Microsoft 365 Copilot readiness checklist

How does Copilot reach your data, and why do permissions matter?

Microsoft 365 Copilot is an AI assistant that combines a language model with your organisation’s data through Microsoft Graph. Email, calendars, Teams chats, SharePoint and OneDrive files ground its answers. Microsoft has renamed the product Microsoft Copilot, and both names appear during the transition.

According to Microsoft’s documentation, Copilot only uses content the user has at least view permission for. That sounds like a safeguard, and it is, but it also describes the real risk. A salary spreadsheet shared with “everyone in the organisation” years ago went unnoticed because nobody searched for it. Ask Copilot to “summarise the budget files” and it can end up in the answer.

This architecture is an application of RAG: the system first retrieves relevant content, then generates an answer. Whether that content should be visible to the person asking depends entirely on your permission model.

How do you find and fix oversharing?

Microsoft’s foundational deployment guidance splits readiness into three pillars: remediate oversharing, set up guardrails and meet regulations. The first takes the most effort.

Two tools do most of the finding. SharePoint Advanced Management, which Microsoft says is included with the Copilot licence, manages sharing and access across SharePoint and OneDrive; its access reports surface broadly shared sites and files. Data Security Posture Management for AI in Microsoft Purview reports sensitive data risks in AI interactions.

Remediation usually runs in this order:

1. List sites that are public or shared with “everyone in the organisation”.
2. Assign an owner to every site; ownerless sites carry the highest risk.
3. Keep sensitive sites out of Copilot search until clean-up is done.
4. Ask site owners to review membership and sharing links.
5. Tighten the default sharing settings for new sites.

This is as much organisational work as technical work. If site owners are not part of the process, the clean-up happens once and drifts back within months.

What are the licensing and technical prerequisites?

Microsoft’s requirements page lists the basics:

• Licensing: an eligible Microsoft 365 base subscription plus a Microsoft Copilot licence (Microsoft Copilot Business for Business plans with up to 300 users). Copilot is not available with device-based licensing for Microsoft 365 Apps for enterprise.
• Identity: every user needs a work account in Microsoft Entra ID. The AI Administrator role allows Copilot administration without Global Administrator rights.
• Mailbox: an Exchange Online mailbox for experiences grounded in email and calendar.
• Apps: Microsoft 365 Apps, a OneDrive account, and transcription or recording for Teams meetings.
• Network: the *.cloud.microsoft domain and WebSocket connections must not be blocked.

If you have users in the EU, read Microsoft’s notes on the EU Data Boundary. According to the documentation, Anthropic models are currently excluded from the boundary, and admins can decide whether to allow them. Identity, network and region decisions belong with your cloud infrastructure planning.

What do sensitivity labels and Purview do?

Sensitivity labels are a Microsoft Purview feature that marks how sensitive a document is and can apply encryption. When a label applies encryption, the user needs both VIEW and EXTRACT usage rights for Copilot to return the content. So even if a permission is wrong, encrypted content has a second layer of protection.

Purview’s other controls for Copilot include data loss prevention that warns or blocks users pasting sensitive data into third-party AI sites, an audit log that captures prompts and responses, retention policies that keep or delete those records, and eDiscovery. How long to keep which record is an AI governance decision, and in the EU or Türkiye it should be made alongside your GDPR or KVKK assessment.

The table below brings the checklist together:

Area	Check	Tool	Owner
Identity and licensing	Accounts in Entra ID, licences assigned to the pilot group	Microsoft 365 admin centre	IT admin
SharePoint and OneDrive permissions	Broadly shared sites found, owners assigned	SharePoint Advanced Management	Site owners, IT
Labelling	Sensitive content labelled, labels enabled for SharePoint and OneDrive	Microsoft Purview Information Protection	Information security
Retention and audit	Retention policy and audit logging on for Copilot interactions	Purview Data Lifecycle Management, Audit	Compliance
Training	Usage policy published, pilot users trained	Internal training programme	HR, business units
Measurement	Pilot metrics and a feedback channel defined	Usage reports, surveys	Project owner

How do you choose a pilot group and measure success?

A good pilot group represents different kinds of work: heavy email users, people who live in meetings, document writers, analysts. A group made only of volunteers, or only of IT staff, does not represent the rest of the company.

Define your metrics before the pilot starts. Useful metric types:

• Weekly active use, and in which apps.
• Time spent on a specific task (for example writing meeting notes), measured the same way before and during the pilot.
• User satisfaction and reports of wrong or incomplete answers.
• The number of permission or oversharing incidents found during the pilot.

These metrics become the basis for the decision to expand. Scenarios that stand out in the pilot, such as summarising long contracts or drafting repetitive text, may point to deeper work in document analysis or content automation.

How do you set up staff training and a usage policy?

Copilot’s value depends on what people ask it. Short, role-specific training works better than a general demo. Cover three things: writing good prompts (the basics of prompt engineering), the habit of checking output, and which data does not belong in Copilot.

Keep the usage policy short: read Copilot output before it goes to a customer, check the cited documents, and report any sensitive content you see by accident. That reporting channel is the cheapest way to find oversharing.

Where should you start?

Look at permissions and sharing first, then plan licences. That order matters most for finance and insurance firms that hold sensitive customer data, and for technology and software companies that have accumulated many project sites.

Through our Microsoft Copilot consulting work, Corrplus runs this checklist with you: in discovery we map permissions and sharing, in design we put labelling, retention and the pilot plan in writing, and in delivery we launch the pilot. We support labelling and logging decisions through security, compliance and data ethics and staff enablement through corporate AI training. Anything that needs legal interpretation we handle together with your legal counsel.