Copilot readiness on Business Premium, without the reports everyone tells you to run

You have 150 seats on Microsoft 365 Business Premium. Someone on the board asked about Copilot, you have budget approval moving, and you did the responsible thing: you read the readiness guidance. Run the Content Management Assessment. Work the Data Access Governance reports. Find the sites shared with “Everyone except external users.” Fence the worst ones with Restricted Content Discovery while you clean up.

So you sign in to the SharePoint admin center, expand Reports, and Data access governance is not there. Neither is Advanced Management in the navigation pane. You check your role assignments. You check whether someone hid the menu. You start googling whether there is a preview toggle.

There is no toggle. Those features belong to SharePoint Advanced Management, and Microsoft’s prerequisites page for SAM lists the base subscriptions that qualify. Business Premium is not one of them.

Does Microsoft 365 Business Premium include SharePoint Advanced Management?

No. Microsoft’s SAM prerequisites page states that your organization must have one of the following base licences: Office 365 E3, E5, or A5; Microsoft 365 E1, E3, E5, or A5; or Microsoft 365 GCC, GCC-High, or DoD. Microsoft 365 Business Premium is not on that list. The page carries an ms.date of 2026-06-30. Confirm against your own tenant before you plan around it.

That list is the whole story, and it is worth reading the rest of the same page carefully because it sets up the confusion. Underneath the base subscription requirement, Microsoft describes how you get SAM: at least one user in your organization is assigned a Microsoft 365 Copilot licence, or your subscription includes SharePoint K, P1 or P2 and you buy the SharePoint Advanced Management Plan 1 add-on, or you have Microsoft 365 E7.

Read quickly, that second condition looks like a way in. Business Premium includes SharePoint Online Plan 1. But the base subscription list is written as a hard requirement above those alternatives, not as one option among them. The add-on path reads as an alternative to holding a Copilot licence, not as an alternative to holding an enterprise base licence.

I have not found a Microsoft page that resolves that ambiguity either way. If you want to settle it for your own tenant, open the Microsoft 365 admin center, go to Billing → Purchase services, and search for SharePoint Advanced Management. If the add-on is offered against your subscription, buy one seat and see whether the SharePoint admin center lights up. If it is not offered, you have your answer, and it took ten minutes.

What does Copilot Business actually get you, and what is the 300-seat limit?

Copilot Business is the SMB add-on. Per Microsoft’s Copilot Business FAQ, it is available to organizations with 300 or fewer users holding a Microsoft 365 Business Basic, Business Standard, or Business Premium plan, and it supports up to 300 seats per tenant. On product capability, the FAQ is direct: “The Copilot Business add-on delivers the same capabilities as the Microsoft 365 Copilot offering.”

That statement is about what Copilot does for users. It says nothing about the SharePoint admin tooling, and the SAM prerequisites page is where the admin tooling is defined.

Two commercial terms matter for your decision timing. Copilot Business is annual commitment only, with monthly or annual billing and no month-to-month option. And the FAQ is explicit that you cannot upgrade to an Enterprise plan from Business Standard or Business Premium with Copilot Business mid-term. You wait until your commitment end date. So if you sign a Copilot Business agreement this quarter and later decide you want SAM, you are locked out of the E3 path for a year.

Canadian list pricing, checked on microsoft.com/en-ca on 3 August 2026: Business Premium is CAD $29.80 per user per month paid yearly, Copilot Business is CAD $28.50 per user per month with a promotional CAD $24.43 running from 1 July to 30 September 2026 and applying to the first year only, and Business Premium with Copilot is sold as a bundle at CAD $43.40.

Put those last two side by side before you sign anything. Business Premium plus the Copilot Business add-on is $58.30 per Copilot user. The Business Premium with Copilot bundle is $43.40 for what Microsoft’s own page describes as work-grounded Copilot in Word, Excel, PowerPoint, Outlook and Teams. Neither route gets you SAM, so it does not change the argument below, but it is $14.90 a seat and the two SKUs sit on different pages of microsoft.com.

The five things the reports would have told you

Before you replace something, name it precisely. Across the Content Management Assessment and the Data Access Governance reports, this is the target list:

1. Site permissions baseline. A snapshot of the permission structure across every SharePoint and OneDrive site, ranked by breadth of access, so you can see which sites are reachable by thousands of users.
2. “Everyone except external users” grants. Where EEEU or Everyone is a recipient, at site, group, folder and file level, including the parent group when access is indirect.
3. Sharing links. Anyone links, People in your organization links, and Specific people links shared externally, created in the last 28 days.
4. Sensitivity label coverage on files. Which sites contain files carrying which labels. Microsoft’s own table of SAM features included in Copilot licences marks this row “Requires E5 or G5,” so it is gated twice over.
5. Ownership and lifecycle gaps. The site ownership policy flags sites that fall below a minimum owner or admin count you set. The inactive site policy flags sites with no activity across SharePoint, Teams, Exchange and Viva Engage over an inactivity period you also set, and can drop them to read-only or archive them.

Items 1, 2, 3 and 5 you can rebuild by hand. Item 4 you mostly cannot, and it matters less than you would think on Business Premium, for reasons in the licensing section below.

How do you find “Everyone except external users” grants without the report?

Two modules. The SharePoint Online Management Shell gives you the tenant-wide site list and the sharing controls. PnP PowerShell walks each site’s groups and role assignments.

Since 9 September 2024 PnP PowerShell requires your own Entra app registration, so -ClientId is mandatory on interactive connections. Run Register-PnPEntraIDAppForInteractiveLogin once, keep the app ID, or set it as an ENTRAID_CLIENT_ID environment variable. The similarly named Register-PnPEntraIDApp is the app-only registration, for unattended runs, and it is not what the script below wants.

The EEEU and Everyone principals show up in SharePoint as claims. In SharePoint Online the “Everyone except external users” login name follows the pattern c:0-.f|rolemanager|spo-grid-all-users/<GUID>, where the GUID is normally your tenant ID, and the classic Everyone claim is c:0(.s|true. Microsoft does not document those strings in a product article, so match on the substring rather than an exact value.

Connect-PnPOnline -Url "https://contoso-admin.sharepoint.com" -Interactive -ClientId $appId

$sites = Get-PnPTenantSite | Where-Object { $_.Template -notlike "SPSPERS*" }
$hits  = New-Object System.Collections.Generic.List[object]

foreach ($site in $sites) {
    try {
        Connect-PnPOnline -Url $site.Url -Interactive -ClientId $appId

        # Path 1: EEEU sitting inside a SharePoint group
        foreach ($group in Get-PnPGroup) {
            $members = Get-PnPGroupMember -Group $group
            foreach ($m in $members) {
                if ($m.LoginName -like "*spo-grid-all-users*" -or $m.LoginName -eq "c:0(.s|true") {
                    $hits.Add([pscustomobject]@{
                        Site = $site.Url; Via = "Group: $($group.Title)"; Claim = $m.LoginName
                    })
                }
            }
        }

        # Path 2: EEEU granted directly on the web
        $web = Get-PnPWeb -Includes RoleAssignments
        foreach ($ra in $web.RoleAssignments) {
            $member = Get-PnPProperty -ClientObject $ra -Property Member
            if ($member.LoginName -like "*spo-grid-all-users*" -or $member.LoginName -eq "c:0(.s|true") {
                $hits.Add([pscustomobject]@{
                    Site = $site.Url; Via = "Direct on web"; Claim = $member.LoginName
                })
            }
        }
    }
    catch { Write-Warning "$($site.Url): $($_.Exception.Message)" }
}

$hits | Export-Csv .\eeeu-hits.csv -NoTypeInformation

On a 200-site tenant this runs in roughly 25 to 45 minutes, most of it spent on the per-site connection handshake rather than the queries. Add a site collection admin sweep first if you are not already an admin on every site, because the loop will throw 403s on the ones you are not.

Be honest with yourself about what this misses. It catches EEEU at the site and site-group level. It does not walk every list, folder and file with broken inheritance, which is exactly what the SAM “Sites and files shared via special SharePoint groups” report does, down to item level with a ParentGroupName column telling you how access was granted. A file dropped in a library and shared to Everyone by one person in 2021 will not appear in the output above.

That gap is real and you should plan around it rather than pretend the script closes it. In practice the site-level sweep finds the sites, and once you know which sites are affected you can walk their libraries individually. That is a tractable job for ten sites and an intractable one for two hundred, so cut the list down hard before you start.

How do you find and kill “Anyone” links without the sharing links report?

The SAM cmdlet is Start-SPODataAccessGovernanceInsight with -ReportEntity SharingLinks_Anyone. Its documentation states plainly that a SharePoint Advanced Management licence is required to run these reports, so on Business Premium it is not an option.

PnP can enumerate links per item with Get-PnPFileSharingLink -Identity <server relative path>. That works, and it is genuinely slow, because it is one call per file. A library with 20,000 documents is an overnight job. Do not point it at the tenant. Point it at the ten sites your EEEU sweep flagged, plus anything HR, finance, legal or executive owns.

For everything else, use the blunt instrument, which is often the correct instrument at this size. Anyone links only exist when sharing capability is set to ExternalUserAndGuestSharing. Dropping a tenant or a site below that setting stops new Anyone links from being created and disables existing ones. The documented values are:

# Tenant-wide: stop Anyone links existing at all
Set-SPOTenant -SharingCapability ExternalUserSharingOnly

# Or leave the tenant open and clamp the sites that matter
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/HR" `
            -SharingCapability Disabled

# Kill "People in your organization" links on a specific site
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" `
            -DisableCompanyWideSharingLinks Disabled

DisableCompanyWideSharingLinks is the one people forget. Organization-wide links are internal, so they survive every external sharing setting you apply, and they are a direct route to the same oversharing that EEEU causes. Its settable values are Disabled and NotDisabled, plus an Unknown that appears on read and cannot be written. That is a naming choice which has caught out better admins than me: Disabled means the links are turned off.

Both of those changes are visible to users the moment you make them, so tell people first. This is the step where an unannounced tightening generates twenty tickets on a Monday.

What does Business Premium actually give you that helps?

More than the licensing tables suggest, as long as you are precise about the edges. From the Microsoft Purview service description (ms.date 2026-08-03):

The first and fifth rows together are the practical shape of your job. Copilot honours the EXTRACT usage right on encrypted content, shown in the Purview portal as Copy and extract content(EXTRACT). Grant a user VIEW without EXTRACT and Copilot will not summarize the file for them, though Microsoft is clear that it can still return a link so the user can open it outside Copilot. Manual labels with encryption are included in Business Premium. The alternative control, scoping a Purview DLP policy to Copilot as a location, is not. So on Business Premium, encrypted manual labels are your file-level Copilot control, and there is no fallback behind them.

Worth knowing before you lean on it: the person who applies the encryption is the Rights Management owner and always holds EXTRACT, so content a user encrypted themselves is always eligible to come back to them through Copilot.

That has a consequence people miss. Manual labelling means a human decides, file by file, which is fine for the 200 documents that genuinely matter and impossible for 200,000. Your labelling scope has to be small and chosen deliberately, and the only way to choose it well is to have done the inventory work above first.

Should you buy up, add Purview, or stay put?

For most 60 to 300 seat tenants: stay on Business Premium and spend the difference on the cleanup. The arithmetic is not close.

The comparison below assumes 150 base seats and 50 Copilot seats, Canadian list pricing checked 3 August 2026, annual commitment. Currency and terms will differ through a CSP.

Option C costs roughly CAD $48,900 a year more than option A, and what that money buys is reporting and a pair of per-site controls. It does not fix a single permission. You would still do all the remediation work described above, you would just find the problems faster.

Option B is the one that gets mispitched. The Purview service description names two add-ons here, Microsoft Purview Suite for Business Premium and Microsoft Defender + Purview Suite for Business Premium, and attaches the same two conditions to both: they require a Microsoft 365 Business Premium base licence and they are capped at 300 seats total. The Canadian add-on page lists the combined Defender and Purview Suites for Business Premium at CAD $20.40 per user per month paid yearly, which is the figure in row B. Priced across 150 seats rather than only the Copilot users, because the labelling rights are per user.

It does close the auto-labelling, Copilot-DLP and Audit (Premium) rows in the table above, and those are real gaps. It does not grant SharePoint Advanced Management, and nothing on the SAM prerequisites page moves because you bought it. If a reseller offers it as the answer to “our DAG reports are missing,” that is the wrong product.

Buy up to E3 when the reporting genuinely pays for itself: several hundred sites, more than one admin, a compliance obligation that requires per-item permission evidence, or a growth path past 300 seats that ends the Copilot Business option anyway. Below that, option A plus a disciplined manual pass is the better trade.

How long does the manual pass take for 60 to 300 seats?

Order matters. You cannot triage what you have not inventoried, and you cannot label sensibly until you know what is overshared.

Call it 45 to 65 hours of admin time over six to eight weeks. Almost none of that is script runtime, and the scripting itself is about a day.

The stall is step four, every time, and it is not a technical problem. Deciding whether the 2019 “Company Wide” site should still be readable by everyone is a business decision, and a single admin cannot make it. They will send an email to a site owner who left in 2023, get no reply, and the project sits there. Identify the human decision-maker for each of your ten sites before you start the sweep, not after. If you cannot name one, that site’s answer is “lock it and see who complains,” and you should agree that rule with your leadership in advance.

The rest of the sequence is covered in more depth in turn on Copilot without leaking your HR folder, and if you are doing this alongside a tenant move, permissions cleanup before migration is the same work at a better moment to do it.

Two numbers are worth taking into your next budget conversation. The reports cost about CAD $49,000 a year for 150 seats. The cleanup they would have accelerated costs about 55 hours. Before you argue either one, run the EEEU sweep. It takes an afternoon to write and half an hour to run, and the length of the output settles which number you are actually facing.