Copilot Chat — Your IT Superpower — User Guide

IT-focused Copilot Chat reference guide covering the interface, the GCSE prompting framework, nine demo scenarios across scripting, troubleshooting, KQL, security review, incident management, regex, Bicep, change requests, and on-call situations, plus tips & tricks and custom instructions.

📝 About This Guide
Level: 100-Level — IT Focused
Audience: IT professionals who want to apply Copilot Chat to real-world IT tasks — scripting, troubleshooting, security review, KQL, infrastructure, incident management, and more.
License key: Chat Basic = available to all M365 users  •  M365 Copilot Premium = requires M365 Copilot license
📊
Section 1

What Is Copilot Chat?

Key Concept The Free Version — Already Yours ▼

Copilot Chat (Basic) is included with every Microsoft 365 subscription at no extra cost. Think of it as your AI-powered IT sidekick. No setup. No license. No excuses.

Feature Details
Access m365copilot.com — sign in with your work account
Model GPT-5 with Smart Mode — auto-selects quick answers or deep reasoning
Web search Real-time information and web-grounded answers
File upload PDF, DOCX, XLSX, PPTX, CSV, JSON, LOG, HTML — up to 50 MB each, 3 at a time
Enterprise Data Protection Your data stays within your tenant and is not used for model training
Stats The Numbers Don’t Lie ▼

From the Microsoft Work Trend Index:

Stat What It Means for Your IT Day
1.2 hours saved per person per day 6+ hours per week — back in your schedule
70% faster first drafts Incident reports, change requests, runbooks — faster every time
4x faster data analysis Log analysis, KQL queries, security reviews
85% say it helps get to a good first draft Especially powerful for documentation, RCAs, and communications
🚀
Section 2

What’s New in Copilot Chat

Key Concept Recent & Upcoming Changes ▼
Feature Status Details
GPT-5 with Smart Mode Live Auto-selects between quick answers and deep reasoning
Memory & Work IQ Live Copilot remembers your preferences across sessions
In-App in Word, Excel, PPT Live Copilot Chat side pane embedded inside Office apps
Edit in Copilot Licensed Specialized agents for Word, Excel, PowerPoint
In-App Access Changes Apr 15 2026 In-app Copilot for unlicensed users being adjusted. Bookmark m365copilot.com — always available
💻
Section 3

Know Your Interface

Reference Interface Controls Quick Reference ▼
Control What It Does IT Use Case
+ (Add Content) Upload up to 3 files (50 MB each) Upload log files, JSON configs, CSV alert exports
/ (Reference Files) Pull in SharePoint/OneDrive files directly Reference runbooks or change request templates Licensed
@ (Invoke Agents) Access specialized agents @Interpreter for data analysis, @Planner for tasks
🎤 Voice Dictate prompts hands-free Useful on-call when your hands are at the keyboard
Temporary Chat Private session with no history saved Use when working with sensitive incident data
Prompt Gallery Browse and save prompts Save your best IT prompts to share with the team
🎓
Section 4

The GCSE Framework

Framework Goal · Context · Source · Expectations ▼

The GCSE framework is the 4-part prompt structure that unlocks dramatically better results. The mnemonic: Giraffes Can See Everything.

Giraffes Can See Everything — Goal, Context, Source, and Expectations
Element What It Means IT Example
Goal What you want Copilot to do “Write a PowerShell script…”
Context Background, audience, environment “…to audit inactive AD accounts in a corporate environment…”
Source Error message, config, file, or URL to reference “…using this Terraform config: [paste]…”
Expectations Format, tone, length, output style “…as a numbered checklist with inline comments.”
Exercise GCSE in Practice — Build a KQL Query ▼

Try these two prompts in Copilot Chat and compare the results:

Prompt 1 — Goal Only
Write a KQL query for Sentinel
Prompt 2 — Full GCSE
Write a KQL query for Microsoft Sentinel that finds all failed sign-in attempts from IP addresses outside the United States in the last 24 hours. Use the SigninLogs table and include the username, IP address, country, failure reason, and timestamp. Add comments explaining each clause.
GCSE Element Prompt 2 Mapping
Goal Write a KQL query for Microsoft Sentinel
Context Find failed sign-ins from outside the US in the last 24 hours
Source Use the SigninLogs table
Expectations Include username, IP, country, failure reason, timestamp. Add comments.
🔧
Section 5

What You Already Have

Reference IT Capabilities Available Right Now ▼
Category What Copilot Can Do Examples
Code Generation Write, review, explain, and debug code PowerShell, KQL, Python, ARM templates, Bicep, Terraform, bash
Troubleshooting Analyze error messages, parse logs, identify root cause Azure errors, Event Viewer outputs, application logs
Documentation Summarize, explain, and translate technical docs Runbooks, architecture docs, KB articles, release notes
Communications Draft audience-appropriate communications fast Incident reports, change requests, team updates, RCA templates
🎬
Section 6

Nine Demo Scenarios

All 27 prompts (9 demos × 3 each) are available on the Demo Prompts companion page. Click COPY and paste directly into Copilot Chat.

Demo 1 The Script Wizard — PowerShell AD Audit ▼

Scenario: Generate a PowerShell script to audit inactive AD accounts, add error handling, and send an HTML email summary alert.

Try This (Prompt 1 of 3)
Write a PowerShell script to find all Active Directory accounts that have been inactive for more than 90 days, including their last logon date, department, and manager. Export the results to a CSV file.

Follow up with: “Now add error handling and logging” → then: “Now add email notification with a summary table”

Demo 2 The Troubleshoot Master — Azure RBAC Error ▼

Scenario: Paste an Azure AuthorizationFailed error and get diagnosis, minimum RBAC role comparison, and exact CLI fix commands — in under 60 seconds.

Try This (Prompt 1 of 3)
Explain this Azure error and tell me exactly what went wrong: 'The client with object id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/write' over scope '/subscriptions/xxxxxxxx/resourceGroups/Production-RG/providers/Microsoft.Compute/virtualMachines/WebServer-01' or the scope is invalid.'

Follow up with: “What RBAC role do I need to fix this?” → then: “Write the Azure CLI commands to assign that role and verify it”

Demo 3 The KQL Query Builder — Sentinel Sign-In Analysis ▼

Scenario: Build complex KQL queries from plain English — including time-series analysis and cross-table correlation for password-spray detection.

Try This (Prompt 1 of 3)
Write a KQL query for Microsoft Sentinel that finds all failed sign-in attempts from IP addresses outside the United States in the last 24 hours. Include the username, IP address, location, failure reason, and timestamp.
Demo 4 The Security Reviewer — Terraform Config ▼

Scenario: Paste a Terraform config and get a security review with CIS benchmark violations listed by control number, and remediated code with comments.

See the Demo Prompts page for the full pre-formatted prompt including the Terraform code block.

Demo 5 The Incident Commander — P2 Outage Communications ▼

Scenario: Feed raw incident facts and receive three audience-appropriate outputs: internal stakeholder email, customer-facing update, and an RCA template.

Try This (Prompt 1 of 3)
Draft a P2 incident notification email for internal stakeholders. Here are the raw details:
- Started: 2:47 PM MST today
- Service: Customer portal (portal.contoso.com)
- Impact: ~30% of users getting 503 errors on login
- Cause: Connection pool exhaustion on backend API servers
- Mitigation: Team is scaling up API server instances
- ETA: 45 minutes to full resolution
Demo 6 The Regex Whisperer — Azure Resource ID & Log Parsing ▼

Scenario: Describe what to match in plain English — Copilot generates, explains, provides test strings, and writes a PowerShell one-liner to use it.

Try This (Prompt 1 of 3)
Write a regex pattern that validates Azure resource IDs. It should match the format: /subscriptions/{guid}/resourceGroups/{name}/providers/{namespace}/{type}/{name} — and explain each part of the pattern in plain English so a junior admin can understand it.
Demo 7 The Bicep Builder — Azure Infrastructure as Code ▼

Scenario: Describe your Azure environment in plain English and receive production-ready Bicep with security best practices, diagnostic logging, private endpoints, and deployment commands.

Try This (Prompt 1 of 3)
Write an Azure Bicep template that deploys a secure web application environment with: a VNet with 3 subnets (web, app, data), an App Service Plan on P1v3, a Web App with managed identity enabled, a Key Vault that only the Web App can access, and an Azure SQL database. Follow security best practices throughout.
Demo 8 The Change Request Machine — Exchange Migration ▼

Scenario: From bullet-point facts, generate a full CAB change request document, three stakeholder email templates, and a printable migration night runbook.

Try This (Prompt 1 of 3)
Draft a formal IT change request for our Change Advisory Board. Here are the details:
- What: Migrate on-prem Exchange 2019 mailboxes to Exchange Online
- Who: 500 users in the Sales and Marketing departments
- When: Saturday April 19, 10 PM — Sunday April 20, 6 AM MST
- Why: End of extended support, reduce infrastructure costs
- Risk: Email downtime during migration window, possible Outlook profile reconfiguration

Include sections for: description, business justification, risk assessment, rollback plan, testing plan, communication plan, and approval signatures.
Demo 9 The On-Call Companion — 2 AM Alert Triage ▼

Scenario: Paste simultaneous Azure Monitor alerts at 2 AM — get a ranked triage plan with CLI commands, remediation steps, and post-incident communications.

Try This (Prompt 1 of 3)
I just got paged at 2 AM with these Azure Monitor alerts firing simultaneously:
- High CPU (95%) on 3 of 5 app servers in the web-prod pool
- Memory utilization at 92% on the same servers
- HTTP 5xx error rate spiked to 15% (normal is <0.5%)
- Average response time jumped from 200ms to 4500ms
- No recent deployments in the last 48 hours

What's most likely going on? Walk me through a triage process — what should I check first, second, third? Give me the specific Azure CLI or PowerShell commands to investigate each step.

Follow up with: “Found a runaway SQL query… give me commands to kill blocking sessions, scale up, and create an alert rule”

💡
Section 7

Tips & Tricks the Pros Use

Tips Seven Power-User Secrets ▼
  1. 1Start new chats for new topics — Copilot uses conversation context. Switching topics? Start fresh for better results.
  2. 2Assign Copilot a role — “Act as a senior Azure security engineer explaining this to a junior team member” dramatically changes depth and tone.
  3. 3Use / to reference files — Type / in the prompt bar to pull in specific documents without leaving the app. Licensed
  4. 4Refine, don’t just create — “Simplify this for a non-technical manager” or “Rewrite this as a bulleted runbook” is powerful.
  5. 5Build a team prompt library — Share your best IT prompts with colleagues. Adoption skyrockets when prompting is a team sport.
  6. 6Use GCSE on every prompt — Even adding one element (Context or Expectations) dramatically improves output quality.
  7. 7Stay close to the roadmap — Microsoft ships Copilot updates monthly. Track what’s new at aka.ms/CopilotBlog.
⚙️
Section 8

Custom Instructions

Key Concept Set It and Forget It ▼

Custom Instructions are persistent preferences that shape every Copilot response — you set them once and never repeat yourself. Access them via Settings → Personalization.

Category What It Controls
Thinking Style Think deeply, verify facts, avoid cascade errors, ask when uncertain
Source Discipline Cite sources, flag unverified claims, never fabricate
Formatting [Verified], [Inference], [Confidence], [Sources], [Glossary] labels
Tone Professional, action-oriented, empathetic; adapts internal vs. external
Shortcuts #s = Summarize  •  #i = Improve  •  #e = Translate to English  •  #f = Translate to French  •  #esp = Translate to Spanish

See the Custom Instructions section below for the full copyable blocks.

📎
Bonus Material

Working with Files

Chat Basic — File upload works in Copilot Chat. M365 Copilot Premium adds direct file referencing from OneDrive/SharePoint via the / command.

How To How to Attach a File ▼
  1. 1 Click the + (plus) icon in the Copilot Chat prompt bar
  2. 2 Browse OneDrive, SharePoint, or upload from your device
  3. 3 Select your file — it appears as a badge above the prompt bar
  4. 4 Type your question and press Enter

Supported types: Word • PDF • PowerPoint • Excel • TXT • Images • CSV • JSON • LOG • HTML
File size limit: Up to 50 MB per file, 3 files at a time.

Cheat Sheet IT File Prompts Cheat Sheet ▼
What You Want Try This Prompt
Analyze a log file “Analyze this log file. Summarize the top 5 errors and suggest a root cause for each.” [attach .log]
Review a config “Review this configuration file for security misconfigurations and best practice violations.” [attach .json or .tf]
Explain a script “Explain what this PowerShell script does, line by line, in plain English.” [attach .ps1]
Parse CSV data “Summarize this data, identify trends, and flag any anomalies.” [attach .csv]
Compare two configs “Compare these two configuration files and list every difference that could affect security or performance.” [attach 2 files]
💡
Bonus Material

Top 10 Power User Tips

Tips Become a Power User ▼
  1. 1Be specific — include audience, tone, and format in your prompt
  2. 2Iterate — if the first response isn’t right, refine it
  3. 3Always review — verify code and facts before running or distributing Copilot output
  4. 4Use follow-up questions — Copilot remembers context within a session
  5. 5Try “What else?” — ask Copilot to expand, add edge cases, or suggest error handling
  6. 6Name your audience — “Write this for a non-technical CIO” changes everything
  7. 7Ask for options — “Give me 3 approaches to fixing this with trade-offs”
  8. 8Use it for brainstorming — “What are 10 ways to harden this configuration?”
  9. 9Check privacy — follow your organization’s AI usage policy for sensitive data and credentials
  10. 10Share what works — contribute your best IT prompts to a shared team library
🚀
Bonus Material

Advanced Prompt Tips

Tip 1 Force Plain Text / Code Block Output ▼

Add this to the end of any script prompt for clean, copy-ready output:

Prompt Suffix
Output the results only as a block of plain text. Do not include any other text. Always treat the block of plain text as a block of code that uses text as the code language. Always include a copy button to copy the contents of the box. Do not include sources.
Tip 2 Retrieve Your Resultant Prompt ▼

Running out of turns? Ask Copilot to consolidate everything so you can continue in a new chat:

Prompt
What is the resultant prompt so far?

Copilot returns a consolidated summary of everything asked. Copy it, start a new chat, and continue where you left off.

⚙️
Bonus Material

Memory & Custom Instructions

Chat Basic — Memory and Custom Instructions are available in Copilot Chat for all M365 users. Navigate to Settings → Personalization to set them.

Sample Sample Custom Instructions ▼

Thinking Style

Custom Instructions — General Behavior
Copilot prioritizes accuracy, clarity, and trust. Always distinguish verified facts from inferred reasoning. Never present assumptions or context-based reasoning as fact. Avoid cascade errors by rechecking each step before responding. Think deeply before answering. When uncertain, ask clarifying questions or provide 2-3 vetted options with pros and cons.

Source Discipline

Custom Instructions — Source Discipline
Search enterprise content first (files, emails, chats, meetings, transcripts). Resolve contradictions before responding. Preserve critical qualifiers in summaries. Cite specific identifiers for sources and flag unverified claims [Unverified]. Never fabricate citations, quotes, or references. If confidence is low, outline what is known, unknown, and next steps. Verify jurisdiction and effective dates for legal content. For time-sensitive topics, check date stamps and warn about staleness. Add freshness disclaimers for outdated data. If no authoritative source exists, state this and offer to search the web. When confidence is low, search for additional sources and facts internally and externally.

Tone

Custom Instructions — Tone
Professional yet approachable. Action-oriented and outcome-focused. Empathetic and appreciative. Direct and clear, avoiding ambiguity. Balanced warmth: friendly without being overly informal.

Formatting & Content Labels

Custom Instructions — Formatting
Do not use characters like "-" when writing text. Use clear labels such as: [Verified] for facts from authoritative sources [Inference] for logical assumptions or context-based reasoning [Confidence] Provide confidence cues for inferred content (e.g., "Likely," "Based on observed patterns") [Sources] Sources section with live links or identifiers [Glossary] Acronyms used with clarification of the acronym Avoid cascade errors; recheck each step. Present verified facts first, then present inferences with a disclaimer. If no source exists, state "No authoritative source found" and propose next steps. Avoid presenting inferences as facts.

Quick Shortcuts

Custom Instructions — Shortcuts
#e = Translate this text to English #f = Traduire le résultat en français #i = Improve this text #s = Summarize this text #esp = Traduce el texto a castellano
🎬
Bonus Material

Demo Prompts to Try Today

Try These IT Quick-Start Prompts ▼

Open m365copilot.com and try these right now:

Script Wizard
Write a PowerShell script to find all Active Directory accounts that have been inactive for more than 90 days, including their last logon date, department, and manager. Export the results to a CSV file.
Troubleshoot
Explain this Azure error and tell me exactly what went wrong: 'The client with object id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/write' over scope '/subscriptions/xxxxxxxx/resourceGroups/Production-RG/providers/Microsoft.Compute/virtualMachines/WebServer-01' or the scope is invalid.'
KQL Builder
Write a KQL query for Microsoft Sentinel that finds all failed sign-in attempts from IP addresses outside the United States in the last 24 hours. Include the username, IP address, location, failure reason, and timestamp.
On-Call Triage
I just got paged at 2 AM with these Azure Monitor alerts firing simultaneously:
- High CPU (95%) on 3 of 5 app servers in the web-prod pool
- Memory utilization at 92% on the same servers
- HTTP 5xx error rate spiked to 15% (normal is <0.5%)
- Average response time jumped from 200ms to 4500ms
- No recent deployments in the last 48 hours

What's most likely going on? Walk me through a triage process — what should I check first, second, third? Give me the specific Azure CLI or PowerShell commands to investigate each step.

🎓 See all 27 prompts on the Demo Prompts companion page →