When you launch Copilot for Microsoft 365 in a pilot group, you expect it to answer questions based on your tenant’s emails, documents, and calendar entries. Instead, it returns generic web results or says it cannot find any information from your organization. This failure is almost always caused by a missing or misconfigured data source permission in the Copilot setup. This article explains why Copilot cannot see your work data and provides the exact steps to restore access to your Microsoft Graph content.
Key Takeaways: Restoring Tenant Data Access for Copilot
- Microsoft 365 admin center > Copilot > Data sources: This setting controls whether Copilot can read Microsoft Graph data for grounded responses. If disabled, Copilot returns only web content.
- Copilot > Settings > Plugins > Microsoft Graph connector: You must enable this plugin for each pilot user. Without it, Copilot cannot search your SharePoint, OneDrive, or Exchange data.
- Azure AD > Enterprise applications > Microsoft Copilot Service: The Copilot service principal must have the correct delegated permissions granted. Missing permissions cause silent data access failures.
Why Copilot Returns No Work Data in a Pilot Group
Copilot for Microsoft 365 uses the Microsoft Graph API to retrieve data from your tenant. When a pilot group member asks a question, Copilot queries Graph for relevant emails, documents, and calendar items. If the Graph connector plugin is disabled or the Copilot service principal lacks the proper delegated permissions, the query returns empty results. Copilot then falls back to generic web content or displays a message that it cannot find work data.
The three most common root causes are:
Missing Microsoft Graph Connector Plugin
Each pilot user must have the Microsoft Graph connector plugin enabled in their Copilot settings. This plugin is the bridge between Copilot and your tenant data. If it is turned off, Copilot cannot access any SharePoint, OneDrive, or Exchange content regardless of other permissions.
Disabled Tenant Data Source
In the Microsoft 365 admin center, a global administrator or Copilot administrator must enable the tenant data source. When this setting is off, Copilot treats all requests as anonymous and returns only public web results.
Insufficient Service Principal Permissions
The Microsoft Copilot Service enterprise application in Azure AD must have the delegated permissions for Mail.Read, Files.Read.All, and Calendars.Read. If these permissions are missing or revoked, Copilot cannot read user data even when the user is licensed.
Steps to Restore Work Data Access for Copilot
- Enable the Microsoft Graph connector plugin for each pilot user
Open Copilot in Microsoft Teams, Outlook, or the web app. Click the Copilot icon in the top-right corner to open the Copilot pane. Select Settings from the pane menu. Choose Plugins. Locate the Microsoft Graph connector plugin and toggle it to On. Repeat for every pilot user. This step must be done per user because plugin settings are individual. - Enable the tenant data source in the admin center
Go to the Microsoft 365 admin center at admin.microsoft.com. In the left navigation, expand Settings and select Org settings. Scroll down and click Copilot. On the Copilot settings page, select Data sources. Under Tenant data, toggle the option Allow Copilot to access organizational data from Microsoft Graph to On. Click Save. This change applies to all licensed users within 15 minutes. - Verify and grant Microsoft Copilot Service permissions in Azure AD
Open the Azure portal at portal.azure.com. Navigate to Azure Active Directory > Enterprise applications. Search for Microsoft Copilot Service and select it. Click Permissions in the left menu. Review the list of delegated permissions. Ensure Mail.Read, Files.Read.All, and Calendars.Read are listed with a status of Granted. If any are missing, click Grant admin consent and select the required permissions. Confirm by clicking Accept. Wait 30 minutes for the permissions to propagate. - Confirm pilot user licenses are active
In the Microsoft 365 admin center, go to Billing > Licenses. Select Copilot for Microsoft 365. Verify that each pilot user has an assigned license with a status of Active. If a license is expired or unassigned, assign a new one. Copilot will not access any data for unlicensed users. - Test with a simple data-specific query
Ask Copilot a question that can only be answered with tenant data, for example: Find the latest document shared by John Smith about the Q3 budget. If Copilot returns a document title or a summary, the configuration is correct. If it returns a web search result, recheck the previous steps.
If Copilot Still Has Issues After the Main Fix
Copilot Returns Generic Output Instead of Tenant-Specific Data
If you completed all the steps above but Copilot still returns web results, the problem is likely a cached browser session. Have the pilot user sign out of all Microsoft 365 apps, clear their browser cache, and sign back in. In Microsoft Edge, go to Settings > Privacy, search, and services > Clear browsing data. Select Cached images and files and Cookies and other site data, then click Clear now. Restart the browser and test Copilot again.
Copilot Shows an Error Message About Data Access
An error message such as Copilot cannot access your organization’s data indicates a permissions propagation delay. After granting permissions in Azure AD, wait up to 60 minutes. If the error persists, check the Microsoft 365 Service Health dashboard for any ongoing incidents with the Copilot service. Go to admin.microsoft.com > Health > Service health and look for Copilot under Microsoft 365 suite.
Only Some Pilot Users See Work Data
This symptom points to an incomplete rollout of the Graph connector plugin. Ask the affected user to open their Copilot settings and verify the plugin is enabled. If it is enabled but still not working, remove the user from the pilot group and add them again. This action triggers a fresh provisioning of the Copilot service for that user.
Copilot Pilot Group vs Full Rollout: Key Differences
| Item | Pilot Group | Full Rollout |
|---|---|---|
| License assignment | Assigned to a subset of users | Assigned to all eligible users |
| Graph connector plugin | Must be enabled manually per user | Can be enabled via group policy or admin script |
| Data source setting | Same tenant-level toggle applies | Same tenant-level toggle applies |
| Permission propagation time | Up to 60 minutes after grant | Up to 60 minutes after grant |
| Troubleshooting complexity | Higher because of per-user plugin settings | Lower because of centralized management |
After completing the steps in this article, your Copilot pilot group should be able to see emails, documents, and calendar data from your tenant. To confirm the fix works for all members, ask each pilot user to run the test query from step 5. If you plan to expand Copilot to your entire organization, consider automating the Graph connector plugin enablement using a PowerShell script or a group policy setting in Microsoft Intune.