Updated 8 October 2026: Microsoft is retiring Restricted SharePoint Search, so this post now points to Restricted Content Discovery and SharePoint Advanced Management instead.
Microsoft 365 Copilot Wave 3 deployment in an Australian tenant is not a licensing exercise. It is a three-pillar readiness exercise: licensing and assignment, tenant pre-flight, and change and adoption. This playbook walks through the prerequisites Microsoft Learn publishes for Copilot. It then layers the Wave 3 feature controls announced on 9 March 2026, and adds the Australian regulatory context every IT leader must document before assigning the first licence.
Why the deployment playbook changed in 2026
Microsoft has refreshed its Copilot deployment guidance several times since the November 2023 general availability release. The current Microsoft Learn article "Get started with your Microsoft 365 Copilot deployment", refreshed in February 2026, structures the deployment journey around three phases: prepare your environment, assign licences, and drive adoption. (Microsoft Learn — Set up Microsoft 365 Copilot and assign licenses, accessed 16 June 2026). The Microsoft 365 Copilot setup checklist, also refreshed in February 2026, is the tenant-side companion to that journey. (Microsoft Learn — Minimum requirements to deploy Microsoft 365 Copilot, accessed 16 June 2026).
The prerequisites themselves have been stable since late 2024. What changed in 2026 is the volume of post-deployment exposure an organisation accumulates when any prerequisite is skipped. Wave 3, announced by Microsoft on 9 March 2026 in the blog post "Powering Frontier Transformation with Copilot and agents", adds Researcher, Analyst, and Work IQ as new surfaces. Each one creates a fresh data-access pattern that must be governed from day one. An Australian tenant that assigns Copilot licences before completing tenant pre-flight is not just under-prepared. It is materially exposed under the amended Privacy Act 1988. (oaic.gov.au — The Privacy Act, accessed 16 June 2026).
Pillar one: licensing and assignment
Microsoft Learn lists three eligible base licences for Microsoft 365 Copilot: Microsoft 365 E3, Microsoft 365 E5, and Microsoft 365 Business Premium. Frontline worker SKUs (F1 and F3) do not qualify. (Microsoft Learn — License options for Microsoft 365 Copilot, accessed 16 June 2026). The Copilot add-on is a separate SKU at USD $30 per user per month for the enterprise tier, with the Copilot Business variant launched on 1 December 2025 at USD $21 per user per month (USD $18 promotional through June 2026) for organisations with fewer than 300 users on a Business Basic, Standard, or Premium base.
For Australian organisations, the licensing maths is rarely a single number. The companion how-to Copilot licensing maths for Australian organisations walks through the full per-seat AUD cost build. It covers the base SKU uplift, the Copilot add-on, the Microsoft 365 E7 Frontier Suite at AUD $99 per user from 1 May 2026, Agent 365 at AUD $15 per user from 1 May 2026, and the 2025 SharePoint Advanced Management bundling change. The five line items below are the minimum the finance team needs in the cost model.
| Line item | Source | Notes |
|---|---|---|
| Base licence uplift (if any) | Microsoft 365 admin centre pricing | E3 → E5 uplift, or Business Standard → Premium |
| Copilot add-on | Microsoft 365 Copilot product page | USD $30 per user per month enterprise; USD $21 SMB |
| Microsoft 365 E7 Frontier Suite | Microsoft 9 March 2026 announcement | AUD $99 per user per month from 1 May 2026 |
| Agent 365 | Microsoft 9 March 2026 announcement | AUD $15 per user per month from 1 May 2026 |
| SharePoint Advanced Management | Microsoft 2025 bundling announcement | Now bundled with Copilot; previously separate |
A defensible 36-month AUD cost model is the gate the finance team signs at the end of pillar one. Without it, Copilot rollouts repeatedly stall when renewal or expansion seats are needed.
Pillar two: tenant pre-flight
Tenant pre-flight is the single area where Australian deployments most often fail. Microsoft's Copilot setup checklist groups pre-flight into identity and access, information protection, and search and content governance. Each of these has a non-negotiable control set for an Australian tenant.
Identity and access
Three controls are non-negotiable here. Entra ID with multi-factor authentication for every Copilot user. Conditional Access policies that scope Copilot invocation by location and device compliance. (Microsoft Learn — Conditional Access overview, accessed 16 June 2026). Privileged Identity Management for any administrator who can change Copilot tenant settings. The ACSC Information Security Manual treats multi-factor authentication as a baseline control for all privileged operations. (cyber.gov.au — Information Security Manual, accessed 16 June 2026). Assigning a Copilot licence to a user without enforced multi-factor authentication is no longer a defensible configuration.
Information protection
Information protection rests on three building blocks. Microsoft Purview sensitivity labels deployed across SharePoint, OneDrive, Exchange, and Teams. Data Loss Prevention policies that include the Microsoft 365 Copilot location, available since late 2024. Microsoft Purview Data Security Posture Management for AI (DSPM for AI), generally available since 2025. Microsoft Learn notes that sensitivity labels are how Copilot enforces information-rights management at response time. (Microsoft Learn — Data, Privacy, and Security for Microsoft 365 Copilot, accessed 16 June 2026). Without labels deployed, every Copilot response treats source content as fully accessible to the prompting user.
Search and content governance
SharePoint Advanced Management, now bundled free with Microsoft 365 Copilot, provides the data access governance reports that surface overshared sites, site access reviews, Restricted Content Discovery and Restricted Access Control. (Microsoft Learn — Get ready for Microsoft 365 Copilot with SharePoint Advanced Management). Microsoft's December 2024 announcement of SharePoint Advanced Management bundling was the practical signal that oversharing analysis is now an explicit deployment prerequisite, not a remediation step.
Australian-specific overlay
Australian tenants add two prerequisites that do not appear in Microsoft Learn. First, an Australian Privacy Principle 8 position covering cross-border disclosure for any Copilot subprocessor outside Australian residency boundaries. Copilot Cowork via Anthropic Claude is the prominent 2026 case. Second, a written reference to the Microsoft Australian IRAP letter published on 26 March 2026 at aka.ms/au-irap, citing the Protected-level coverage of Azure, Dynamics 365, Microsoft 365, and Copilot.
Pillar three: change and adoption
Microsoft's Copilot adoption guidance, refreshed in March 2026, structures adoption around three workstreams: a pilot cohort, success metrics, and a champions network. Microsoft Learn documents the recommended pilot size as 50 to 300 users for enterprise tenants and 10 to 100 users for SMB tenants, running for six to eight weeks before any tenant-wide rollout.
The companion how-to Copilot adoption KPIs that survive the first 90 days walks through the KPIs Australian organisations should track: weekly active Copilot users, Copilot Chat invocation rate, sensitivity label coverage of Copilot-touched documents, audit log review cadence, and the count of high-risk prompts flagged by Microsoft Purview Communication Compliance. These five KPIs hold up because a board can defend them against an Office of the Australian Information Commissioner enquiry.
A Wave 3 feature posture is now part of the adoption plan, not a separate exercise. Researcher and Analyst are independently controllable in the Microsoft 365 admin centre. You can stage them into a ring of advanced users without enabling them tenant-wide. Work IQ requires a documented employee disclosure under Australian Privacy Principles 1, 3, and 5 before activation. (oaic.gov.au — Australian Privacy Principles guidelines, accessed 16 June 2026). Most Australian organisations defer Work IQ until the privacy notice is published and acknowledged.
Wave 3 features: what to know before enabling
The 9 March 2026 Microsoft announcement introduced three named Wave 3 features that change the data-access surface of a Copilot tenant.
Researcher
Researcher is a deep-research agent that synthesises across tenant content, public web sources, and connected line-of-business systems. Microsoft Learn documentation refreshed in March 2026 confirms Researcher is admin-toggleable per user and per group. Australian deployments commonly enable Researcher for legal, strategy, and policy teams first, then stage broader enablement after six weeks of pilot data.
Analyst
Analyst extends Excel Agent mode with multi-step analytical workflows over tenant data. It inherits the same Microsoft Purview sensitivity-label boundaries as Copilot Chat. Most Australian deployments treat Analyst as a finance and operations rollout, with explicit guidance that Analyst outputs are draft analyses, not signed-off advice.
Work IQ
Work IQ ingests personal work signals — calendar patterns, communication graphs, document interaction — to personalise Copilot suggestions. Microsoft's product documentation states that Work IQ data is tenant-bounded and not used for model training. The collection itself is still a new category of personal information for Australian Privacy Principle purposes. A written employee disclosure and an updated privacy policy are the minimum controls before activation.
The deployment-versus-governance distinction
This playbook covers deployment prerequisites. It does not cover the steady-state governance posture an Australian organisation must maintain after Copilot is live. The Copilot Governance Maturity scorecard at /copilot-readiness is the companion tool for that work. It scores post-deployment posture across Purview, Data Loss Prevention, agent governance, and Australian Privacy Principle 8 on a five-level maturity scale. Australian organisations need both: a deployment gate and an ongoing maturity gate.
The five evidence artefacts your risk register needs
Before authorising Copilot licence assignment, an Australian risk register should capture five evidence artefacts. First, a 36-month AUD cost model signed by finance. Second, a Microsoft Purview baseline configuration record showing sensitivity labels, Data Loss Prevention, and DSPM for AI status. Third, a SharePoint Advanced Management oversharing report dated within the last 30 days. Fourth, an Australian Privacy Principle 8 position document referencing the 26 March 2026 IRAP letter and naming any subprocessor exclusions such as Copilot Cowork. Fifth, a pilot cohort plan with named success metrics and a six-to-eight-week review cadence.
These five artefacts form the minimum defensible evidence pack for an Australian board discussion or an Office of the Australian Information Commissioner enquiry.
Australian context and compliance
Four developments now line up for Australian Copilot deployments: the amended Privacy Act 1988, the 26 March 2026 IRAP letter, the 1 May 2026 Microsoft 365 E7 and Agent 365 commercial launches, and the Wave 3 feature surface. The reference artefacts exist. The Microsoft Learn deployment guidance has been refreshed. The licensing vehicles are documented.
Organisations operating under the Protective Security Policy Framework, the Information Security Manual, or sector-specific obligations such as APRA CPS 230 and CPS 234 should document Copilot deployment as a discrete change with board-level visibility, not as a routine Microsoft 365 feature enablement.
Related guides
This playbook sits at the centre of a deployment cluster. The companion guides go deeper on each pillar and on the wave history that shaped the current feature surface.
- Copilot licensing maths for Australian organisations builds the 36-month AUD cost model behind pillar one.
- Copilot adoption KPIs that survive the first 90 days sets out the five metrics that defend pillar three to a board.
- Microsoft 365 Copilot Wave 1: what the GA launch meant for Australian organisations covers the permissions inheritance model that still drives tenant pre-flight.
- Microsoft 365 Copilot Wave 2: Pages, agents, and what Australian IT leaders missed explains the agent surface and the Copilot Control System.
- Microsoft 365 Copilot Researcher and Analyst agents details the two Wave 3 features you stage into a controlled ring.
- Microsoft Copilot Wave 3: the complete Australian IT leader briefing frames the governance decisions due before the 1 May 2026 licensing window.
Call to action
Wave 3 deployment is one of the most consequential changes an Australian Microsoft 365 tenant can authorise in 2026. The prerequisites are well-defined and the regulatory context is clear. Score your tenant on the free Copilot Deployment Readiness audit to identify the prerequisite gaps that must close before licence assignment. Then bring a practitioner into the room for a fixed-scope deployment readiness assessment that produces a 30-day remediation roadmap aligned to the ASD Blueprint Required tier.
Sources referenced in this article: Microsoft Learn — Set up Microsoft 365 Copilot and assign licenses, Minimum requirements to deploy Microsoft 365 Copilot, License options for Microsoft 365 Copilot, Data, Privacy, and Security for Microsoft 365 Copilot, Get ready for Microsoft 365 Copilot with SharePoint Advanced Management, and Conditional Access overview. Microsoft, "Powering Frontier Transformation with Copilot and agents" (9 March 2026), "Introducing Microsoft 365 Copilot Business" (1 December 2025), and "SharePoint Advanced Management included with Microsoft 365 Copilot" (December 2024). Microsoft Australian IRAP letter (26 March 2026, aka.ms/au-irap). ACSC Information Security Manual (cyber.gov.au). Office of the Australian Information Commissioner — Privacy Act 1988 and Australian Privacy Principles guidelines (oaic.gov.au, all accessed 16 June 2026).
