Microsoft has flipped a switch that's easy to read as a small administrative detail and is actually a governance event: Copilot in Fabric is now on by default for tenants. Not opt-in, not behind a toggle an admin has to go find — on, unless someone deliberately turns it off. I want to talk about that word "default", because defaults are where a huge amount of real governance quietly happens, and this one deserves a conscious response rather than a shrug.

The headline everyone will take is "Copilot is everywhere now." The more useful reading is this: a default is a decision made on your behalf by someone who doesn't know your risk appetite. The mature move isn't to accept it or to reflexively reject it — it's to re-decide it, on purpose, for your organisation.

Why "default on" is a bigger deal than "available"

There's a world of difference between a capability being available and a capability being on by default, and it's worth being precise about why.

When something is available but off, adopting it is an act. Someone has to decide to enable it, which means someone has to think about it — weigh the benefit, consider the risk, own the choice. That friction is annoying, but it's also a natural checkpoint where governance happens.

When something is on by default, not adopting it becomes the act. The capability is live across your estate the moment the switch flips centrally, and the burden inverts: instead of someone choosing to turn it on, someone now has to notice it's on and choose to turn it off. And "notice and actively reconsider a default" is a thing organisations are famously bad at, because defaults are invisible precisely by being defaults. Most tenants will run with this simply because nobody made a decision either way — which is to say, they'll have made a significant choice about AI and their data by not choosing.

That's the part I want people to catch. Doing nothing here is not neutral. It's a decision to run Copilot across your Fabric estate, made by omission.

The questions the default doesn't answer for you

So treat the switch as a prompt to actually think, and here's what's worth thinking about — none of which Microsoft's default can answer, because the answers depend on you:

  • What data is Copilot now positioned to touch? Copilot works over your Fabric content — your lakehouses, your semantic models, your reports. Turning it on across the tenant means it's now available against data you may not have classified with an AI assistant in mind. Do you actually know what's sensitive in there?
  • Who can use it, and should they all? On-by-default across the tenant is a broad blast radius. It's entirely reasonable to want Copilot enabled for your analytics team and not enabled in a workspace holding your most regulated data. The default doesn't make that distinction; you have to.
  • What have you told your people? If Copilot is suddenly live, users will start feeding it prompts — potentially including things they wouldn't paste into an external tool but will happily type into one that's "built in." A default-on capability with no accompanying guidance to staff is a small governance gap that scales quickly.
  • Does your appetite match Microsoft's? Microsoft set this default for the average tenant. You are not the average tenant. A public-sector body, a regulated financial firm, and a marketing agency have wildly different tolerances, and exactly one default was chosen for all of them.
A default is a decision optimised for the vendor's median customer. Your job is to notice when you're not the median — and you're almost never the median.

This isn't an argument against Copilot

I want to be clear, because it's easy to read caution as opposition. I'm not telling you to turn it off. Copilot in Fabric is genuinely useful — I've argued elsewhere that as a fast assistant for the people who can check its work, it earns its place. For plenty of organisations, leaving it on for the right teams is exactly the right call, and the default will have done them a small favour by removing a step.

The point isn't the direction of the decision. It's that there should be a decision. "On for our analytics workspaces, off in the regulated domain, with a one-page note to staff about what not to paste into it" is a governed posture. "On everywhere because we never looked" is the same end state arrived at by sleepwalking — and the two look identical right up until the day they don't.

What I'd actually do this week

Concretely, if I owned data governance in a Fabric shop the week this default landed, the response is short and unheroic: open your tenant settings and look at the Copilot configuration as it now stands. Confirm which workspaces and which users it's live for. Decide, deliberately, whether that blast radius matches your risk appetite — and narrow it where it doesn't. Send your data users two sentences about what the assistant is and what not to feed it. That's an afternoon, and it converts a default you drifted into an a posture you chose.

Because that's the whole lesson of "default on", and it's bigger than this one feature. As AI capabilities get switched on across the tools you already run — quietly, centrally, by vendors optimising for adoption — the organisations that stay in control won't be the ones that block everything or the ones that accept everything. They'll be the ones who treated every new default as a question addressed to them, and took the afternoon to answer it on purpose. Microsoft made a choice for you this month. Make it yours.