AI Readiness for Microsoft 365
Before Copilot reads everything in your tenant, make sure it should.
Copilot can read whatever the person asking can reach. In most tenants (your organisation's own corner of Microsoft 365), that includes years of over-shared SharePoint and Teams content, and from the day you switch Copilot on, all of it becomes easy to find. We would much rather you found it first.
The risk, plainly
Copilot does not change your permissions; it simply uses the ones you already have.
Microsoft 365 Copilot answers questions using everything the person asking is allowed to open. That is how it is meant to work, and it is a good thing.
The trouble lies in what people are allowed to open. Think of the finance site someone shared with the whole company years ago, the Teams channel that still includes last year's contractors, or the spreadsheet sent round with an "anyone in the organisation" link. None of it mattered much while nobody went looking, but Copilot goes looking every time someone asks it something.
The good news is that this can be fixed, and most of the fixes are housekeeping you would want done anyway. It simply needs doing before rollout, rather than after the first awkward answer.
Illustrative example. Not client data.
Employee, sales team
What are the salary bands for senior managers?
Copilot
Based on Pay review 2024 FINAL v3.xlsx, senior manager bands run from ...
The spreadsheet sits in an HR site that was shared with "Everyone except external users" years ago. Copilot has not done anything wrong here: the permission was always there.
What we look at
We look at six areas, working in your own tenant and alongside your own people.
Permissions and oversharing
We look across SharePoint, Teams and OneDrive for sites open to the whole organisation, "anyone with the link" sharing, broken inheritance (where a folder no longer follows its site's permissions), and the groups nobody remembers creating.
Identity and access in Entra
We check multi-factor authentication, conditional access, guest and leaver accounts, and who holds admin roles, because Copilot is only ever as safe as the accounts using it.
Sensitivity labels and data loss prevention
We look at whether your sensitive content is labelled at all, whether the labels actually restrict anything, and whether your data loss prevention (DLP) policies cover Copilot and Teams.
Licensing
We work out who really needs a Copilot licence (and who does not), what your current plans already include, and what agents are likely to cost as people use them more.
Shadow AI
These are the AI tools your people already use with company data outside Microsoft 365. There are usually more than anyone expects, and it is rarely a disciplinary matter: people simply want to get their work done.
Agents
For agents built in Copilot Studio or elsewhere, we check which connectors they use, what data they can reach, and who is allowed to publish them.
What we leave you
You will have a plan and a policy you can actually work from.
We work with read-only admin access, alongside your IT lead. Most of the fixes are changes your own team can make from our list, since they know the tenant better than anyone, but if you would rather we made them, we can.
We are a Microsoft Partner. TODO: confirm exact partner programme wording and any designations
- A findings report with a red, amber and green summary
- A remediation plan in priority order, with the effort for each item
- A plain-English AI usage policy your staff will actually read
- A suggested rollout: who gets Copilot first, and what to keep an eye on
- If you want it, a quarterly governance review as your tenant and agents change
Who does the work
One of our senior engineers leads this work, and you will know who it is from the start.
The work is led by our senior engineers, who have spent a long time with Azure, Microsoft 365 and identity. Where a job needs security testing, we bring in specialist associates we know and trust, and we will tell you before we do.
Meet the teamAlready using AI outside Microsoft?
If your teams have also built tools or automations with AI, a Production Readiness Review checks those with the same care, looking at security, personal data, server load and cost.
Book a Readiness ReviewTalk to us
Talk to us about Copilot.
Tell us roughly where you have got to, and one of our Microsoft specialists will get back to you within one working day to arrange a 30-minute call. There is no obligation, and you will not be passed to a sales team (we do not have one).