Both products are safe enough to buy. The question is not which is more secure, it is where your governance sits. Microsoft Copilot inherits the permissions, labels and audit trail your tenant already runs. ChatGPT Enterprise hands you a second console to govern, with its own identity, its own logs and its own audit surface. And one fact settles the choice for most companies of 50 to 500 people before the security review starts: ChatGPT Enterprise is quote-only, with a seat floor you may not clear.
Search this comparison and you get ten reseller blogs and a Microsoft compete page whose four headlines all end in “ChatGPT doesn’t.” Fine if you want the Microsoft argument stated well. Less help if you are holding a license decision for 180 staff and need to know what work each option creates on your side of the contract.
Where governance lives, in one table
Strip out the marketing and the split is architectural. One product governs AI with the stack you already own. The other brings its own.
| Control | Microsoft Copilot | ChatGPT Enterprise |
|---|---|---|
| Identity | Entra ID in your own tenant | SAML single sign-on, SCIM provisioning |
| Permissions on your files | Inherited. Copilot reaches only what the signed-in user can already open | None inherited. Access comes from connectors you wire up |
| Data loss prevention | Microsoft Purview DLP policies, sensitivity labels, information barriers | Workspace policy plus whatever your network or browser tooling catches |
| Audit and legal hold | Purview audit, eDiscovery and retention, same as mail and files | Compliance logs and a compliance API your own tooling reads |
| Training on your content | Excluded under enterprise data protection terms | Excluded by default under the data processing agreement |
| Residency | Microsoft 365 residency commitments and the EU Data Boundary | Selectable storage regions, plus inference residency where supported |
| Encryption keys | Microsoft 365 encryption, Customer Key option | Customer-managed keys on the Enterprise tier |
| Where an auditor looks | Tools your security team already has accounts in | A second console they will review as a new system |
Microsoft’s security documentation for Copilot puts the inheritance plainly: Copilot “only accesses data that users are authorized to access” and respects existing Microsoft 365 compliance, privacy and residency commitments. That one sentence is the whole Microsoft case and the whole Microsoft risk. OpenAI’s controls are good and standalone. They just do not know anything about your SharePoint.
Neither vendor trains its foundation models on business content. Microsoft says prompts, responses and data reached through Microsoft Graph are not used for training, and binds that under its Product Terms and Data Protection Addendum. OpenAI says the same for business tiers in its enterprise privacy terms. Treat that row as a tie and stop spending review time on it.
The tier you can actually sign
Here is the part the comparison pages skip. They all set Copilot against ChatGPT Enterprise, a product with no list price and a sales-led contract that, for a 300-person company, is often not the product on offer. Published prices below were read in October 2026; vendor pages move, so check before any number reaches a board pack.
| Plan | Published price | Floor or cap | Governance you get |
|---|---|---|---|
| Microsoft 365 Copilot | $30 per user per month, annual commitment, on top of a base license | Add-on, no minimum | Full Purview surface, tenant audit, labels, eDiscovery |
| Microsoft 365 Copilot Business | $21 per user per month list | Organizations up to 300 users | Same tenant inheritance, SMB base licenses |
| Microsoft Copilot Chat | Included with many Microsoft 365 plans | None | Enterprise data protection, prompts stay in the tenant boundary |
| ChatGPT Business | $20 per seat per month annually, $25 monthly | 2 seats, capped at 200 paid seats | Single sign-on, admin console, no-training terms |
| ChatGPT Enterprise | Not published, by quote | Annual term with a deal-set seat floor | Adds SCIM, compliance API, residency, customer keys |
Resellers and buyers report ChatGPT Enterprise quotes clustering around $45 to $75 per seat per month with seat floors near 150. Those are reported figures, not published ones, and they matter as arithmetic rather than price: a 90-person company cannot sign a 150-seat floor, so for a large slice of the mid-market the honest comparison is Copilot against ChatGPT Business.
That changes the table. SCIM provisioning, the compliance API, data residency and customer-managed keys all sit on the Enterprise tier. ChatGPT Business gives you single sign-on, an admin console and the no-training terms, a real gain on personal logins, as we argue in the case for paying for managed seats. It does not give you automatic deprovisioning when someone leaves, and it gives your eDiscovery tooling nothing to read.
So at mid-market scale, Copilot arrives at $21 to $30 per user with audit, labels, retention and legal hold already wired, on top of a license you pay for anyway. ChatGPT Business arrives at $20 to $25 with an admin console and manual user management. The cheaper seat carries the thinner audit trail. Price that gap rather than assuming it away.
Copilot leaks inward, ChatGPT leaks outward
This is the sentence neither vendor will write, and it decides what work you have to do before launch.
Copilot’s risk points inward. It creates no new permissions. It makes the ones you have usable in plain English. A finance folder shared with “everyone except external users” three reorganizations ago sat open and invisible because nobody searched for it. Ask Copilot what the bonus pool looked like last year and that misconfiguration becomes a sentence with a citation. Microsoft documents this openly under the heading “Preventing oversharing” and publishes a deployment blueprint for it. The work it implies: permission cleanup across SharePoint and OneDrive, label coverage on sensitive document types, and the controls that keep unlabeled content out of scope. For most companies that is weeks of unglamorous work, and it is the real cost of a Copilot rollout.
ChatGPT’s risk points outward. It inherits nothing, so it exposes nothing you own. The exposure is content a person moves out of your boundary by paste, upload or connector, and the admin console cannot see a paste that never left the browser. That is why the controls that count sit in your network and endpoint tooling rather than the vendor’s console, a point we work through in what data loss prevention for AI assistants really covers. The work implied here is a data rule staff can apply, a sanctioned tool list, and enforcement at the edge.
Two products, two risks, two different pre-launch programs. A review that scores them on one checklist misses both.
What each console shows you after launch
Buyers over-weight the purchase and under-weight the oversight that follows, and the reporting surfaces are not equal. Microsoft now has two. The Copilot security dashboard in the Microsoft 365 admin center covers data protection, oversharing and DLP, with documented roles: Global Reader to view, AI Administrator to change. Above it sits the Microsoft Security Dashboard for AI, which pulls Defender, Entra and Purview signals into one view and inventories AI assets, including third-party ones such as ChatGPT and Gemini. It is in public preview, so treat its coverage as moving. The strategic read matters more than the feature list: Microsoft is building the console that governs the AI tools it does not sell you.
OpenAI’s reporting is narrower and more programmatic. Workspace analytics show adoption, and the compliance platform emits append-only log events your SIEM, eDiscovery or DLP tooling can query. That shape suits a security team with existing tooling and fits poorly where that team is one IT manager and a managed service provider. One documented limit: the compliance API will not let you delete records OpenAI logs for audit and security purposes.
Judge this by who will sit in the console on a Tuesday. At 50 to 500 people that person has another full-time job.
The certification question buyers get wrong
Procurement collects logos. The logos are real and they are not the answer. OpenAI’s trust portal lists SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022, 27017, 27018, 27701 and ISO/IEC 42001:2023, plus CSA STAR, PCI DSS, GDPR and CCPA. ISO/IEC 42001, the AI management standard, is the one most buyers overlook and the one that speaks to a governance review. Microsoft’s attestations sit in the Service Trust Portal and are broad for the same reason its inheritance argument works.
Three things to do with that:
- Ask for the report, not the badge. SOC 2 scope is per-service and per-feature, and a newer capability can ship outside the audited boundary. Confirm the features you plan to enable sit inside it.
- Separate contracts from attestations. HIPAA is not on OpenAI’s certification list because HIPAA is not a certification. If you need a business associate agreement, ask for it in writing.
- Check the tier again. An attestation covering the product does not grant you a feature your plan excludes.
Most companies end up running both
Not as a hedge, as an outcome. Office-heavy roles want the assistant inside Word, Excel, Outlook and Teams. Research, engineering and strategy roles want the stronger general reasoner and their own custom assistants. On capability grounds, routing by role beats standardizing.
It is also the priciest governance posture available, and worth naming before you drift into it: two consoles, two log formats, two retention policies, two sets of access reviews. IBM’s 2026 Cost of a Data Breach Report, built on 602 breaches between March 2025 and February 2026, found only 19% of breached organizations coordinate between their AI governance and security teams. Running two platforms without that coordination is how you get a policy nobody can enforce in either one.
The same report shows why the console comparison is the easier half. Shadow AI showed up in 43% of breached organizations, up from 20% a year earlier. Among those with an AI-related incident, 92% had no AI access controls and 68% had no AI governance policy, up the wrong way from 63%. The failure mode is not picking the weaker vendor. It is buying either one and governing neither, the gap we take apart in the safe AI use playbook.
How to decide in two weeks
The decision needs less analysis than most buyers give it and more evidence than most collect.
- Count the seats you can sign. Under roughly 150 people, price Copilot against ChatGPT Business and set the Enterprise tier aside until a client contract or an auditor forces it.
- Run a permissions health check first. Sample twenty sensitive SharePoint and OneDrive locations and ask who can open them. If the answer embarrasses you, that cleanup is a Copilot prerequisite and belongs in the cost.
- Name the auditor’s question. Write down the one request you expect from a client, insurer or regulator this year. “Show me the conversation log” needs the tier with the compliance API. “Show me your policy and training records” is something neither console answers.
- Pilot by role, then name an owner. Ten office-heavy users on one tool, ten research-heavy on the other, three weeks, one scorecard. Then name who owns the console on day 31, with time in their week.
What neither console can do
Admin controls set what is possible. Staff judgment sets what happens, and the gap between them is where incidents live.
No setting tells a person whether a client’s unsigned term sheet belongs in a prompt. No label catches the paste into a tool you never licensed, on a phone, at 7pm. No dashboard separates a confident wrong answer from a correct one. Those decisions sit with the person at the keyboard, which makes them a training problem rather than a procurement one — the same gap between buying capability and having it that runs through the case against treating licenses as enablement.
What closes it is short, hands-on work on the team’s own documents: here is the tool you now have, here is the line, here is what happens when you cross it, now try it on the file in front of you and get corrected in the moment. A session of that kind sits in a $2,000 to $15,000 market range, small against a year of seats, and it is the part of the rollout that changes behavior. Leaders who want the oversight framing rather than the configuration detail should start with the governance training options aimed at boards and executives.
For a second opinion on which tier fits your obligations, the free AI-readiness call is a 30-minute version of steps one through three above.
Frequently asked questions
Which is more secure, Microsoft Copilot or ChatGPT Enterprise?
Neither, in any way that should decide your purchase. Both exclude business content from foundation-model training, encrypt in transit and at rest, and hold current attestations. What differs is where governance sits: Copilot inside your Microsoft 365 compliance stack, ChatGPT Enterprise in a second domain with its own identity and logs.
Can a 100-person company buy ChatGPT Enterprise?
Often not. It is quote-only on an annual term, and reported seat floors cluster near 150. Below that the realistic option is ChatGPT Business, which carries single sign-on and the no-training terms but not SCIM, the compliance API, data residency or customer-managed keys.
Does Copilot see files our staff should not have access to?
No, and that is the subtlety. Copilot reaches only what the signed-in user could already open. The risk is that it makes existing oversharing easy to find in plain language. Remediate permissions on sensitive locations before rollout, not after the first awkward answer.
Is ChatGPT Business enough for a company with no compliance function?
Usually yes, until something external asks for what it lacks. The triggers are a client contract requiring conversation logs, an auditor asking for retention evidence, or growth past the 200-seat cap. Buy Business and write down the three events that would force an upgrade.
If we already pay for Microsoft 365, is Copilot the cheaper governed option?
On audit work, usually. The seat runs $21 to $30 per user per month on top of your base license, and the audit, retention, labeling and eDiscovery controls are ones your team already operates. The hidden cost is permission cleanup, which a tenant with a decade of SharePoint sprawl should budget weeks for.
Does either product satisfy an AI governance obligation on its own?
No. A platform gives you the technical means. Regimes ask for a written policy, evidence staff were trained, a record of decisions, and someone accountable. Article 4 of the EU AI Act has required providers and deployers to ensure staff AI literacy since 2 February 2025, and a license is not evidence of literacy.
What should we ask each vendor in writing before signing?
Six questions. Is the no-training commitment in the data processing agreement rather than only on a web page? Which controls are tier-gated, and which tier are we buying? Can an administrator set retention, and is deletion contractual? Is there an API our eDiscovery tooling can read, and what can it not delete? What is the attestation scope for the features we plan to enable? What are the seat floor and cap?
We rolled out Copilot and staff still use ChatGPT. What now?
Common, and not a discipline problem. People keep the tool that is faster and holds their history. Either license the second tool or block it, because a tool that is neither is the default failure state. Then measure the share of prompts running through accounts you govern — the only number that says whether the control you bought is attached to the behavior you were worried about.
Key takeaways
- The split is architectural, not a security ranking. Copilot inherits your tenant’s identity, permissions, labels and audit trail. ChatGPT Enterprise is a second governance domain with its own console and logs.
- Check tier eligibility first. ChatGPT Enterprise is quote-only with reported seat floors near 150, so the real mid-market comparison is Copilot against ChatGPT Business, which lacks SCIM, the compliance API, residency and customer keys.
- Copilot’s risk points inward at your own permission debt, ChatGPT’s outward at what people paste. Each implies a different pre-launch program, and permission cleanup is the true cost of a Copilot rollout.
- Ask for the SOC 2 report and read the system description instead of collecting badges. Scope is per-service and per-feature, and HIPAA coverage is a contract request.
- Running both is a real outcome and the priciest posture. IBM found only 19% of breached organizations coordinate AI governance with security.
- The console is the easy half. IBM found shadow AI in 43% of breached organizations, 92% of those with an AI incident had no access controls, and 68% no policy. Judgment at the keyboard is a training problem, not a procurement one.
Dirk Jan van Veen, PhD
