Microsoft 365 Copilot works inside the permissions, data and compliance boundaries you have already configured in your tenant. That is both the opportunity and the risk. If users already have access to sensitive documents they should not see, Copilot can make that access much easier to stumble across. Suddenly that HR folder with "everyone" permissions is not just a quiet problem. It is a search away.
So before you buy a single licence, work through this. It is the same structure we use in our Copilot readiness assessments.
1. Identity readiness
| Check | Why it matters | Evidence / decision required | Status |
|---|---|---|---|
| MFA coverage | Weak sign-in controls undermine any AI rollout. | MFA status and Conditional Access coverage. | |
| Privileged roles | Admins need stronger controls than standard users. | Role assignments, PIM status, admin accounts. | |
| Guest users | External users may have access to content Copilot can reason over for internal users. | Guest inventory, access reviews, stale guests. | |
| Legacy authentication | Old auth methods increase account compromise risk. | Sign-in logs and legacy auth report. |
2. SharePoint and OneDrive oversharing
This is the big one. Copilot does not leak data. It surfaces data people already had access to but never found. The problem is that "never found" was doing a lot of heavy lifting in most tenants.
- Identify sites with broad Everyone or Everyone except external users permissions.
- Review anonymous and organisation-wide sharing links.
- Find sites without active owners.
- Review OneDrive external sharing and sensitive content stored in personal drives.
- Prioritise HR, finance, legal, board, customer and acquisition-related sites for manual review.
3. Teams governance
| Check | Why it matters | Evidence / decision required | Status |
|---|---|---|---|
| Public Teams | Public Teams can expose content far more widely than intended. | List of public Teams and owners. | |
| Orphaned Teams | Teams without owners are difficult to govern. | Ownerless Teams report. | |
| External access | Guests and external collaboration should be deliberate. | Guest membership and external sharing settings. | |
| Channel sprawl | Too many Teams and channels makes content harder to manage. | Active Teams inventory and usage review. |
4. Purview, labels and retention
| Control | Why it matters | Minimum sensible position before pilot |
|---|---|---|
| Sensitivity labels | Helps classify and protect sensitive content. | Basic label set for Public, Internal, Confidential and Highly Confidential. |
| DLP | Reduces risk of sensitive data leakage. | Policies for common sensitive information types where relevant. |
| Retention | Stops important data being deleted casually or retained forever by accident. | Clear approach for key records and business-critical sites. |
| Audit | Provides visibility of user and admin activity. | Know what can be audited and who reviews it. |
Do not let the word "Purview" scare you into thinking this is enterprise-only territory. A basic label set and a couple of DLP policies is a perfectly reasonable starting point for a 30-person company. Microsoft's own Copilot data and compliance readiness guidance sets out the minimum, and their Data Security for Copilot assessment is a fair self-check.
5. Pilot design
- Start with a controlled group of users who have clear use cases.
- Do not give licences to everyone without measuring adoption and risk.
- Include a mix of leadership, operations, finance, sales and technical users.
- Define three to five approved use cases before the pilot starts.
- Measure time saved, quality of output, user confidence and data issues found.
Hard truth: if the tenant has poor SharePoint governance, Copilot will not fix it. Copilot will make poor governance more visible. That can be useful, but only if the organisation treats readiness as a data governance project rather than a licence assignment exercise.
We would rather tell you to fix governance first and delay licences by a month than sell you a rollout that embarrasses someone in week one. It happens. A finance director asks Copilot for a pay summary and gets one.
Book a Copilot Readiness Assessment
Before rolling out Copilot, check what it can see. We can run a focused Copilot Readiness Assessment to identify oversharing, governance gaps and safe pilot options.
Book a Copilot Readiness Assessment