Recognised globally. Delivering impact across the UK.
Phoenix Software is the 2026 Microsoft Nonprofit Partner of the Year, recognised globally for helping nonprofit organisations achieve meaningful outcomes through Microsoft Cloud and AI.
The recognition is global. The work behind it is UK focused.
It comes from over 35 years spent working alongside UK charities, hospices, and social impact organisations. Helping them protect sensitive information, make tight budgets go further, and give their people tools that help rather than get in the way.
If you are weighing up Copilot, worrying about security, or trying to work out what your Microsoft estate is really costing you, that is the work we do every week.
Some of the charities we work with
What the award says about your next project
What this means for your organisation
An award does not deliver a project. It recognises where our experience sits.
Microsoft judges this category on outcomes for nonprofit organisations, not on how much we sell.
For a charity looking at AI, security, or a cloud move, that is the useful part. The approach has been tested on organisations just like yours, with the exact same constraints. Small teams. Sensitive data. Budgets defended line by line at board level.
We are not new to this sector. We are a trusted supplier to 540 charities and not for profit organisations big and small, and across the UK.
540
charities and not-for-profit organisations, big and small, across the UK, work with us as a trusted supplier
Summary
Adoption has raced ahead of governance
Charities are using AI faster than they are building the rules to govern it. The question of whether to adopt has been settled. What happens next remains entirely open.
The numbers show how far that shift has gone.
-
79% of charities now use AI Source: Charity Digital Skills Report, 2026
-
81% reported digital progress over the past year, up from 60% Source: Charity Digital Skills Report, 2026
-
92% of large charities use AI Source: Charity Digital Skills Report, 2026
Now look at what sits underneath that adoption
-
15%
have updated their risk register to reflect how AI is being used
- 15%
- updated their risk register
- 79%
- use AI
Source: Charity Digital Skills Report, 2026
-
17%
managed to get digital costs into a funding application this year
- 17%
- this year
- 30%
- the year before
Source: Charity Digital Skills Report, 2026
Half of all charities lack an AI policy, rising to 62% for small charities.
A third of boards are rated poor on AI skills, and 46% of charities have no trustee with digital expertise at all. Only 15% have updated their risk register to reflect how AI is being used.
Money is the biggest issue. Almost two thirds of charities name squeezed finances as their biggest barrier. And the funding route for digital work is narrowing.
Chapter 01
The threat has not eased
Charities hold donor financial records and safeguarding data about vulnerable people. Ransomware attacks decreased for businesses last year, but rose for charities.
-
In the last 12 months
28%
of charities identified a cyber breach or attack
-
Of those
49%
went on to be victims of cyber crime
-
The most disruptive attack
69%
of those affected named phishing, which reached a quarter of all charities
Ransomware, last year
- Fell for businesses
- Rose for charities
Source: DSIT and Home Office, Cyber Security Breaches Survey 2025/2026.
6 in 10
6 out of 10 charities say cyber security is a high priority for senior management.
Fewer have anyone whose actual job it is to do something about it.
Very few charities have a CISO. Almost none can staff a security operation around the clock. A posture assessment gives you a clear picture of where you are exposed and what to fix first.
Chapter 02
The divide is not about appetite
Larger charities are pulling away. Among large organisations, 92% use AI and 79% have an AI policy in place or in development. Smaller charities have the same ambition and far less support around them.
The risk is not that charities fail to adopt AI. Most already have. The risk is adopting it without governance, without security, and without the skills to judge whether the output is right.
More than half of charities say limited skills are holding them back, and a third now say they do not trust AI tools. That figure has more than doubled in a year.
AI is already changing how funding applications are completed, according to almost six in ten funders. More than half are unsure when it has been used.
That raises a wider question: not whether charities should use AI, but whether they have the skills and governance to use it responsibly and transparently.
Which is the uncomfortable part
The organisations with the least capacity to govern AI well are the ones least able to afford the consequences of getting it wrong.
Chapter 03. Becoming a Frontier charity
What the other side of the gap looks like
Microsoft has a name for organisations that have made the shift. It calls them Frontier Firms.
In Microsoft’s words, a Frontier Firm is powered by intelligence on tap, human-agent teams, and a new role for everyone: agent boss. Put plainly, AI stops being a tool that individuals open and becomes part of how the organisation runs. People set the direction. Agents handle the repetitive work. Someone stays accountable for both.
What Microsoft's research found
AI users producing work they could not have produced a year ago
All AI users
58%
Frontier Professionals, the most advanced users
80%
A Frontier charity is not a bigger charity.
It is one where the admin that swallows a service manager’s Tuesday gets handled by an agent, and the manager spends Tuesday with beneficiaries instead.
While this framing was written for commercial organisations, it applies to charities better than you might expect. The constraint it answers is one that charities already live with. Too much to do, too few people, and not enough money to hire more.
In a commercial organisation the argument is about speed and margin. In a charity it is about capacity.
Microsoft wrote this model for organisations that measure themselves in revenue. Charities do not, so the translation matters.
Every hour an agent takes back is an hour returned to the mission, and that is the only return a board of trustees will care about.
Open each area to see what it looks like at ground level.
None of that replaces anyone
It moves the admin and leaves the judgement, which was never the thing charities were short of.
How the shift happens
Microsoft describes the journey in three phases. They are a useful way to work out where you currently sit.
-
Where most charities are: Most charities we work with are here
Phase one
Everyone has an assistant
Copilot helps people do what they already do, faster. A fair few charities do not know the other phases exist.
-
Where Scope is: Scope, moving into phase three
Phase two
Agents join the team
Agents join the team as digital colleagues, taking specific tasks at human direction. Scope’s people built more than 210 agents themselves through a citizen developer programme, with over 130 use cases identified.
-
Phase three
Agents run processes
People set direction and agents run whole processes, checking in when a decision is needed. Scope built its own agents, led by the people who understood the work.
Where we come in
Less of this is about technology than people expect. The platform is usually bought already. What tends to be missing is a decision about which work should move, and the governance to let it move safely.
Our Frontier readiness work covers four things.
-
A map of where the work actually goes, so you can see which processes are worth handing to an agent and which are not.
-
The governance underneath. Data permissions, Microsoft Purview, and an AI policy your trustees will put their names to.
-
Agent building placed in the hands of your own people, through Copilot Studio and Microsoft 365 Agent Builder, the way Scope did it.
-
A measure your board will accept, framed as capacity released rather than licences deployed.
What Microsoft means by these words
- Frontier Firm. An organisation powered by intelligence on tap, human-agent teams, and a new role for everyone: agent boss. Microsoft's term, from the 2025 Work Trend Index.
- Agent. An AI system that can reason, plan, and act to complete tasks or whole workflows, with human oversight at key moments.
- Agent boss. A person who manages one or more agents. Microsoft expects this to become part of most jobs.
- Human-agent ratio. Microsoft's proposed measure for balancing human oversight against agent efficiency on a mixed team.
- Frontier Professional. In the 2026 Work Trend Index, the most advanced AI users, who use agents for multi-step work rather than single tasks.
- Frontier charity. Our phrase, not Microsoft's. It describes the destination, never a status anyone confers.
What a Frontier Partner is, and why it matters to you
A Frontier Firm is what an organisation becomes. A Frontier Partner is who helps it get there. It is a recognition inside the Microsoft AI Cloud Partner Program for partners leading AI transformation. Phoenix holds this status.
It is not applied for, it is accumulated, through Solutions Partner designations and advanced specialisations including:
- Microsoft 365 Copilot
- AI Apps or AI Platform on Azure
- Data Security
Why this matters if you hold sensitive data
For a charity reading this page, the badge itself is not the interesting part. Data Security is one of the specialisations required to earn it, which means governance is not something we add at the end of an AI project. If you hold safeguarding records or donor financial data, that is the detail worth knowing.
Microsoft describes the approach as AI-first and human-led, combining agents with human judgement rather than replacing one with the other. It is now developing the badge into a full Frontier Partner specialisation, covering the designing, building, deploying, governing, and securing of agents across Azure, Microsoft 365, GitHub, and the security stack.
It also means we are doing this ourselves before we ask you to. Microsoft expects Frontier Partners to use its AI internally first, and the way we run Copilot and agents inside Phoenix is where most of our advice actually comes from.
Chapter 04. What Microsoft makes possible
Six places the Microsoft platform supports you today
Most charities already own more Microsoft capability than they use. The work is rarely about buying something new. It is about turning what you have into something your people understand and want to work with.
Copilot and agents
210+
Copilot agents built by Scope's own people
Most charities start Copilot with admin. Administration and project management is the most common use case in the sector, at 71%. That is a fine place to begin and a poor place to stop.
Scope went further. Its people now run more than 210 Copilot agents, built in-house through a citizen developer programme we helped establish, with over 130 use cases identified. That is the human-agent team Microsoft describes, running inside a charity whose IT team is six people.
We run governed adoption: defined use cases, training for the people who will use it, and an AI policy your trustees can put their names to.
Accessibility and inclusion
30%+
of colleagues at Scope are disabled
For many charities, accessibility is not a feature list. It is the mission.
At Charities Aid Foundation, Copilot changed how their former CEO, who is blind, worked through long reports and documents. At Scope, where more than 30% of colleagues are disabled, Copilot reduces cognitive load for neurodivergent and dyslexic staff and lowers the anxiety that comes with written communication.
We assess accessibility across Microsoft 365, Windows, and your own services, then build inclusion into the design rather than bolting it on at the end.
Watch the Charities Aid Foundation story Explore accessibility and inclusion
Security and managed detection
10,041
incidents triaged for Shelter in twelve months
Phoenix Protect – Active Response is our managed Security Operations Centre, built on Microsoft Sentinel. Monitoring, threat containment, and incident response, delivered from the UK by our own analysts.
When a departing Scope employee began copying more than 118 files onto a USB drive, Sentinel flagged it straight away. The IT team stepped in before the data left the building.
Shelter works with people facing a housing emergency, and its systems hold the detail of their lives. It needed Cyber Essentials and Cyber Assurance Level 1 to keep working with the Ministry of Justice. Phoenix Protect got it there. Our SOC triaged 10,041 incidents for Shelter over twelve months, and the charity has had no major security incident since we started working together.
Read the Shelter story Explore managed IT security services Explore Phoenix Protect – Active Response
Cloud, endpoints, and devices
£25,000
a year found through Azure optimisation at Scope
Head office, regional hubs, retail shops, community settings, and volunteers on their own kit. Charity estates are untidy by nature.
We design and run Azure environments, manage devices through Intune, and deliver Windows 365 Cloud PCs where people need a secure desktop from anywhere. We also check what you are paying for. A recent Azure optimisation at Scope found £25,000 a year.
Practical Action shows what that looks like over time. We have been its software supplier for more than 15 years, across ten offices worldwide. Intune and Windows Autopilot replaced manual, on-site device builds, older devices were upgraded to run BitLocker, and the VPN hub-and-spoke network gave way to direct Azure access at most sites.
Read the Practical Action story Explore cloud and infrastructure Explore our cloud cost optimisation services
Data and impact reporting
- Microsoft Fabric
- Power BI
- Purview
Funders want evidence of impact. Most charities hold the data and still cannot answer the question.
We build the model behind the answer: Microsoft Fabric and Power BI for outcomes reporting, Purview for governance, and dashboards your board and funders can read without needing a translator.
Licensing, funding, and cost control
24/7
managed SOC at Scope, funded from licensing savings
Nonprofit pricing can be challenging. Grants change, SKUs get renamed, and renewals land at awkward moments.
We review your tenant, apply nonprofit pricing wherever you qualify, and strip out what nobody is using. Scope moved to Microsoft 365 E5, retired its third-party security tools, and funded a 24/7 managed SOC from the savings. Annual software spend did not go up.
“We were able to achieve all of this change without spending any more money. In fact, the whole project has saved us money.”
A tenant and licensing review checks what you own, what you use, and what nonprofit pricing you qualify for. It is usually the fastest way to free up budget for everything else on this page.
Chapter 05. Proof, from organisations like yours
Our customers say it better than we do
Scope supports the one in four people in the UK who are disabled. A team of six supports around 500 users across a central office, hubs in Leeds and Cardiff, 65 retail shops, an e-commerce operation, and colleagues working in the community.
Featured story: Scope
Working with us, Scope strengthened its security, improved accessibility, and rolled out Copilot at scale. All within its existing annual software spend.
Scope, in numbers
-
210+
Copilot agents live, built by Scope's own people
-
130+
use cases identified
-
24/7
managed SOC, funded from savings elsewhere
-
£25,000
a year saved through Azure optimisation
-
1
potential data leak caught before it left the building
“Phoenix bends over backwards to help us. You couldn’t ask for more from a technology partner.”
Chapter 06. Why charities work with Phoenix
A team that works with charities, not a generalist desk
The people you speak to work with charities every day, not with charities among other sectors.
What you get
I never want to feel like an unimportant, 'small fish' customer. I've never had this concern with Phoenix. Everyone at Phoenix respects us as an organisation and genuinely wants to support our mission to help disabled people.
-
A dedicated Charity and Social Impact team. Specialists, not a generalist desk.
-
NCVO Trusted Supplier and SCVO Partner.
-
Our own research. We ran The state of AI in charities with NCVO rather than repackaging someone else’s survey.
-
A UK Security Operations Centre staffed by our own analysts, not outsourced overnight.
-
Nonprofit pricing applied properly, across Microsoft and our wider vendor portfolio.
-
Relationships that last years rather than renewals.
Why Phoenix and Microsoft
We build on Microsoft rather than around it. Defender, Sentinel, Purview, Intune, Copilot, Azure, and Fabric are the platform we work in daily, which is why we can usually find capability you already own.
-
2026 Microsoft Nonprofit Partner of the Year Winner
-
2026 Microsoft Cloud and AI Endpoint Partner of the Year Finalist
-
Microsoft Frontier Partner
Recognition for partners leading AI transformation, earned through Solutions Partner designations and specialisations including Microsoft 365 Copilot and Data Security. It is what equips us to help you become a Frontier charity.
-
Microsoft Azure Expert MSP
-
Microsoft Solutions Partner – Microsoft Cloud
-
Member of Microsoft Intelligent Security Association (MISA)
-
Microsoft Verified Managed XDR Solution – Phoenix Protect Active Response
-
Microsoft MVP for Cloud and AI Endpoints – Dan Bowker
-
Microsoft MVP for Copilot – Lewis Thomson
-
Microsoft-funded programmes for the sector, including Elevate
Workshops, webinars, and in-person sessions co-delivered with Microsoft for charity and non-profit customers.
Chapter 07. Where to start
Five simple ways to get started
Every organisation has different priorities, so the best place to begin is with the challenge that matters most to you. Turn a card to see whether it fits.
-
AI and governance session
Good first step if
You are using AI already and have nothing written down.
What happens
A working session on use cases, risks, and a policy your board can approve.
-
Microsoft licensing review
Good first step if
Your grant licences changed and you are not sure what you lost.
What happens
We check what you own, what you use, and what nonprofit pricing you qualify for.
-
Microsoft security for charities session
Good first step if
Your board is asking questions you cannot answer yet.
What happens
How Microsoft’ security tooling will help you enhance collaboration, productivity, and secure your digital ecosystem.
-
Copilot pilot
Good first step if
You want evidence before you commit budget.
What happens
A scoped pilot with defined use cases, training, and measurement.
-
Agent readiness session
Good first step if
Copilot is in, and you want to know what comes after admin.
What happens
We map where your work goes, agree which processes an agent should take, and set the governance to let it happen safely.
-
Not sure yet
Good first step if
You are not sure which of these fits.
What happens
Tell us what is on your mind and our charity team will help you work out the right first step.
Talk to our charity team
Get in touch with our charities team using the form below. Prefer to talk? Email [email protected] or call 01904 562200.
Closing
Start a conversation
Being recognised globally for our work with nonprofit organisations is a real honour, yet the work behind that recognition is often far quieter and more practical: a licensing review that frees up budget, a threat caught at two in the morning, or a colleague able to read a long report independently for the first time.
So the question we would ask is not whether your organisation should adopt AI, or move to the cloud, or strengthen its security. It is simpler than that.
What would you do with the money, time, and headroom if you got them back?
Our charity team would be glad to talk it through.
FAQ
Does my charity qualify for Microsoft nonprofit pricing?
Most registered UK charities do, but eligibility is assessed by Microsoft against its nonprofit criteria rather than by us. We can check your position and handle the validation. Eligible organisations can get Microsoft 365 Business Basic free for up to 300 users, plus discounts of up to 75% on paid plans.
What changed with the Microsoft 365 Business Premium grant?
Microsoft retired the free Business Premium and Office 365 E1 grants for nonprofits from 1 July 2025, taking effect at each organisation’s next renewal. Business Basic remains free for up to 300 users, and Business Premium is available at a discount. If you moved down to Business Basic, you no longer have Intune, Defender for Business, or Conditional Access.
Can a small charity use Copilot safely?
Yes, with governance in place first. That means knowing where your data sits, setting permissions correctly, agreeing which use cases are allowed, and writing a policy your trustees have approved. Just over half of charities have no AI policy at all, which is the gap worth closing before you scale.
Do we need Microsoft 365 E5 to get a managed SOC?
No. Phoenix Protect – Active Response is built on Microsoft Sentinel and works with a range of Microsoft licensing positions. E5 often makes the commercials work better because it consolidates tooling you are paying for separately, which is what happened at Scope.
How do we fund this when digital costs are hard to get into funding bids?
Two routes. First, nonprofit pricing and licence consolidation often release money you are already spending, which is how Scope funded its managed SOC. Second, we help frame digital work as delivery cost rather than overhead, which is the framing funders respond to. Only 17% of charities got digital costs into an application this year, so this is worth deliberate effort.
What is a Frontier Firm, and does it apply to charities?
Frontier Firm is Microsoft’s term for an organisation powered by intelligence on tap, human-agent teams, and a new role for everyone: agent boss. It comes from Microsoft’s Work Trend Index research. The term was written for commercial organisations, and there is no separate Microsoft definition for charities. The model still applies, because the problem it solves is capacity, and that is the problem most charities have. Scope is a working example, with more than 210 agents built by its own staff.
Source register
Every figure on this page, with its origin. Nothing here is estimated or rounded in our favour.
-
79% of charities use AI; 81% report digital progress, up from 60%. 92% of large organisations use AI; 79% have or are developing a policy.
-
51% have no AI policy, 62% of small charities. 33% of boards poor on AI skills. 46% have no trustee with digital skills. 15% have updated their risk register for AI.
-
63% name squeezed finances as their biggest barrier. 17% got digital costs into a funding application, down from 30%.
-
56% cite limited skills; 35% do not trust AI tools, more than double last year. 58% of funders say AI is changing applications; 55% do not know who uses it. 71% use AI for administration and project management.
-
28% of charities identified a breach or attack in 12 months; 49% of those were victims of cyber crime; phishing hit 25% of charities and was most disruptive for 69% of those affected; ransomware fell among businesses and rose among charities; 60% treat cyber security as a high priority.
-
Business Premium and Office 365 E1 grants retired from 1 July 2025; Business Basic free to 300 users; up to 75% discount on paid plans.
-
Frontier Firm definition: intelligence on tap, human-agent teams, and agent boss; the three phases; human-agent ratio.
-
58% of AI users producing work they could not have produced a year ago, rising to 80% among Frontier Professionals.
-
Frontier Partner: AI-first, human-led recognition earned through Solutions Partner designations and specialisations including Microsoft 365 Copilot and Data Security; specialisation scope across Azure, Microsoft 365, GitHub, and security.
-
Scope: 210+ agents, 130+ use cases, £25,000 a year Azure saving, 118+ files flagged, 24/7 SOC funded from savings.
-
Shelter: 10,041 incidents triaged over 12 months; Cyber Essentials and Cyber Assurance L1 achieved; no major security incident since.
-
Charities Aid Foundation: Copilot and accessibility for the charity's former CEO, Neil Heslop OBE. Practical Action: supplier for over 15 years, ten offices, Intune and Autopilot, VPN retired for direct Azure access.