AI glossary, in plain English.

Microsoft 365 Copilot is the per-user AI assistant Microsoft sells on top of an existing M365 Business or Enterprise subscription. Once licensed (currently around USD 30 per user per month), it appears inside every Office app and as a standalone chat surface at copilot.microsoft.com signed in as the work account.

The critical detail most buyers miss: Copilot grounds its answers in the user’s permissioned view of SharePoint, OneDrive, Teams, and Outlook. Quality of output is therefore a function of how well the underlying content estate is organised and permissioned. Most rollouts that disappoint do so because of the SharePoint layer, not the AI.

Copilot Studio is Microsoft’s low-code agent-building tool. It replaced Power Virtual Agents and is the right starting point for most SMB agent use cases: customer-service bots, internal knowledge agents, policy lookup agents, expense-claim triage. It can ground in SharePoint, Dataverse, public web, and connected data sources.

Copilot Studio agents are licensed by message pack (currently around USD 200 per 25,000 messages) plus optional generative-AI metering. The build-vs-buy decision against Azure AI Foundry usually turns on whether you need fully custom orchestration and grounding logic, or whether the Studio templates cover 80% of the case.

Azure AI Foundry is the developer-facing counterpart to Copilot Studio. Where Studio targets business builders with a low-code canvas, Foundry targets engineering teams who need full control over model choice, orchestration, evaluation, and deployment. It covers model catalog (OpenAI, Mistral, Phi, plus open-source), prompt flow, evaluation harnesses, and deployment to managed endpoints.

Foundry is the right answer when an agent has custom orchestration logic, multiple grounding sources with conditional logic, regulated data handling, or scale beyond what Copilot Studio messaging packs make economical. Below that threshold, Studio is usually faster, cheaper, and easier to govern.

The Power Platform is the umbrella over Microsoft’s low-code tools: Power Apps for custom business apps, Power Automate for workflow automation, Power BI for analytics, and Power Pages for external-facing portals. AI Builder is the prebuilt AI model layer that drops into any of them — form processing, sentiment, classification, prediction.

For most SMBs already on Microsoft 365, the Power Platform is the highest-leverage layer of the AI stack: it’s often already licensed (via M365 entitlements), it integrates natively with the rest of the estate, and it covers 60–80% of the automation surface that smaller firms would otherwise pay Zapier or similar for.

Purview is the governance layer of the Microsoft estate. The pieces most relevant to AI: sensitivity labels (which Copilot respects), data loss prevention (DLP) policies, the oversharing assessment (which surfaces SharePoint sites where Copilot might leak), and the AI Hub (which monitors prompts sent to Copilot and ChatGPT from managed devices).

Most AI governance work for SMBs starts with Purview because the licensing is usually already in place via M365 E3/E5 or M365 Business Premium. Activating the oversharing assessment and labelling the top 20 crown-jewel libraries is typically the single highest-impact governance move before a Copilot rollout.

SharePoint Premium (formerly Syntex) is the pay-as-you-go AI layer on top of SharePoint Online. It covers document understanding models, content assembly, e-signature, image classification, and translation. It’s licensed by transaction, not by user, which makes it economical for high-volume document workflows but expensive if used as a default.

The most common SMB use cases are contract metadata extraction, invoice processing, and templated proposal assembly. For most firms it sits as an optional add-on rather than a default capability.

A large language model is a transformer-based neural network trained on internet-scale text to predict the next token in a sequence. GPT-4, Claude, Gemini, Llama, and Phi are all LLMs. The model itself does not have memory, opinions, or real-time knowledge — those properties are added by the application built around it.

For SMB buyers, the practical implication is that the model is rarely the differentiator. Two AI products built on the same model can produce very different outcomes depending on the prompt design, grounding sources, governance posture, and adoption mechanics.

RAG is the dominant pattern for building business AI applications. At query time, the application searches a content store (SharePoint, a vector database, a SQL table) for relevant snippets, then includes those snippets in the prompt sent to the LLM. The model uses them as context when generating the answer.

Most enterprise AI assistants — including Microsoft 365 Copilot, most Copilot Studio agents, and most Azure AI Foundry agents — are RAG systems under the hood. The quality of the retrieval (right documents, right chunks, right ranking) usually determines the quality of the output more than the choice of model.

Grounding is what separates a useful business AI assistant from a generic chatbot. A grounded answer cites specific source documents — SharePoint pages, contracts, knowledge-base articles — so the user can verify the claim. Microsoft 365 Copilot grounds in the tenant; Copilot Studio agents ground in whatever connectors you wire up.

Ungrounded generation is appropriate for some tasks (drafting, brainstorming, summarising provided text), but anything that touches a customer, a number, or a policy decision should be grounded. The single biggest source of Copilot-related risk is users treating ungrounded answers as if they were grounded.

Hallucination is the failure mode where an LLM produces output that looks confident and reasonable but is wrong. The model is not lying — it has no concept of truth — it is producing the statistically likely next tokens. When the training data thins out or the prompt is ambiguous, those tokens cease to correspond to reality.

Hallucination cannot be eliminated, only mitigated. Grounding, citation requirements, retrieval quality, verification UI ("show me the source"), and user training all reduce the rate. For SMBs the highest-leverage mitigation is usually training: teach users to verify before they send.

Prompt engineering is the discipline of writing the instructions — system messages, user messages, examples, constraints — that elicit good behaviour from an LLM. For end users it shows up as "the way I ask Copilot for a draft." For builders it shows up as the multi-section system prompt that defines an agent’s persona, scope, refusal behaviour, and output format.

At SMB scale the highest-ROI prompt-engineering work is usually building a shared prompt library: the 30–50 prompts that match how your teams actually work, pinned somewhere visible. It is more durable than chasing model upgrades.

Every LLM has a context window: the upper bound on how much text it can read in one go. Modern models range from around 8,000 tokens to several million. Tokens are roughly three quarters of a word in English.

For business users, the context window is mostly invisible — Copilot and other assistants handle truncation under the hood. For builders it matters: it sets the limit on how many retrieved chunks a RAG pipeline can pass to the model, and it influences cost (more tokens in = more dollars per query).

Tokens are the chunks an LLM operates on: sub-word pieces produced by a tokenizer. "Hello" is one token; "tokenization" is three. As a rough rule of thumb, 1,000 tokens is around 750 English words.

Tokens matter commercially because most pay-as-you-go LLM pricing is per million tokens of input and output. They matter operationally because they define the context window and the upper bound on a single request.

An embedding is a vector — typically several hundred to several thousand floating-point numbers — produced by an embedding model from a piece of text. Texts with similar meanings end up near each other in vector space, which is what makes semantic search work.

Embeddings are the backbone of RAG systems: when a user asks a question, the question is embedded, the system finds the nearest document chunks in vector space, and those chunks are fed to the LLM as context.

Fine-tuning takes a pre-trained base model and continues training it on a smaller, curated dataset. The result is a model that is biased toward the patterns in the fine-tuning data — a specific tone of voice, a specific output format, a specific domain.

For SMBs, fine-tuning is almost always the wrong first answer. RAG, better prompting, and better retrieval will deliver more value at a fraction of the cost and ongoing maintenance burden. Fine-tuning is appropriate when you have stable, repetitive, high-volume use cases where prompt engineering has plateaued.

An AI agent is an application built around an LLM that can take actions, not just generate text. The LLM acts as the reasoning core, deciding which tools to call (search, send email, query a database, trigger a workflow) and in what order, to accomplish a goal stated by the user.

In the Microsoft estate, "agent" most often refers to Copilot Studio agents or Azure AI Foundry agents. The level of autonomy varies enormously — from a chatbot that only retrieves answers, through to an agent that drafts and sends emails on the user’s behalf.

Orchestration is the control flow around an LLM. It decides whether to retrieve documents first, which tool to call next, when to ask the user for clarification, and how to assemble a final answer. In Copilot Studio it’s the topic-and-action graph; in Azure AI Foundry it’s prompt flow or custom code.

For SMBs, orchestration complexity is often the single biggest driver of build-vs-buy decisions. If the orchestration is simple (one retrieval, one answer), Copilot Studio is enough. If it branches across multiple tools, evaluates intermediate output, and may loop, Azure AI Foundry usually wins.

Power Automate is the workflow layer of the Power Platform. It runs scheduled, triggered, and on-demand flows that connect M365 services, Dataverse, third-party SaaS apps, and on-premises systems. Most SMBs use it for things like approval routing, email-to-task automation, document generation, and SharePoint list automation.

In the AI era, Power Automate is the "hands" of Copilot Studio agents — the layer that turns an agent’s decision into an actual action (create a record, send an email, post to Teams). AI Builder plugs into Power Automate to add prebuilt AI models (form processing, sentiment, classification) into flows.

AI Builder is the prebuilt-and-customisable AI models that drop into Power Apps and Power Automate. It covers form processing, object detection, sentiment analysis, language detection, text classification, prediction, and a growing set of generative actions backed by GPT-class models.

For most SMB automation cases, AI Builder is the right starting point because it lives inside flows the team is already building. It’s licensed by credit pack, which makes pilots cheap to start but production economics need a check before scale.

DLP is the cluster of Purview policies that scan content for sensitive patterns (credit card numbers, social security numbers, custom regex) and block, warn, or audit sharing. The same policy engine applies to email, Teams chats, SharePoint, OneDrive, and the AI Hub.

For Copilot rollouts the DLP question is whether sensitive content should appear in Copilot output for users who otherwise have access. Most SMBs handle this with sensitivity labels (which Copilot respects) rather than DLP blocking, because outright blocking interferes with legitimate work.

Sensitivity labels are the user-visible governance primitive in Microsoft Purview. Each label can carry a name, a colour, a set of encryption and sharing rules, and a footer/header. They apply to Word, Excel, PowerPoint, PDF, email, and SharePoint sites.

Critically, Copilot respects sensitivity labels: documents labelled as confidential will not be surfaced in Copilot responses for users who don’t have the relevant permissions. Labelling the top 20 crown-jewel libraries is typically the highest-leverage governance move before launch.

The oversharing assessment is a tenant-level Purview report that scans SharePoint, OneDrive, and Teams for content with anonymous or "everyone except external" sharing, and flags sites where Copilot could surface that content broadly. It’s free, takes about an hour to interpret, and is the single most useful pre-Copilot diagnostic.

A typical SMB tenant has between 5 and 50 sites flagged. The remediation isn’t to fix all of them; it’s to restrict the top five sensitive sites (HR, finance, legal, executive, sales-pricing) before Copilot goes live and let governance maturity catch up over time.

An AI acceptable-use policy is the first document in any minimum-viable AI governance pack. It defines which AI tools are sanctioned, what categories of data can and cannot be put into them, who to contact when something goes wrong, and the consequences of violation.

It should be one page, plain English, and signed by every employee before they get Copilot access. Long policies are not read; the goal is comprehension, not coverage.

The EU AI Act is the EU’s tiered regulatory regime for AI systems. It classifies systems into unacceptable, high, limited, and minimal risk, and imposes proportionate obligations on each. High-risk systems (employment, credit, education, critical infrastructure) attract the most stringent requirements: documentation, human oversight, data governance, transparency.

For most SMBs, the practical impact is around general-purpose AI use (M365 Copilot, ChatGPT) and any deployed systems that touch hiring, lending, or other high-risk domains. Documentation discipline now will save scramble later — obligations phase in through 2025–2027.

Weekly active users is the standard Copilot adoption metric reported in the Microsoft Copilot Dashboard. It’s the percentage of licensed users who triggered at least one Copilot interaction in the trailing seven days.

Industry baseline at three months is around 25–35% WAU. A well-run SMB rollout with a named Champion typically reaches 60%+ by month six. WAU below 40% at month six is the trigger to retire dormant seats and refocus the enablement programme.

Seat reclaim is the highest-ROI admin task in the first year of a Copilot rollout. The Copilot Dashboard exposes per-user activity; users with zero interactions in the trailing 30–60 days are reclaim candidates.

A 20–30% reclaim rate in the first six months is normal. At USD 30 per seat per month, a 30-seat reclaim on a 100-seat rollout returns over USD 10K per year that would otherwise sit dormant.

A Copilot Champion is the person whose actual job it is to make a Copilot rollout work. They run office hours, maintain the prompt library, triage incidents, own the adoption dashboard, and co-own the governance pack with IT and the COO. It is an operational and enablement role, not a technical one.

Below ~50 licensed seats the role can sit inside an existing L&D or operations manager with ring-fenced hours. Above that, the part-time arrangement breaks and a dedicated hire usually pays back inside six months.

Fractional AI leadership is the engagement model where a senior AI practitioner takes on the strategic responsibilities of a CAIO without the full-time cost. They own the roadmap, sit in on vendor calls, run governance reviews, and produce the weekly executive readout.

It’s the right shape for firms running multiple AI initiatives that need a single point of senior accountability but don’t have the volume or budget to justify a full-time CAIO. Typical engagements run 6–12 months and convert into either a full-time hire or a continuing fractional arrangement.

An AI readiness assessment is the diagnostic that should precede any meaningful AI investment. It covers four dimensions: use-case quality (what problem are you actually solving), data and content estate (is it in a fit state for grounding), governance posture (will the auditors be satisfied), and adoption capacity (is there a named owner, are there hours available).

A good assessment ends with a shortlist of two or three use cases, indicative ROI bands, and a recommendation that may well be "not yet." A bad one ends with a proposal to do everything.

AI ROI is the financial business case for an AI initiative. The honest version has four levers: hours saved per user, fully-loaded cost per hour, adoption rate, and the offsetting cost of licences and enablement. Vendor calculators tend to inflate the first two and ignore the last.

A disciplined ROI model survives challenge from the CFO. It uses conservative hour-saving estimates, applies a realistic adoption ramp, and accounts for the enablement and governance overhead. Most credible payback windows for Copilot at SMB scale come out between 4 and 14 months.

The use-case shortlist is the output of any serious AI strategy phase. It compresses dozens of candidate ideas to two to four that will actually be built first — typically the highest-impact, lowest-risk, highest-confidence options.

Shortlists that work share three traits: each item names the team that owns it, each item carries a defensible ROI band, and each item has a written exit criterion that decides whether it scales or gets killed at the checkpoint.