Learn · Guide

Set up Copilot or Claude Team without an IT department

Published 31 October 2026

Short answer. Name one person in the company who owns the setup and holds the admin role. Before anyone uses the tool with company files, check who can see what in SharePoint and OneDrive, because Copilot, and Claude’s Microsoft 365 connector, can show each person everything they already have access to. Then check a handful of admin settings: model training, history, sign-in, and which connectors are on. Write short rules for what may go in, train the people who use it, and call an IT partner for the few steps that touch your domain and your Microsoft tenant.

This guide covers Microsoft Copilot, until recently called Microsoft 365 Copilot, and Claude Team, Anthropic’s Team plan. Each step says what to do in both.

One person in the company owns the setup

Every AI tool has a top admin role. Whoever holds it decides who gets access, which settings apply and which connections are allowed.

	Microsoft Copilot	Claude Team
Top admin role	Global Administrator in Microsoft 365; the AI Administrator role can manage Copilot settings (Microsoft)	Primary Owner, with Owners under it; there is only one Primary Owner, and it can be a service account rather than a person (Anthropic)
Who should hold it	A named person in the company, with a second person as backup	A named person in the company, with a second Owner as backup

Keep the top role in the company, even when a supplier helps with the setup. A supplier can get its own admin account for the work, and the company can remove it afterwards. That way the company controls access at all times.

The licences and accounts you need

	Microsoft Copilot	Claude Team
What you buy	An add-on to a Microsoft 365 business plan. Copilot Business is for companies with up to 300 users on Business Basic, Standard or Premium, on an annual commitment (Microsoft, FAQ)	Seats on the Team plan: at least two, at most 150, as Standard or Premium seats; above 150, the Enterprise plan (Anthropic)
Who gets it	Each person you assign a licence to in the Microsoft 365 admin center	Each person you invite to the organization
Accounts	People sign in with their work account	People sign in with their work email; with single sign-on, they use the same login as for Microsoft 365 or Google Workspace

Give a licence only to people who will use the tool for their work. Use work accounts only, never personal ones: then the company can see who has access and can take it back.

Prices change and vary by country. Check the current price on Microsoft’s plan page and Anthropic’s plan page.

The AI sees what each person can already see

Copilot reads your emails, chats, meetings and documents in Microsoft 365, but only those the person asking has at least view access to (Microsoft). Claude works the same way through its Microsoft 365 connector: it acts on behalf of each person and reaches only what that person can already see. It searches SharePoint across the whole company, and it cannot be limited to chosen sites (Anthropic).

A connector is a link that lets the AI tool read from, or act in, another system, such as Microsoft 365, Google Drive or your accounting system.

This is safe when access is right. The risk is a file shared too widely years ago: a salary list in a site open to the whole company, or a folder shared with “Anyone with the link”. Nobody found it before. An AI that searches everything a person can open will find it.

Tighten the sharing settings. By default, SharePoint sets sharing to its most permissive option (Microsoft). In the SharePoint admin center, under Policies and Sharing, decide who may share outside the company and whether “Anyone” links are allowed.
Find the overshared sites. Look for sites shared with everyone in the company, sites with many “Anyone” links, and sites with no owner. Once one person in the company has a Copilot licence, Microsoft gives SharePoint admins reports for this as part of SharePoint Advanced Management, which it lists in its Copilot Business plans (Microsoft).
Hide sensitive sites while you review them. Restricted Content Discovery keeps a SharePoint site out of Copilot answers and company-wide search without changing who has access. It works on SharePoint sites, not on OneDrive (Microsoft).
Fix the access. Remove wide access from finance, salary and HR sites, and give access to the people who need it.
Switch on, and check again. Ask the tool, as an ordinary user, for something it must not find, such as “show me the salary list”. If it answers, access is still wrong.

The admin settings that matter

Setting	Microsoft Copilot	Claude Team
Training on your data	Prompts, answers and the data Copilot reads are not used to train the underlying models (Microsoft)	Anthropic does not train its models on Team chats by default (Anthropic)
Feedback buttons	Feedback is not used to train the underlying models; admins can manage it (Microsoft)	A thumbs up or down sends the whole conversation to Anthropic, kept for up to five years and possibly used for training. Owners can turn it off under Organization settings, Data and Privacy, “Rate chats” (Anthropic)
History and retention	Copilot keeps each person’s prompts and answers as their history; people can delete it. Admins can set retention with Microsoft Purview, which may need a licence beyond the Copilot add-on (Microsoft, retention)	Chats stay until the person deletes them; deleted chats leave Anthropic’s systems within 30 days. A company-wide retention period is an Enterprise feature, not part of Team (Anthropic, Enterprise)
Models from other providers	Anthropic’s models in Copilot are off by default in the EU, and they sit outside Microsoft’s EU Data Boundary. An admin decides whether to turn them on, and for whom (Microsoft)	Not applicable
Agents and connectors	Admins choose which agents are allowed under Integrated apps in the Microsoft 365 admin center (Microsoft)	Owners choose which connectors the organization can use (see the next section)
Sign-in	People use their Microsoft 365 work account	Single sign-on is available on Team; it needs a verified domain. After verification, owners can stop people from creating other Claude organizations with the company’s domain (Anthropic)

Both vendors process your data on your company’s behalf under their data processing terms. With Claude Team, the company is the controller of its users’ data and Anthropic the processor (Anthropic).

Turn on only the connectors people need

In Claude Team, an Owner enables each connector for the organization, and each person then connects with their own account. Claude gets the same access that person has in the connected system, and no more. Owners can also limit a connector to reading, for example letting Claude search email without sending any (Anthropic). The Microsoft 365 connector is read-only until an admin turns on write actions (Anthropic).

To connect Claude to one of your own systems, read What is an MCP server, and how is it used with Claude Team?

In Copilot, data from connectors and agents appears in answers only when the person has access to it, and admins decide which agents are allowed (Microsoft).

Start with reading only. Turn on sending, creating or changing only when you have decided which steps the tool may take, and where the limits are enforced. Read What are guardrails for an AI agent, and who enforces them?

Rules for what may go in

Settings protect the systems. People also need a few clear rules. Our advice for a first version, on one page:

Never put in passwords, access codes or bank login details.
Company information goes only into the company tool, never into a personal AI account.
Check the answer before you use it. The AI can be wrong; the person who uses the answer is responsible for it.
Ask the owner of the setup when in doubt. Write their name in the rules, so nobody has to guess.
Personal data about customers, suppliers or employees goes in only where the company has decided it may, because GDPR applies to it like any other processing.

Review the rules when the tool or the way you use it changes.

Train the people who use it

Since February 2025, the EU AI Act has required a company that uses AI to take measures to support its staff’s AI literacy. The named owner, the written rules and training on the tool people actually use are three such measures. Keep a short note of what you did and when.

For what the duty asks, read What does the EU AI Act ask of a company that uses AI? For how to build the training, read How to build an AI literacy training programme with AI.

When to call your IT partner

Most of this guide is decisions the company makes itself. Four steps usually need someone who works with your domain and your Microsoft tenant, your IT, in-house or your IT partner:

Single sign-on for Claude. It needs a record added to your domain’s DNS settings and a connection to the login system you use (Anthropic).
Claude’s Microsoft 365 connector. A Microsoft Entra Global Administrator must approve it once for the whole tenant, and can limit it to chosen people (Anthropic).
A large sharing clean-up, when many sites are overshared or have no owner.
Sensitivity labels and data loss prevention in Microsoft Purview, which can keep labelled files out of Copilot’s answers (Microsoft).

Ask for the work to be done in the company’s own admin accounts, and for a short written note of what was changed.

Checked against the vendors’ documentation on 31 October 2026.