How do you go from a Copilot pilot to a company-wide rollout?

You move from pilot to rollout when the pilot has improved a specific task against a measurement taken before you started, and when your data permissions hold up for a wider audience. The rest is sequence: licences for a small group, a decision on a fixed date, then successive waves, each with an owner.

How many Copilot pilots actually become a rollout?

A minority, according to the independent sources we found, although none gives a recent, solid percentage. Forrester, in its analysis of 27 February 2026, written after dozens of conversations with CIOs and CDOs about Dynamics 365, Power Platform and Microsoft 365, sees most companies still in pilot mode and 12-18 months from deployment at scale. It describes an EMEA bank that extended licences only after measurable improvements.

The most precise figure is older. In a Gartner survey from June 2024 of 132 IT leaders, reported by Computerworld, 60% had started a pilot, 6% had finished one and were planning a large-scale deployment, and 1% had already extended Copilot to all eligible employees.

Microsoft tells the opposite story: on its call of 29 July 2026 it reported more than 30 million paid Copilot licences and growth of almost 75% in three months in the number of enterprise customers who give it to most of their information workers. That is vendor data, and a growth rate does not say how many such customers there are or how many pilots stall before they get there. We covered why so many stall in why bought licences end up being used for email.

What steps take you from a Copilot pilot to the whole company?

Five, in this order: choose the process, get the data in order, run the pilot in a closed window, decide, widen in waves. Microsoft describes three phases, Pilot, Deploy and Operate: licences for a small group to test, then for a larger group, then monitoring and corrections. Its Adoption Hub starts from Plan: deciding where Copilot can deliver value first.

Step	What you do	How you know you can go further
1. Choose the process	A recurring task with a number the company already tracks (time, errors, volume). You fix the baseline measure and name an owner in the business.	There is a written use case, with the baseline and a name next to it.
2. Get the data in order	Check permissions and sharing on the sites the pilot uses. Fix the risky ones or exclude them from Copilot’s search.	The pilot’s sites are no longer shared with the whole organisation or left without an owner.
3. Run the pilot in a closed window	Licences for a dedicated group and hands-on support on the real task, for 6-8 weeks (a rule of thumb of ours).	The measurement is repeated with the same people and the same counting rules.
4. Decide	The business owner and IT look at the same numbers and choose: widen, redesign or stop.	The measure has improved, the improvement is explained by the process, the access rules are written down, the budget is calculated.
5. Widen in waves	You restart from the same process with other teams doing the same work, one owner per wave.	Each wave repeats the check from step 4 before the next one starts.

For the pilot group, Microsoft suggests people from different areas who are already heavy users of the Microsoft 365 apps and who then act as champions. To decide on a rollout, though, part of the group has to do the same work, otherwise step 1 has nothing to compare against.

A well-chosen task looks like this: at a consulting firm with more than a hundred consultants, a presentation went from four hours to under one, and more than 115 people now use the tool.

How do you know a Copilot pilot is ready for rollout?

When the measure for the process has improved, the permissions hold up for the wider audience and the budget is based on real cost.

Technical checks and usage numbers help, but neither tells you whether the task has improved. That is the number from step 1, and we explain how to read it in how to measure Copilot’s ROI.

You also have to attribute the result correctly. The Copilot Dashboard warns that Copilot is unlikely to be the only cause of the changes it shows: seasonality, role changes and reorganisations count too. The assisted hours it calculates are an estimate built on usage, not the time saved on your own process. For reading active users and returning users, see how many employees really use Copilot every day.

The third point is cost: the real licences and prices for the wider audience and, if the use case involves agents, how they are billed. The sums are in what Copilot really costs.

How do you prepare permissions before widening Copilot?

You find the sites that are shared more than they should be, temporarily restrict what Copilot can read, and then correct the access, all before opening up to the wider audience. The reason is that Copilot respects existing permissions, sharing settings and policies: widening the audience also widens the wrong permissions that were already there.

In the Gartner survey cited above, 40% of respondents had delayed rollout by at least three months over oversharing concerns (content shared with more people than it should be) and 57% had limited it to low-risk or trusted users. According to Max Goss, a Gartner analyst, Copilot is not at fault: the environment had never had its permissions in order. Forrester puts it this way: “Governance determines who scales and who stalls”.

Microsoft organises the work in three blocks: remediating oversharing, setting stable guardrails, complying with AI regulations. In the setup guide you start from the hundred most used sites, with the SharePoint Advanced Management permissions report (included, according to Microsoft, in the Copilot licence). Until the risky sites are fixed, you hide them from Copilot with Restricted Content Discovery and apply Purview DLP rules; then the owners review access and remove links open to the whole organisation. For Microsoft this foundation is strongly recommended, not mandatory: putting it in place before you widen is our choice, and the one we bring to our tenant governance and security service.