy Copilot before they change how work moves. This RisePlan helps you turn Microsoft 365 Copilot from a loose chat habit into a useful operating layer: daily workflows, source hygiene, prompt contracts, scoped agents, safe actions, and review routines.

Course thesis

Copilot becomes valuable when it is connected to real work: meetings, files, messages, decisions, and workflows. The agent layer only works after the context layer is clean. Teach the team to use Copilot on daily work first, then turn repeated work into scoped agents with owners, sources, tests, permissions, and review.

What you leave with

A working Copilot adoption map, reusable prompt contracts, a clean source pack, a first-agent scope brief, a test set, an action approval ladder, and a 30-day review rhythm.

For

Founders, operators, department leads, managers, AI owners, and Microsoft 365-heavy teams that need practical adoption and safe first-agent setup.

Workflow

Adopting Microsoft 365 Copilot across daily knowledge work, then turning repeated questions and handoffs into governed team agents.

Change

Move from scattered Copilot experiments to a shared work system with source-aware prompts, clean knowledge packs, tested agents, and explicit human review.

What you can do

Use these as checks while you move through the plan.

Explain the difference between Microsoft 365 Copilot Chat, app Copilot, Agent Builder, SharePoint agents, Copilot Studio, Agents Toolkit, connectors, Work IQ, and Copilot APIs.

Map where Copilot can help in meetings, email, documents, decisions, project updates, and handoffs.

Write prompt contracts that define outcome, role, sources, constraints, evidence, format, and review criteria.

Prepare a source pack that makes Copilot and agents safer by cleaning permissions, file versions, and ownership.

Design and test a first knowledge-only agent before adding actions or workflow automation.

Choose when to use Agent Builder, SharePoint agents, Copilot Studio, Agents Toolkit, or connectors.

Install a governance loop for owners, tests, permissions, action approval, lifecycle, and retirement.

Chapters

01

Know Which Copilot You Mean

Start by separating the brand from the work. Copilot can mean chat, app assistance, agents, connectors, APIs, or a low-code builder. Teams lose weeks when they treat those as one thing.

Copilot is a product family. The first adoption mistake is assuming every user sees the same tool. Microsoft describes Microsoft 365 Copilot as an AI productivity tool integrated across Microsoft 365 apps and extendable with agents, connectors, Work IQ, and Copilot APIs. Source: Microsoft 365 Copilot extensibility overview.

Use this plain-language map. Copilot Chat is the work chat surface. App Copilot helps inside tools like Word, Outlook, Teams, Excel, and PowerPoint. Agent Builder creates simple declarative agents. SharePoint agents focus on site or library content. Copilot Studio builds low-code agents and flows. Agents Toolkit gives developers source control, APIs, custom actions, and deployment control. Connectors bring external business data into the Copilot ecosystem.

The practical rule: match the job to the surface. A meeting recap belongs near Teams and Outlook. A policy helper belongs near SharePoint or Agent Builder. A workflow that calls external systems belongs in Copilot Studio or a pro-code build. A custom app that needs work context belongs near Work IQ or Copilot APIs.

Availability is not universal. Licenses, tenant policy, admin settings, region, rollout timing, and data access all affect what the team can use. A RisePlan for Copilot must begin with capability discovery before training.

Quality checklist

Each Copilot surface is named separately.

Tenant and admin dependencies are captured instead of guessed.

At least one work scenario is connected to each enabled surface.

Unknowns have an owner and next check.

The inventory includes agent and connector surfaces, not only chat.

Common mistakes

Using Copilot as one vague label.

Training users on features the tenant has not enabled.

Skipping admin policy and permissions.

Confusing GitHub Copilot with Microsoft 365 Copilot.

Starting with Copilot Studio when a simple knowledge agent is enough.

Checkpoint

Can your team explain which Copilot surface should handle a meeting recap, a proposal draft, a policy question, and a system update?

Exercise

Create your Copilot surface inventory.

List the Copilot surfaces your team actually has today. Include Copilot Chat, app Copilot, Agent Builder, SharePoint agents, Copilot Studio, connectors, and developer APIs. For each surface, mark enabled, blocked, unknown, owner, target users, and first useful work scenario.

Use this at work tomorrow

Ask the Microsoft 365 admin owner for one clear answer: which Copilot surfaces are enabled, blocked, or not licensed today?

02

Map The Daily Work

Copilot becomes useful when it is attached to real work patterns. Map the recurring moments where people read, decide, draft, summarize, compare, and hand off information.

Microsoft 2026 Work Trend Index says organizational factors such as culture, manager support, and talent practices account for twice the reported AI impact of individual effort alone. Source: Microsoft 2026 Work Trend Index. Adoption is a management pattern, not a prompt contest.

The 2026 arXiv paper on M365 Copilot Chat analyzed about 5.5 million sessions and found broad work usage: writing, information retrieval, analysis, decision-making, strategy, and diagnosing systems. Source: AI in the Enterprise: How People Use M365 Copilot Chat. The lesson is direct: start where work already repeats.

Use four work modes. Ask mode finds, summarizes, explains, and compares. Collaborate mode helps the human shape a draft or decision. Delegate mode gives Copilot a bounded task with sources and acceptance criteria. Systematize mode turns repeated Copilot jobs into prompts, checklists, agents, or automations.

Begin with friction. Where do people lose time searching? Where do meetings produce weak follow-up? Where do project updates depend on memory? Where does customer context get rewritten every week? Those are Copilot work candidates.

Quality checklist

The map covers real recurring work, not imagined use cases.

Every use case names source systems.

Sensitive work is marked before prompting begins.

The output is concrete enough to review.

The map separates daily habits from future agents.

Common mistakes

Starting with a generic prompt library.

Ignoring the manager routines that make adoption stick.

Choosing rare work because it sounds strategic.

Failing to name the source material.

Treating every repeated question as an agent candidate too early.

Checkpoint

Can you point to five weekly work moments where Copilot changes a real handoff or output?

Exercise

Build a daily Copilot work map.

Choose one team. Map recurring work across meetings, email, documents, analysis, decisions, project updates, customer context, and handoffs. For each item, mark frequency, pain, source systems, sensitivity, review need, and the best Copilot mode: Ask, Collaborate, Delegate, or Systematize.

Use this at work tomorrow

Pick one recurring meeting and use Copilot to extract decisions, owners, deadlines, risks, and missing information from approved notes.

03

Write Prompt Contracts

Prompt quality improves when the prompt defines the job. A prompt contract gives Copilot the outcome, role, sources, constraints, evidence rules, format, and review standard.

A weak prompt asks for an answer. A stronger work prompt defines the job. A prompt contract names the output, the sources, the boundaries, and the acceptance standard. That makes Copilot easier to review and easier to reuse.

The core contract has seven parts: outcome, role, sources, constraints, process, format, and review. Outcome tells Copilot what finished work should exist. Role gives a work lens. Sources define what may be used. Constraints prevent invention. Process says whether to ask questions first. Format makes the output usable. Review states how a human will judge it.

Source discipline matters. Ask Copilot to separate confirmed facts from interpretation and missing information. Ask for citations or source references where available. Tell it to say unknown when the source material does not support an answer.

Keep prompt contracts close to the workflow. A meeting-to-actions prompt belongs in the meeting routine. A proposal outline prompt belongs in sales prep. A policy summary prompt belongs beside the approved policy source pack.

Quality checklist

The prompt names a concrete output.

Approved sources are explicit.

The prompt includes a missing-information rule.

The format fits a real work handoff.

The review criteria are visible before generation.

Common mistakes

Asking for polish while leaving facts undefined.

Forgetting to tell Copilot what sources to use.

Letting Copilot choose the format.

Saving prompts with no owner or test date.

Treating a useful one-off prompt as a team standard before review.

Checkpoint

Can another teammate use your prompt contract and produce a reviewable output without extra explanation?

Exercise

Convert three loose prompts into prompt contracts.

Take three Copilot prompts your team already uses. Rewrite each one with outcome, role, sources, constraints, process, format, evidence, and review. Test the original and the contract on the same work item. Compare usefulness, source discipline, and review effort.

Use this at work tomorrow

Rewrite one prompt you used this week as a contract, then save the improved version where the team can reuse it.

04

Clean The Context Layer

Copilot and agents reflect the quality of the information they can access. Before building agents, clean the folders, permissions, versions, labels, and ownership around the source material.

The agent layer sits on the context layer. If the source material is duplicated, outdated, overshared, or politically messy, the agent will surface that mess faster. Copilot does not fix information architecture by existing.

Microsoft connector docs describe synced connectors that index content into Microsoft Graph and federated connectors that retrieve content in real time through Model Context Protocol. Source: Microsoft 365 Copilot connectors overview. Both approaches depend on good source ownership and access control.

Build a source pack for every agent candidate. A source pack is a curated set of documents, sites, folders, systems, and exclusions. It states which sources are authoritative, which are stale, who owns updates, who can access the content, and what the agent must not answer.

The boring work is the moat. Remove duplicates. Archive obsolete policies. Name files clearly. Add a short source guide. Check sensitivity labels. Confirm intended users can access the sources. Confirm unintended users cannot.

Quality checklist

Approved and excluded sources are both listed.

Current versions are clear.

Permissions are checked with intended and unintended users.

A source owner is named.

The source pack has a review cadence.

Common mistakes

Using the whole company SharePoint as the source.

Keeping old policies because nobody wants to decide.

Assuming inherited permissions are correct.

Skipping exclusions.

Building the agent before source ownership is assigned.

Checkpoint

If Copilot answers from this source pack, would the team trust the source set and the access model?

Exercise

Prepare one agent source pack.

Pick one repeated workflow from your Copilot work map. Create a clean source pack. Include approved folders, excluded folders, current documents, stale documents to remove, source owner, update cadence, sensitivity level, and intended user group. Do not build the agent until this pack passes review.

Use this at work tomorrow

Choose one SharePoint folder that people rely on, remove obsolete material, and name one owner for source freshness.

05

Build The First Knowledge Agent

Start with a narrow knowledge-only agent. Give it a job, a source pack, boundaries, conversation starters, and a test set before sharing it beyond the pilot group.

Yes, you can use agents with Microsoft 365 Copilot. Microsoft declarative agent docs describe agents as custom experiences that use instructions, actions, knowledge, and metadata while running on Microsoft 365 Copilot infrastructure. Source: Declarative agents for Microsoft 365 Copilot.

Agent Builder is the easiest start for quick Microsoft 365 declarative agents. Microsoft positions it for simple projects where users specify SharePoint and connector knowledge sources, test, then share. Source: Agent Builder in Microsoft 365 Copilot. SharePoint agents are useful when the scope is a site or library.

A first agent should answer from knowledge. It should not email customers, update CRM, change financial records, approve discounts, or modify HR data. Knowledge-only gives the team room to learn source behavior, refusal behavior, and review needs before actions create operational risk.

Good first agents have tight jobs: team onboarding, project cockpit, policy self-help, proposal material finder, meeting decision assistant, or product knowledge helper. Each one has a specific audience and a source boundary.

Quality checklist

The agent has one clear job.

The source pack is ready before build.

Refusal topics are explicit.

Conversation starters match real work.

The pilot group is small.

Common mistakes

Calling a broad company helper a first agent.

Writing personality instructions before work instructions.

Adding actions because the demo looks better.

Sharing with the whole company after one good answer.

Forgetting the escalation rule.

Checkpoint

Can the agent job be explained in one sentence by a user who did not build it?

Exercise

Write the first-agent scope brief.

Before opening Agent Builder or SharePoint, write the agent job in one paragraph. Define target users, allowed sources, excluded sources, allowed topics, refusal topics, answer format, escalation rule, owner, and pilot group. Then draft five conversation starters that teach users what the agent is for.

Use this at work tomorrow

Write the job description for one knowledge-only agent and show it to the source owner before building.

06

Choose The Right Builder

Agent Builder, SharePoint agents, Copilot Studio, Agents Toolkit, and connectors solve different problems. Pick the smallest tool that fits the work.

Microsoft tool comparison separates no-code, low-code, and pro-code options. Source: Choose the right tool to build a declarative agent. The wrong tool creates either too much process or too little control.

Use Agent Builder when the agent is simple, Microsoft 365-native, and mostly knowledge-based. Use SharePoint agents when the source boundary is a site, folder, or document library. Use Copilot Studio when the work needs triggers, tools, connectors, agent flows, or broader channel control. Use Agents Toolkit when the agent becomes software and needs code review, source control, APIs, custom UX, or CI/CD.

Microsoft Agent Builder docs note practical limits: it is for quick and straightforward projects, advanced capabilities belong in Copilot Studio, admin controls affect availability, web content can be disabled, and some Teams or mobile experiences are limited. Source: Agent Builder in Microsoft 365 Copilot.

The decision test is simple. If the agent only answers from curated knowledge, use the simple path. If it must move data, call systems, trigger from events, or support business-critical operations, move to a platform path with stronger ownership and controls.

Quality checklist

The selected builder matches the highest-risk requirement.

A simple knowledge use case stays simple.

Actions and connectors trigger extra governance.

Pro-code is chosen for control, not prestige.

The future upgrade path is documented.

Common mistakes

Choosing Copilot Studio before the team has tested the workflow.

Using Agent Builder for work that needs audited system updates.

Ignoring connector implications.

Treating pro-code as better by default.

Letting one demo decide the architecture.

Checkpoint

Can you defend the chosen builder using the job, sources, actions, risk, and ownership model?

Exercise

Run the builder decision matrix.

Take your first-agent scope brief. Score the need for source scope, actions, connectors, triggers, custom UI, code review, deployment control, audit, and admin governance. Choose the smallest builder that satisfies the highest-risk requirement.

Use this at work tomorrow

For your first agent idea, decide whether it is Agent Builder, SharePoint, Copilot Studio, or Agents Toolkit before any build starts.

07

Test Before You Share

An agent is not ready because it answered one demo question. Test normal answers, boundary behavior, outdated sources, ambiguous questions, permissions, format, and unknowns.

Microsoft requires declarative agents to pass Responsible AI validation checks before publication. Source: Declarative agents for Microsoft 365 Copilot. Your internal quality bar should be more concrete: define the questions before the pilot.

Use a seven-part test set. Five normal questions the agent should answer. Three boundary questions it should refuse or qualify. Three outdated-source traps. Three ambiguous questions where it should ask for clarification. Two permission checks. Two format checks. One unknown-answer test where the correct answer is not found.

Score each answer. Zero means unsafe or invented. One means partially useful with source or boundary problems. Two means useful with minor corrections. Three means ready for pilot. Normal questions should average 2.5 or higher. Boundary, permission, and unknown tests must pass.

Testing is also training. Every failed answer teaches whether the source pack, instructions, refusal rule, or user expectation needs to change.

Quality checklist

Tests are written before wider sharing.

Normal and boundary cases are both included.

Permission checks use different user access levels.

Unknown-answer behavior is tested.

Failed tests produce specific source or instruction updates.

Common mistakes

Testing only the questions that make the agent look good.

Skipping permission checks.

Accepting invented answers because they sound useful.

Not recording failed tests.

Sharing before the agent has an owner review.

Checkpoint

Would you trust this agent after reading its test log, not after watching its best demo?

Exercise

Build and run the agent test set.

Write your test questions before sharing the agent. Run them as the owner and as at least one intended user. Capture answer score, source behavior, correction needed, missing source, permission issue, and instruction update. Do not widen access until the risk tests pass.

Use this at work tomorrow

Write ten test questions for the agent you want to build, including two questions it should not answer.

08

Add Actions Safely

Actions change the risk profile. An agent that answers from sources is one thing. An agent that changes systems needs approval levels, logging, escalation, and stronger ownership.

Microsoft describes agents as able to retrieve, summarize, reason, and take real-time actions such as updating databases or triggering workflows. Source: Microsoft 365 Copilot extensibility overview. That is powerful. It is also the point where governance stops being optional.

Use an action approval ladder. Level 0: answer only. Level 1: draft an action for human review. Level 2: prepare a system update and let a human submit. Level 3: execute a low-risk action with logging. Level 4: execute a sensitive action only with explicit approval and audit.

Most first agents should stay at Level 0 or Level 1. Customer-facing, financial, legal, HR, security, discount, access, and contract actions should require explicit human approval. Faster is not the goal if nobody can explain what changed.

Move to Copilot Studio when the work needs connectors, tools, triggers, agent flows, or multi-channel deployment. Move to a pro-code path when the workflow is business-critical enough to need engineering review, custom APIs, CI/CD, and observability.

Quality checklist

The action changes a named system or record.

Failure impact is described plainly.

Approval level is assigned before build.

Logging and rollback are defined.

Sensitive actions require explicit human approval.

Common mistakes

Adding write actions to make the agent feel impressive.

Skipping the rollback path.

Treating draft and submit as the same risk.

Letting the agent decide escalation.

Using connectors before data ownership is clear.

Checkpoint

If this agent action goes wrong, can the team see what happened, stop it, and correct the record?

Exercise

Map one possible agent action.

Choose one action your agent could eventually perform. Define the trigger, system touched, data changed, failure impact, approval level, log record, rollback path, and human escalation point. Decide whether the action belongs now, later, or never.

Use this at work tomorrow

Take one tempting agent action and classify it from Level 0 to Level 4 before anyone builds it.

09

Govern Agents Like Work Assets

Shared agents need owners, source maintenance, tests, change logs, review cadence, policy boundaries, and retirement rules. Treat them like living work assets.

Microsoft 2026 Work Trend Index says agent scale needs evaluation infrastructure, managed identities, permissions, policy enforcement, lifecycle management, monitoring, and auditability. Source: Microsoft 2026 Work Trend Index. That is the operating reality behind the demo.

Every shared agent needs four owners. A business owner accountable for usefulness. A source owner responsible for knowledge freshness. A technical owner responsible for builder, connector, and environment issues. A risk owner responsible for sensitive topics, actions, and escalation.

Governance should be visible and light enough to use. One card is enough for the first version: purpose, users, allowed use, prohibited use, sources, owner, action level, test date, review cadence, known gaps, and retirement condition.

Retirement is a sign of maturity. Some agents should become simple prompts. Some should become Copilot Studio workflows. Some should be archived because the source quality or business value is too weak.

Quality checklist

Every owner role is named.

Allowed and prohibited uses are explicit.

The action level is visible.

The test set has a location and date.

The agent has a retirement rule.

Common mistakes

Calling IT the only owner.

Launching without source maintenance.

Treating governance as a legal document nobody reads.

Forgetting to retest after source changes.

Keeping unused agents live forever.

Checkpoint

Could a new manager inspect this card and understand what the agent does, who owns it, and when it should stop?

Exercise

Create the agent governance card.

For your first shared agent, fill in purpose, users, owners, sources, prohibited uses, test set link, approval level, pilot group, review cadence, known gaps, and retirement rule. Review it with the manager and admin owner before wider rollout.

Use this at work tomorrow

Assign a business owner, source owner, technical owner, and risk owner for one proposed agent.

10

Run The 30-Day Copilot Work Loop

Adoption becomes real when the team repeats the loop: inventory, daily workflows, source pack, first agent, test, pilot, review, decide.

The 30-day path is a decision loop. At the end, the team should know which Copilot habits are worth keeping, which agent should scale, which source packs need cleanup, and which automation ideas are too risky.

Week 1 maps the current work and Copilot capability. Week 2 installs prompt contracts and daily routines. Week 3 builds a first knowledge-only agent with a source pack and test set. Week 4 pilots, scores, updates, and decides the next move.

Measure practical signals. Time saved is useful, but quality and review effort matter more. Track repeat use, source confidence, correction rate, review time, missing-source rate, refusal quality, and decisions made.

The output is a Copilot Work Memo. It names what changed, what broke, what the team will keep, what will become an agent, what needs admin work, and what should stop.

Quality checklist

The loop has one target team.

The decision meeting is scheduled at the start.

Daily workflows and the first agent are separated.

Success and stop signals are both defined.

The final memo produces a scale, redesign, or stop decision.

Common mistakes

Running adoption as training only.

Measuring logins instead of workflow value.

Skipping the decision meeting.

Trying to launch several agents at once.

Ignoring source-owner workload.

Checkpoint

At day 30, can the team decide what to keep, what to change, and what to stop using evidence from real work?

Exercise

Plan your 30-day Copilot work loop.

Create a four-week board with one owner, one target team, five daily Copilot workflows, one source pack, one knowledge-only agent, one test set, one pilot group, and one decision meeting. Put the decision meeting on the calendar before the build starts.

Use this at work tomorrow

Book the 30-day decision meeting and write the one question it must answer.

30-day path

Week 1: inventory enabled Copilot surfaces, map daily work scenarios, and choose five recurring workflows.

Week 2: write prompt contracts for the selected workflows and test them on real Microsoft 365 work.

Week 3: prepare one source pack, scope one knowledge-only agent, and run the builder decision matrix.

Week 4: build or configure the first agent, run the test set, pilot with a small group, and hold the 30-day decision meeting.

Success signals

The team can name which Copilot surfaces are enabled and which are blocked or unknown.

Five recurring workflows have source-aware prompt contracts.

One source pack has approved sources, exclusions, owner, permissions check, and review cadence.

One knowledge-only agent has a job, boundaries, conversation starters, test set, and owner.

Boundary, permission, and unknown-answer tests pass before wider sharing.

The 30-day review produces a scale, redesign, pause, or stop decision.

Reflection prompts

Where did Copilot improve the work, and where did it only make output faster?

Which source gaps created weak answers or extra review effort?

Which prompt contracts should become team standards?

Which repeated questions deserve an agent, and which should stay as prompts or checklists?

Which actions are too sensitive until approval and audit are stronger?

Which agent should be retired, rebuilt, or moved to Copilot Studio?

Manager checklist

Confirm the tenant capability map before training the team.

Pick workflows with real repetition and visible review needs.

Protect source cleanup time before agent building starts.

Require prompt contracts for shared Copilot routines.

Start with a knowledge-only agent.

Review the test log before wider rollout.

Assign owner roles and review cadence.

Hold the 30-day decision meeting.

In this library

Related RisePlans

Want this shaped around your company?

Risey can research your company foundation first, then build a version of this path around your real workflows, customers, and culture.

Start with your company