AI for MSPs: The Permissions-First AI Work Small-Business Clients Will Actually Pay For (2026)

The short answer

The AI work small-business clients will pay an MSP for in 2026 isn't a chatbot. It's making the AI they already bought safe and actually used: clean up who can see what before Microsoft 365 Copilot or ChatGPT gets switched on, write one page of rules, roll seats out a team at a time, and check usage at day 30. If you're an IT consultant rather than a managed service provider, it's the same job sold as a fixed project. And one Microsoft licensing detail makes the first step cheap.

Most "AI for MSPs" advice is about using AI inside your own help desk. That's worth doing, but it isn't what your clients are asking you about. They're asking whether to buy Copilot, and you're the person with the admin keys.

Why the job starts with permissions

Microsoft's own privacy documentation says Copilot "only surfaces organizational data to which individual users have at least view permissions." Read that from the client's side. Copilot doesn't create new access. It makes existing access easy to use. The HR folder someone shared with the whole company in 2021 was safe because nobody knew where it was. Now anyone can find it by asking a question.

That's the pitch to a client, and it's true: "Before we turn this on, let's find out what everyone can already see." It also includes people outside the company who were given access through things like shared Teams channels.

The licensing detail that makes it cheap to start

You don't need a separate governance product to run the oversharing review. Microsoft Learn says that if an organization assigns at least one Microsoft Copilot license, SharePoint admins get access to the SharePoint Advanced Management features that support a Copilot deployment. The ones that matter for the readiness job:

Two exceptions from the same page: the sensitivity-labels report needs E5, and restricting which apps can create sites needs the separate Plan 1 add-on. For most small clients neither blocks the work.

So the first step of a Copilot readiness project is one seat. Microsoft's pricing page lists Copilot Business at $18 per user per month on an annual subscription, marked down from $21. One seat, assigned to the person who'll pilot it, turns on the reports you need to scope the cleanup.

A 30-day plan for a 25-person client

Seat math for the full 25 at the price on Microsoft's page today: $450 a month at $18, $525 at $21, on top of the Microsoft 365 plan they already pay for. Phasing the seats (1, then 10, then 25) is the part clients thank you for at renewal. The training side of week 3, by role, is in Microsoft Copilot training, and the policy for week 1 can start from my one-page AI acceptable use policy.

What not to sell (yet)

• A custom chatbot per client. Every one is a small software product you now maintain: prompts drift, the model underneath changes, and the client calls you when it says something wrong. Sell it only after the client's people use the standard tool every week.
• AI that acts on systems before the permissions are clean. Agents and connectors inherit the same access problem, with more reach.
• "AI transformation" decks. A 25-person client wants to know what changes on Monday. Show them the 30-day table, not a maturity model.

If you're an IT consultant, not an MSP

The work is identical. The difference is the relationship: you're paid for the project, not the monthly contract, which makes you the independent voice when the client asks whether their MSP's plan is right. That independence is the whole argument in fractional CIO vs vCIO, and it's a selling point for you here. Price the readiness job as a fixed scope with a defined end (the day-30 report), not hours.

For a reference point on what owners see published: my own AI Team Rollout, which covers this same sequence for one team on Copilot, ChatGPT Business or Claude, is from $4,500, and there's more on how it runs on my AI implementation page.

The client conversation, in one line

Odds are some of your clients' people already use AI on personal accounts, with no rules and nothing the company can see. The pitch isn't "you need AI." It's "your people already use it, so let's make sure it can only see what they should." If you want the manager's side of that conversation, it's in AI for managers.

What to do this week

Pick one client already on Microsoft 365 Business Standard or Premium. Run the sharing-links report on their tenant (or assign one Copilot seat first if they have none) and count the company-wide links. Bring that one number to your next quarterly review. It sells the project better than any deck.

Sources

• Microsoft Learn, "Data, Privacy, and Security for Microsoft 365 Copilot", learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy (read October 5, 2026)
• Microsoft Learn, "SharePoint Advanced Management features in Microsoft Copilot licenses", learn.microsoft.com/en-us/sharepoint/sharepoint-advanced-management-licensing (read October 5, 2026)
• Microsoft, Microsoft 365 Copilot pricing, microsoft.com/en-us/microsoft-365-copilot/pricing (read October 5, 2026)