“I tried that Copilot thing and it just gave me waffle.” I hear some version of this a lot — usually from someone who typed one vague line into Microsoft Copilot, got a bland answer back, and quietly decided the whole thing was overhyped.
The tool wasn’t the problem. The brief was. The single biggest shift that separates people who get genuinely useful work out of Copilot from people who get waffle is this: stop treating it like a search box, and start treating it like a capable new colleague on their first day. You wouldn’t say “do the marketing” to a new starter and expect magic. Copilot is the same. This is a short, practical guide to using Microsoft Copilot well — what to hand over, how to brief it with prompts that actually work, and how to keep it safe.
(For the record: this website, this post included, is built with heavy AI assistance. This isn’t a sales pitch for AI — it’s how we actually work, written up.)
Start with the jobs actually worth handing over
Before the “how,” the “what.” Copilot is strongest on anything that’s mostly reading, writing, summarising or reasoning over text — and because it lives inside Microsoft 365, the everyday wins for a small business sit right where you already work:
- Drafting — emails in Outlook, proposals and policy first drafts in Word, a deck in PowerPoint, job adverts, website copy.
- Summarising — boiling a 30-page report, a long email chain, or a Teams meeting you missed down to the decisions and actions.
- Tidying — turning your rough bullet points into something you’d actually send.
- Pulling things out — “what are the key dates and obligations in this contract?”
- Thinking it through — a sounding board for a plan, or a list of what you might’ve missed.
Where it’s weakest is anything that needs a guaranteed-correct fact, a live answer, or specialist judgement you’d normally pay a professional for. Those aren’t off-limits — they’re just things you delegate the draft of and then check, never things you take on trust. More on that below.
A good rule of thumb: if it’s a job you could hand to a sharp, well-read assistant who doesn’t know your business yet, it’s a job you can hand to Copilot.
Write a good Copilot prompt: brief it like a colleague
This is where most of the difference lives. A thin prompt gets a thin answer. A good prompt has four parts, and you already know them — they’re what you’d tell a new starter:
- A role. “You’re our office manager replying to a supplier.” Telling Copilot who to be sets the tone and the assumptions.
- The context. “This is a client who’s annoyed their order is late. They’re a good customer and we want to keep them.” Copilot can’t read the room you’re in unless you describe it.
- The raw material. Point it at the actual email thread, the actual report, the actual notes — or paste them in. Don’t make it guess at what it can’t see.
- What good looks like. “Under 150 words. Warm but not grovelling. Offer a clear next step.” Constraints make the output usable instead of generic.
Compare the two prompts:
Thin prompt: “Write an apology email to a customer.”
Briefed prompt: “You’re our office manager. A long-standing client, Sarah, is frustrated her order is two weeks late because of a supplier delay on our end. Write a warm, genuine apology under 150 words — own the mistake, don’t make excuses, and offer to call her this week. Here’s the thread so far: [paste, or point Copilot at it in Outlook].”
The second one comes back nearly ready to send. The effort you put into the brief is the work; Copilot does the typing.
Its real superpower: it already knows your stuff
Here’s what sets Microsoft Copilot apart from a standalone chatbot. The paid Microsoft 365 version is connected to your own Microsoft 365 account — so it can draw on your documents, emails, calendar, chats, meetings and contacts, not just whatever you paste in (Microsoft). That’s what makes it feel like genuine delegation rather than a clever autocomplete: “summarise the last three emails from this client and draft a reply,” “what did we agree in the project planning meeting?”, “pull the risks out of the contract in my OneDrive.”
Two things worth knowing so this lands the way you expect:
- It only ever sees what you can see. Copilot surfaces organisational data to which you already have at least view permission (Microsoft) — it doesn’t widen anyone’s access. The flip side, covered below, is that existing loose permissions become very easy to stumble across.
- You can still hand it material directly. In Copilot Chat you can paste text, upload a file, or drag one into the chat — handy for the lighter version you get with a work account, which works from the web rather than your full file estate.
Treat it as a conversation, not a vending machine
The first answer is rarely the finished one, and it isn’t meant to be. The people who get the most out of Copilot treat it as a back-and-forth:
- “Good start — make it warmer and cut the last paragraph.”
- “That’s too formal for us. Imagine you’re explaining it to a mate.”
- “Give me three subject lines for that, ranging from safe to bold.”
You’re not starting over each time; you’re steering. This is exactly how you’d refine a draft with a colleague, and it’s where a mediocre first attempt becomes the thing you actually use.
Always check the work — it’s still your name on it
Here’s the non-negotiable. Copilot, like every large language model, can be confidently wrong. The NCSC puts it plainly: these tools “can get things wrong and present incorrect information as fact” (NCSC). It can invent a statistic, misremember a date, or state a legal point that simply isn’t true — and it’ll do it in the same fluent, assured tone as everything else.
So the line to hold is: delegate the drafting, not the sign-off. Anything that leaves the building under your name — a figure in a proposal, a claim about a client, a legal or compliance point, a number on your website — you verify yourself before it goes out. Copilot gets you 90% of the way in a tenth of the time; the last 10% is your judgement, and that’s still the job.
Keep the sensitive stuff out — and mind your permissions
The other half of doing this safely is being deliberate about which Copilot you’re in and what it can reach. Three things worth knowing:
- The version matters. On the paid Microsoft 365 Copilot — and on Copilot Chat used while signed in with a work account — your prompts, responses and the data Copilot pulls from your Microsoft 365 account aren’t used to train the underlying models, and they stay inside the Microsoft 365 service boundary (Microsoft). The free consumer Copilot you’d sign into with a personal account is a different proposition, and the bigger risk is usually staff pasting work into whatever they’ve signed up for personally, without anyone knowing.
- Permissions are the new perimeter. Because Copilot can read anything a user already has access to, an over-shared SharePoint folder or a “whole company” Team that nobody tidied up suddenly becomes searchable in plain English. Copilot doesn’t create that exposure — it just makes existing sloppiness obvious. Getting permissions right before you roll it out is the work.
- The law doesn’t look the other way. There’s no “AI exemption” from data protection. The ICO is clear that if you put personal or client data into a tool, you remain responsible for it (ICO).
None of this means “don’t use it.” It means use the right, approved version, tidy up your permissions first, put a one-page staff policy behind it so everyone knows the rules, and keep genuinely sensitive material out unless you’ve checked the terms. We dig into this properly in the AI security risks UK businesses should plan for, and if you’re weighing Copilot against the alternatives, our take on Claude vs Microsoft Copilot is the place to start.
The short version
Delegating to Copilot isn’t a technical skill — it’s a management one. Pick a job you’d trust to a capable assistant. Brief it like you’d brief a person: role, context, material, what good looks like. Lean on the fact that it can reach your own files and email. Treat the reply as a first draft to refine. Check anything that carries your name. And be deliberate about which version you use and what it can reach. Do that, and the “waffle” problem disappears — because the quality of what comes out tracks the quality of what you put in.
