If your not-for-profit runs Microsoft 365, the Microsoft 365 Copilot app is about to land on your staff and volunteer PCs whether you asked for it or not. Microsoft is resuming an automatic rollout it had briefly paused, pushing the app onto eligible Windows devices that already run the Microsoft 365 desktop apps between mid-June and mid-July 2026 — and it arrives quietly through the Office updater rather than the Windows Store. As reported by Windows Latest, admins have to actively opt out or the app simply appears; the toggle lives in the Microsoft 365 Apps admin center.

The part that matters for NFPs isn’t the new icon — it’s what Copilot can see. Copilot only surfaces data a person already has access to, and that’s exactly the problem. In the not-for-profit environments we look after, years of “just share it with everyone so people can find things” have left SharePoint sites, Teams channels and shared mailboxes far more open than anyone realises. Donor lists, beneficiary case notes, board papers and payroll spreadsheets that were technically reachable but practically buried suddenly become findable in plain English by anyone who can type a question. High volunteer turnover and lean IT make that worse, not better.

Why it matters: if your organisation’s turnover is above $3 million you have Privacy Act obligations over that information, and “a volunteer asked Copilot and it handed back a list of at-risk clients” is precisely the kind of disclosure that becomes a notifiable breach. Even under that threshold, donor and beneficiary trust is the one asset a charity can’t simply buy back.

What to do: decide now whether you actually want Copilot live across the organisation, and set the opt-out before the rollout reaches your devices if you’re not ready. Then, either way, treat this as the nudge to review who can really see what in Microsoft 365 — before Copilot makes it easy to find. If you’d like a hand rolling Copilot out safely, that’s the kind of thing we do for not-for-profits, alongside compliance and data governance.