Checked by Hanny Ramzy on 26 September 2026. Drafted with AI help, then checked against Microsoft's own earnings releases and documentation, and our own Microsoft 365 admin centre.
On 25 September 2026, Microsoft’s chief executive Satya Nadella posted on X about the biggest update to Copilot so far. One reply, seen more than 270,000 times, was a blunt question from @vishalsingh2972: “Serious question: does ANYONE use copilot?”
A few hours later Nicolas Bustamante, who works on AI for knowledge workers at Microsoft, answered him. He said Microsoft 365 Copilot “now has over 30 million paid seats”, that large companies need AI that works with their existing data and meets privacy and compliance rules across countries, and that the “perception gap” comes from the San Francisco tech bubble, where most people work at smaller companies.
That is one Microsoft employee’s view on social media. So we went to Microsoft’s own investor pages and documentation to check the number, and to see what it means for a Malaysian business. Office Niaga supplies Microsoft 365, through a Microsoft CSP partner, as well as Google Workspace, and customers are starting to ask us whether Copilot is worth it.
The short answer: yes, and Microsoft has published the number
The 30 million figure is real, and it comes from Microsoft itself, not only from the post on X. In its results for the quarter ended 30 June 2026, released on 29 July 2026, Satya Nadella said “Microsoft 365 Copilot reached over 30 million paid seats”.
Microsoft has given a figure in each of its last three earnings calls. Here is how paid seats have grown, in Microsoft’s own words:
| Earnings call | Paid Microsoft 365 Copilot seats | What else Microsoft said |
|---|---|---|
| 28 January 2026 | 15 million | Daily active users up 10 times year on year |
| 29 April 2026 | Over 20 million | Accenture has over 740,000 seats, its largest Copilot customer so far |
| 29 July 2026 | Over 30 million | Enterprise customers giving Copilot to most of their office staff grew nearly 75% in a quarter |
Two things are worth keeping in mind. First, a paid seat is a licence someone bought, not proof that the person uses it every day. Microsoft has shared growth rates for daily use but not a daily user count. Second, 30 million is big but not universal. In January 2026 Microsoft said it had over 450 million paid Microsoft 365 commercial seats. So fewer than one in ten paid Microsoft 365 business users had the paid Copilot licence at the latest count.
That fits what Bustamante described. Copilot is spreading fastest in large organisations, and most people who use Microsoft 365 at work do not have the paid version yet.
Why it feels like nobody uses it
It is easy to see why the question came up. Most AI talk online is about consumer chatbots and coding tools, while Microsoft 365 Copilot is used inside company accounts, behind a work sign-in. People rarely post about summarising a tender document or catching up on a Teams meeting.
The names do not help either. “Copilot” now covers a free consumer app, the free Copilot Chat for work accounts, the paid Microsoft 365 licence, GitHub Copilot for developers and more. In August 2026 Microsoft also renamed the Microsoft 365 Copilot app, which many people still call the Microsoft 365 app, to Microsoft Copilot. Someone who says they have “never used Copilot” may have opened it this morning to get to Word. Our guide to what happened to the Microsoft 365 app sorts out every Copilot name.
Why large organisations choose Copilot
Bustamante’s argument was that big companies care less about which chatbot is cleverest and more about data, privacy and control. Microsoft’s own documentation backs up each of those points:
- It works on data you already have. With the paid licence, Copilot answers from the emails, files, meetings, chats and SharePoint sites in your Microsoft 365 account, through Microsoft Graph. Nobody has to copy documents into a separate AI tool.
- It follows your existing permissions. Microsoft says Copilot “only surfaces organizational data to which individual users have at least view permissions”. It also honours sensitivity labels and encryption applied with Microsoft Purview.
- Your data is not used for training. Microsoft states that “prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation LLMs, including those used by Microsoft Copilot.”
- The same contract as your email. Microsoft calls this enterprise data protection. Prompts and responses are covered by the same Data Protection Addendum and Product Terms as your email in Exchange and your files in SharePoint, with Microsoft acting as a data processor.
- Compliance paperwork already exists. Microsoft lists compliance offerings for Copilot including GDPR, ISO 27001, HIPAA and ISO 42001, the standard for AI management systems. Microsoft also says Copilot works within the Microsoft 365 service boundary of your tenant.
- IT stays in control. Admins manage Copilot in the same Microsoft 365 admin centre they already use for users and licences, with audit, retention and settings for what Copilot may do.
When we opened Copilot > Settings > View all in our own admin centre, it listed more than 20 separate Copilot controls, from web search and image generation to which AI model providers are allowed:
For a bank, a hospital group or a government department, those controls matter more than a clever answer. That is why Copilot is being bought in bulk by large employers, even while it is rarely discussed on social media.
What this means for a Malaysian business or agency
The same reasons apply in Malaysia, but a few details are worth checking before you decide.
Personal data and the PDPA
Microsoft’s terms make it a data processor for your Copilot prompts and responses. They do not take over your own duties under Malaysia’s Personal Data Protection Act 2010 (PDPA). Your organisation still decides what personal data staff may put into Copilot, and Copilot can only see what each user can already open. If a staff member with the paid licence can open the HR folder today, Copilot can use the HR folder when that person asks it a question.
Where the data is kept
Microsoft says Copilot works within your Microsoft 365 tenant’s service boundary, and that stored prompts and responses are kept “in alignment with contractual commitments” for your other Microsoft 365 content. Where that content is physically kept needs a closer look:
- Malaysia is a local region. Microsoft lists Malaysia, with a data centre in Kuala Lumpur, as a local data location for Microsoft 365, including Copilot.
- The written commitment is an add-on. For an organisation signed up in Malaysia, Microsoft’s commitment to store Copilot data at rest in Malaysia comes with its Advanced Data Residency or Multi-Geo add-ons, not with a standard plan.
- Processing can happen elsewhere. Microsoft says customers outside the EU “may have their queries processed in the US, EU, or other regions”.
An admin can check this under Settings > Org settings > Organization profile > Data location. Government agencies and GLCs with data residency rules should read this panel, and their own policy, before a pilot.
Which plans can use Copilot
The free and paid versions have different requirements. Microsoft lists these, as of 26 September 2026:
| What you want | Plans Microsoft lists |
|---|---|
| Copilot Chat, at no extra cost | Microsoft 365 Business Basic, Business Standard and Business Premium; Microsoft 365 E3, E5 and E7; Office 365 E1, E3 and E5; the F plans; education and government plans |
| Microsoft 365 Copilot Business, the paid add-on for smaller businesses | Business Basic, Business Standard, Business Premium, Microsoft 365 Apps for business or Teams Essentials |
| Microsoft 365 Copilot, the paid add-on for larger organisations | Microsoft 365 E3 or E5, Office 365 E1, E3 or E5, and many other enterprise and frontline plans. Microsoft 365 E7 already includes it |
Microsoft’s newest documentation shortens these names to Microsoft Copilot and Microsoft Copilot Business. Microsoft’s Malaysian website still sells the small business version as Microsoft 365 Copilot Business, for organisations of up to 300 users.
One plan is missing from the Copilot Chat list: Microsoft 365 Apps for business. Our own test account is on that plan, and Chat told us it was not available:
To see which plan you have, look under Billing > Your products in the admin centre. Our guide to assigning Microsoft 365 licences shows the page. If your plan names are confusing, see Office 365 vs Microsoft 365.
How to start small
You do not need to buy Copilot for everyone to find out whether it helps. Microsoft’s own setup guide recommends piloting with a small group of users first. This is the order we suggest:
- Turn on Copilot Chat first. If you are on Business Basic, Standard or Premium, your staff already have it. Ask them to sign in with their work account, not a personal one, so enterprise data protection applies. Our Microsoft 365 sign-in guide covers the work account, and Microsoft Authenticator protects it.
- Write a one-page AI rule. Say what staff may paste into Copilot Chat, such as customer names, IC numbers or tender prices, and what they must check before sending anything Copilot drafts.
- Fix oversharing before any paid seats. The paid licence lets Copilot search everything a user can open, so old “anyone with the link” shares and team sites open to the whole company become visible in answers. Microsoft’s deployment guidance starts with this step. Our guides to sharing OneDrive files and SharePoint team sites show where those settings live.
- Pilot paid seats with a few people. Pick three to five staff who spend most of their day in email, meetings and documents, such as a manager, a sales lead and an admin officer. Give them a few weeks and specific tasks to try.
- Measure, then decide. The admin centre has Copilot usage reports. Ask the pilot group which tasks got faster, and only then decide whether to add more seats.
In our own admin centre, Copilot > Overview > Security has a Manage data oversharing section for step 3:
Microsoft says SharePoint Advanced Management is included with Copilot licences. It can find overshared sites and hide sensitive ones from Copilot while you fix them.
When Copilot is not worth it
Copilot is not the right buy for everyone. These are the situations where we would wait:
- Your work is not in Microsoft 365. If files sit on a shared drive in the office, in personal Google Drive accounts or in WhatsApp groups, the paid licence has little to work with. Move the work in first.
- Your sharing is a mess and nobody owns it. If you cannot say who can open what, fix that before giving Copilot the ability to search it.
- Staff only need an occasional draft. Rewriting an email or summarising a pasted document works in the free Copilot Chat. The paid licence earns its keep for people who live in email, meetings and shared documents all day.
- Nobody will change how they work. A licence that is never opened is still billed. A pilot shows whether your team uses it before you commit.
- You are on Microsoft 365 Apps for business only. You would need Business Basic or higher to get Copilot Chat, so compare the upgrade with the add-on before buying either.
- Your data residency rules need a written commitment. Budget for the residency add-on, or clear it with your data protection officer, before you start.
What about Google Workspace and Gemini?
If your business runs on Google Workspace instead, Google includes Gemini in its Business plans, with Gemini in Gmail on every plan and Gemini in Docs, Sheets and Meet from Business Standard. We cover what each plan gets in Gemini for business and how to use it in our Gemini guide for Malaysian offices.
What are Copilot CLI and Copilot Cowork?
Bustamante said he uses “Copilot CLI for coding” and “Copilot Cowork” every day. Both are real products, but neither is what most office staff will use first:
- GitHub Copilot CLI is a coding assistant that runs in a computer’s terminal. GitHub says it can “answer questions, write and debug code, and interact with GitHub.com”. It is for software developers.
- Copilot Cowork is part of Microsoft Copilot. Microsoft says it “carries out tasks on your behalf”, such as sending emails, scheduling meetings and creating documents. It uses your permissions, and it is billed by usage, so an admin has to switch on usage-based billing and choose who can use it.
How we checked this guide
We read the X posts by @vishalsingh2972, Nicolas Bustamante and Satya Nadella on 26 September 2026 and quoted them only briefly. We checked the 30 million figure against Microsoft’s own earnings release of 29 July 2026 and its earnings calls of January, April and July 2026 on microsoft.com. Every statement about licences, data protection, data residency, admin controls, oversharing and Cowork comes from Microsoft Learn. Copilot CLI comes from GitHub’s documentation. The screenshots are from our own Microsoft 365 admin centre and test account on 26 September 2026. We did not include prices, because they vary by supplier and change often.
We drafted this guide with AI help. Hanny Ramzy then checked every number, plan name and menu path against those sources on 26 September 2026. Microsoft is changing Copilot quickly, so we will update this page when its figures or licence rules change.
Planning Copilot or Microsoft 365 for your organisation?
If you want a second opinion before a Copilot pilot, WhatsApp our team on +60 16-916 3324. We can check which plans you have, what your staff can use today and what to tidy up first. We supply both Microsoft 365 and Google Workspace, so we will tell you plainly which fits the way you work.
Hanny RamzyHanny Ramzy runs Office Niaga at Web Impian Sdn. Bhd. (SSM 920163-H) in Kota Bharu, Malaysia, helping businesses and agencies move to Google Workspace and business email with Ringgit billing and local support.