Grand Traverse County Proposes Microsoft 365 Copilot Pilot With 100 Licenses

Grand Traverse County is asking commissioners to approve a near-$400,000 renewal of its Microsoft 365 subscription and — crucially — to add 100 Microsoft 365 Copilot licenses as part of a controlled pilot, a move that crystallizes how local governments are balancing productivity gains from generative AI with the hard lessons of a recent ransomware breach and renewed emphasis on identity and security controls.

Background​

Grand Traverse County’s Information Technology Department has submitted a renewal request for the county’s full Microsoft 365 suite that totals roughly $398,083.80 for a one‑year term. The package includes the familiar productivity apps — Word, Excel, PowerPoint, Outlook, Teams, OneDrive, SharePoint — and a proposed add‑on of 100 Microsoft 365 Copilot licenses. The budget increase tied to Copilot is approximately $36,000 for the year, and the county’s current Microsoft licensing term is set to expire on October 15, making the renewal time‑sensitive.
County leadership frames this as a measured introduction of AI, not an immediate broad enablement: the Copilot seats are intended as a pilot cohort distributed across roughly 27 offices and departments, drawn from an employee base of about 580 people. Implementation has been tied to a governance package: formation of a Center of Excellence in AI (a governance framework rather than a dedicated office), mandatory AI technical training for participating employees, and signed AI use agreements for pilot participants. The county also reports an identity upgrade — moving from an Entra/ Azure Active Directory P1 license to Entra ID P2 — intended to strengthen identity protection and privileged access controls.
This specific procurement request arrives in the wake of a high‑impact ransomware incident that disrupted county and city operations in June. That incident appears to have accelerated cloud migration and security modernization plans, including an emphasis on identity hardening, vendor‑hosted systems for critical workloads, and explicit guardrails for AI adoption.

---

What the county is buying and why it matters​

Microsoft 365 and the Copilot add‑on: capacity and cost​

• The county’s renewal covers the full Microsoft 365 productivity stack for all users and adds 100 Copilot licenses as an add‑on to existing seats.
• Publicly available enterprise pricing for Microsoft 365 Copilot aligns with an add‑on price of approximately $30 per user per month on an annual commitment basis. That rate scales to roughly $36,000 per year for 100 users — precisely the increase the county budget documents reflect.
• The county administrators note there is no cost advantage to buying fewer Copilot seats in their purchase scenario; pricing is per user and the county opted to “thumb‑nail” 100 seats to seed a pilot without enabling Copilot organization‑wide.

Why this matters: Copilot is not a standalone productivity tool — it is a deep integration into the Microsoft 365 ecosystem. That means the county can trial AI‑assisted drafting, summarization, data analysis in Excel, and Teams integrations while preserving existing identity, file storage, and access control constructs that govern county data.

Entra ID P2 — identity as a first line of defense​

• The county’s renewal includes an upgrade from Entra/Azure Active Directory P1 to P2 licensing. P2 bundles advanced identity protection, just‑in‑time privileged access (Privileged Identity Management, PIM), risk‑based conditional access, and access reviews that are absent or more limited in P1.
• Entra ID P2 gives security teams more actionable signals about risky sign‑ins, automated conditional access responses, and the ability to reduce standing administrative privileges through time‑bound role activation.

Why this matters: identity compromise is the vector for many modern ransomware and data‑exfiltration attacks. The county’s P2 upgrade is a textbook investment in reducing attack surface and detecting risky behavior early, which is a logical complement to rolling out Copilot in a controlled way.

---

The governance package: Center of Excellence, training and AI agreements​

The county has tied its Copilot rollout to three governance elements:

• A Center of Excellence in AI (COE) — framed as a governance framework to standardize rollout decisions, playbooks, and policy, rather than a brick‑and‑mortar office.
• Mandatory AI technical training for pilot participants to ensure employees understand what Copilot can and cannot do, how to safely prompt it, and what types of data must never be exposed to AI tools.
• Execution of a formal AI Agreement by participating employees that sets ground rules for permitted use, data handling, record retention, and disciplinary consequences for misuse.

These measures are consistent with current best practices for municipal AI adoption: start small, require training and accountability, and route decisions through a governing body that balances use cases, security, privacy, and legal exposure.

---

How Copilot integrates technically into a Microsoft tenancy​

• Copilot functions as an add‑on service to a qualifying Microsoft 365 tenant and reasons over work data available through the Microsoft Graph, SharePoint, OneDrive, Outlook mailboxes and Teams content — subject to permission boundaries and tenant controls.
• Tenant administrators can manage Copilot capabilities through the Microsoft 365 admin center, enabling or disabling features like file upload, web grounding (whether Copilot can access web content), and data retention for Copilot chat histories.
• In public‑sector and government contexts, there are additional configuration options and default settings intended to reduce data leakage risk; organizations can choose to disable web grounding and to enable enterprise data protection mechanisms.

The county reports it has not “turned on” Copilot as a general service — devices have a deactivated interface that requires per‑user licensing and registration to become functional. That staged approach is technically sensible because it preserves centralized control over who gets access and under what conditions.

---

Benefits: real gains for departmental productivity​

Rolling out Copilot strategically can deliver measurable benefits across county operations:

• Faster document drafting and redlining — Copilot accelerates iterative drafting, offers summarization, and can propose plain‑language versions of technical documents, which helps legal, HR, and permitting teams.
• Data analysis and reporting — in Excel, Copilot can translate natural‑language questions into formulas, help clean data, and draft narrative summaries of datasets for elected officials and the public.
• Meeting efficiency — Copilot in Teams can create notes, action items, and concise meeting summaries, reducing administrative time drains.
• Knowledge discovery — Copilot can surface contextual information across departments when integrated with SharePoint and the Graph, enabling cross‑office collaboration that previously required manual searching.
• Lower barrier to automation — Copilot Studio and agent creation tools allow IT and power users to assemble lightweight agents for repetitive tasks without heavy development cycles.

For a county with dispersed offices and diverse administrative tasks, the promise is compelling: more efficient workflows, more readable public communications, and faster internal reporting cycles.

---

Risks and trade‑offs: what local governments must weigh​

While benefits are tangible, the county’s plan carries material risks that must be actively managed.

Data privacy and confidentiality​

• Copilot reasons over tenant data when authorized. If employees upload or paste sensitive content — social security numbers, medical records, law‑enforcement case details, or legal strategy — there is a real risk of inappropriate exposure.
• Generative AI models can generate plausible but inaccurate text (hallucinations). In an official government context, errors introduced by an AI assistant — in public notices, case filings, or financial statements — can create legal and reputational harm.

Mitigation: strict data classification, disabling file uploads where appropriate, labeling sensitive repositories, and requiring human review for any AI‑generated content intended for external publication.

Compliance, transparency, and public records​

• Local governments operate under transparency regimes and records retention laws. How AI‑generated outputs, prompts, and chat histories are treated under public‑records law must be clarified before broad Copilot use.
• If Copilot is used to generate or summarize records, the county should adopt clear retention, logging, and discoverability practices for FOIA or court orders.

Mitigation: bake Copilot logs into the county’s records management system, update FOIA and retention policies to cover AI artifacts, and require employees to note when AI was used to produce official documents.

Security posture and attack surface​

• AI tooling, if misconfigured, can become an additional vector for data leakage or phishing‑style social engineering when prompts or outputs contain sensitive structure or divulge patterns.
• Copilot’s integration points (Graph connectors, SharePoint, Exchange) are powerful but multiply the consequences of an identity compromise.

Mitigation: the county’s Entra ID P2 upgrade, if correctly configured, provides risk‑based conditional access, just‑in‑time admin elevation, and access reviews that materially reduce the chance of misuse following credential theft.

Cost and procurement considerations​

• The county’s stated $36,000 incremental annual cost for 100 seats matches published per‑user pricing at approximately $30/month. That pricing is sensible for a pilot but scales quickly if adoption expands.
• The county noted there is no cost saving at lower seat counts in its current procurement scenario. Some deployment support programs or volume negotiations have minimums or tiered offers; counties should validate whether deployment incentives or partner FastTrack discounts apply before committing.

Mitigation: start with a fixed pilot cohort, instrument ROI and risk metrics for 6–12 months, then revisit seat counts and contracting strategies with procurement and legal counsel.

---

Operational recommendations: a practical, phased roadmap​

A pragmatic rollout that balances productivity with risk can look like this:

• Pilot design and selection
• Identify 80–120 users across representative roles: attorneys, permitting staff, finance, social services, and a few front‑line supervisors.
• Prioritize users with high administrative workloads and clearly bounded datasets.
• Governance and policy
• Establish the Center of Excellence in AI with membership from IT, legal, records, HR, and representative departments.
• Publish a clear AI Acceptable Use Policy and require signed AI Agreements for pilot participants.
• Technical controls and identity
• Activate Entra ID P2 features: Identity Protection, risk‑based Conditional Access, Privileged Identity Management, and access reviews.
• Configure Copilot tenant controls: disable web grounding unless explicitly needed, restrict file upload capabilities, and enable audit logging.
• Training and human review
• Deliver role‑based training on prompts, hallucination awareness, sensitive data handling, and FOIA implications.
• Require at least one human reviewer for any AI‑generated content destined for public release.
• Monitoring, metrics and evaluation
• Instrument usage metrics (who, when, what), accuracy assessments, and time‑savings sampling.
• After 3 and 12 months, the COE should report to commissioners on adoption, near misses, incidents, and ROI.
• Incident response
• Update IR playbooks to cover misuse of Copilot, exfiltration via prompts, and recovery procedures for any AI‑related incidents.

This phased approach provides measurable decision points while preserving the option to pause, scale back, or accelerate based on real usage data and security posture.

---

Legal, records, and public‑sector specific concerns​

• Public bodies must be explicit about how AI involvement affects records requests. Prompts and outputs may be discoverable and should be logged accordingly.
• Attorney–client privilege, law‑enforcement investigative materials, public health information, and other regulated classes of data must be explicitly excluded from Copilot for non‑qualified users.
• The county’s proposed AI Agreement is the right instrument to codify these boundaries, but legal counsel should tailor language to local retention statutes, FOIA, HIPAA (if applicable), and discovery rules.

---

Why the Entra ID P2 upgrade is a sensible companion to Copilot​

The county’s decision to upgrade identity licensing is not merely a checkbox; it materially reduces risk in several ways:

• Risk‑based conditional access can automatically enforce MFA or block access for anomalous sign‑ins, limiting the chance that a bad actor can leverage a stolen credential to reach Copilot‑connected resources.
• Privileged Identity Management (PIM) reduces standing privileges for administrators and auditors, making it harder for an attacker to gain a persistent foothold.
• Access reviews and entitlement governance give the county the ability to certify who still needs access to high‑risk systems on a scheduled cadence.

When Copilot is reasoning over work content, the last thing an IT team wants is persistent privileged accounts, unchecked sync connectors, or stale access that makes lateral movement trivial.

---

Practical cautions and unverifiable aspects​

• The county’s internal cost breakdown beyond the Copilot line item — such as existing per‑user Microsoft 365 licensing tiers and the precise mix of E3/E5 or Business plans in their tenancy — is public procurement information but may vary by negotiation and existing contract terms. Those line‑item details were summarized in meeting materials; readers should treat exact per‑user entitlements as procurement‑specific and confirm during contract review.
• Microsoft’s public pricing for Copilot and Entra ID P2 was used to cross‑check the county’s budgeting math; while published vendor prices align with the county’s stated increase, final negotiated pricing, taxes, and procurement fees can alter totals. Any claim that the county will pay precisely $398,083.80 should be confirmed against the final executed contract and invoice.

These cautionary notes reflect normal uncertainties in public procurement: posted pricing and actual purchase totals can diverge after taxes, enterprise agreements, and multi‑year commitments are negotiated.

---

The political and organizational dynamics​

• The county’s ransomware event earlier in the year pushed IT modernization to the front of the agenda. That background explains why commissioners are being asked to approve simultaneous moves: cloud migration for certain mission‑critical applications, identity hardening, and an AI pilot.
• The county’s approach — a pilot cohort with formal governance — is politically defensible. It demonstrates due diligence by tying new technology to training, agreements, and an identity upgrade that specifically addresses the attack vectors highlighted by the recent breach.
• Still, elected officials and procurement committees should be prepared for constituent scrutiny around AI, privacy, and public records. Transparent reporting about the pilot’s scope, safeguards, and measurable outcomes will be essential for public trust.

---

Decision factors for commissioners​

When commissioners evaluate this renewal and licensing change, the salient considerations should be:

• Is the proposed governance package (COE, training, AI Agreement) robust, enforceable, and backed by legal and records counsel?
• Will IT incorporate Entra ID P2 features thoroughly — not just purchase the license — and can they demonstrate concrete configuration steps (PIM, conditional access policies, identity protection thresholds)?
• Does the procurement include audit logging and retention of Copilot chat histories to satisfy public‑records obligations?
• Is there a clear metric set and reporting cadence to reassess whether the pilot should expand, contract, or be modified?
• Has procurement validated whether deployment assistance, FastTrack incentives, or partner discounts apply that might alter total costs or implementation timelines?

Answering these questions in the affirmative will give commissioners the confidence to approve a cautious, traceable AI pilot that aligns with modern security expectations.

---

Final analysis and outlook​

Grand Traverse County’s Microsoft 365 renewal and the decision to purchase 100 Copilot licenses represent a pragmatic, incremental path into generative AI for local government. The move is notable because it pairs a productivity pilot with an identity upgrade and a governance framework — exactly the combination experts recommend when introducing tools that reason over sensitive work data.
The county’s explicit linkage of Copilot adoption to a Center of Excellence in AI, mandatory training, and signed AI agreements is a strong governance posture. Upgrading to Entra ID P2 is a complementary security investment that reduces risk from identity compromise and gives administrators the tools to control who can access Copilot‑connected resources.
That said, benefits will not arrive automatically. The county must operationalize its governance commitments: configure tenant controls to prevent inadvertent data exposure, maintain exhaustive logs for public‑records requests, and hold to a disciplined review cycle that ties usage to measurable outcomes. The pilot cohort approach is smart: it limits blast radius while generating real adoption data that can inform an expanded rollout or a strategic pullback.
In short, the county’s plan reflects a healthy mix of ambition and caution: it demonstrates a willingness to modernize government workflows with Microsoft 365 Copilot, while acknowledging that AI adoption in the public sector must be accompanied by upgraded identity protection, enforceable policies, and visible accountability. The coming months of the pilot will reveal whether those safeguards are sufficient to deliver productivity gains without compromising security, privacy, or public trust.

---

Source: GovTech Grand Traverse County, Mich., Eyes M365 Copilot Expansion