The Microsoft 365 Work
That Determines Whether
Copilot Returns Value
None of it is AI work, and all of it is prerequisite. Identity baselines, oversharing remediation, migration completeness, label taxonomy, provisioning discipline, and an agent lifecycle. This is the engagement catalogue: the foundational half of an AI programme, delivered by someone who has operated the estate.
Identity & Secure Foundation
Copilot does not grant access. It exercises access already granted, at conversational speed, on behalf of a user who no longer needs to know where the file resides. Each weakness in the identity model becomes a retrieval path.
Entra ID & Conditional Access
MFA enforced tenant-wide and phishing-resistant for privileged roles. Legacy authentication blocked. Conditional Access evaluating device compliance and sign-in risk rather than a correct password alone.
Privileged Access
Standing Global Admin removed. Just-in-time elevation with approval and time bounds through Privileged Identity Management, with access reviews that complete rather than expire.
Intune & Endpoint Compliance
Compliance policies the intended Copilot cohort genuinely meets, verified by report before seats are purchased rather than discovered through support volume afterwards.
Data Governance & Oversharing Remediation
The heaviest-weighted pillar in the assessment, and the one that pauses more pilots than any other. Not because the technology is difficult, but because the initial findings are substantial and remediation time was not scheduled.
| Finding | Why it matters under Copilot | Remediation |
|---|---|---|
| "Everyone except external users" grants | A convenience grant becomes an organisation-wide retrieval surface. Users surface documents they were always technically permitted to open but would not previously have located. | Inventory each grant, rank by content sensitivity, replace with scoped groups, and re-run the report to evidence the change. |
| Org-wide sharing links | Links created for a single meeting persist for years and remain resolvable during grounding. | Expire and restrict default link types at tenant level, then sweep existing links by age and site sensitivity. |
| Unlabelled high-value content | Without sensitivity labels there is no downstream enforcement: no restriction, no encryption, and no meaningful DLP. | Publish a minimal taxonomy of three to four labels and auto-apply to the highest-risk repositories in the first instance. |
| Gaps in DLP coverage | Policy applied to SharePoint but not Teams or Exchange leaves the workloads Copilot reads only partially covered. | Extend DLP to every Copilot-readable workload, then validate with realistic prompts rather than synthetic samples. |
| ROT content in the index | Redundant, obsolete, and trivial content does not merely consume storage; it degrades the quality of every answer. | Apply retention and lifecycle rules, then complete a clean-up on the highest-volume sites before the rollout widens. |
| No recurring site access review | Permissions drift back over time. A one-off remediation without a review cadence is a snapshot rather than a control. | Deploy SharePoint Advanced Management: site access reviews, restricted access control, and recurring oversharing reports. |
Content Estate & Modernisation
Copilot reasons over what has landed in Microsoft Graph. Content held on a file share, in a legacy document system, or behind a third-party boundary is not visible to it. The gap between what users expect it to know and what it can reach is where confidence is lost in the first week.
Migration & Consolidation
- File shares and legacy DMS content into SharePoint and OneDrive, with permissions rationalised during migration rather than replicated
- Tenant-to-tenant consolidation after acquisition, including identity, mail, and content
- Explicit out-of-scope declarations for what will not move, so expectations match reality
Sprawl & Provisioning
- Templated Teams and SharePoint provisioning with mandatory ownership
- Inactivity and orphan reviews that reassign or archive, rather than accumulate
- Naming, metadata, and information architecture that remains workable in day-to-day use
Search & Grounding Quality
- Microsoft Search relevance tested against real queries, to establish a baseline before Copilot is introduced
- Metadata and permission fixes on the failing cases, then re-test
- A published statement of what Copilot can and cannot reach in your estate
Connectors
- Graph and Copilot connectors prioritised by use-case value rather than by ease of connection
- Two high-value sources connected and measured before the catalogue is expanded
- Permission mapping checked end to end, so connected data respects source access
Copilot Deployment, Adoption & Licence Economics
Deployed licences are not adoption. Adoption is measured behaviour change against a baseline captured before rollout, which is why the baseline work is sequenced first, while an uncontaminated measurement remains available.
Licence Strategy
- Per-user inventory mapped against Copilot prerequisites before any purchase conversation
- Three to five personas, seats allocated accordingly, and a sixty-day reclamation rule for dormant licences
- E3 versus E5 modelled on real headcount, with agent consumption metered against an Azure budget alert
- A single named budget owner on record, as programmes stall fastest on unowned spend
Adoption & Measurement
- Five use cases, each with an owner and a quantified return, rather than a catalogue of possibilities
- An executive sponsor who demonstrates their own use, since sponsorship without usage reads as scepticism
- A champions cohort at approximately one per fifty seats, with an active channel and a monthly cadence
- Copilot Dashboard in Viva Insights reporting three agreed metrics to the sponsor, monthly
The renewal decision is determined in month two. Not because the product has changed, but because by that point there is either a baseline and three metrics, or anecdotes and a record of assigned licences.
Copilot Studio Agents Under Governance
Placing agent building with the business was the intent, since that is where the process knowledge resides. It also means the agent estate grows faster than any central team can inventory it, unless a gate and a register exist from the outset.
-
Gate 1 · Intake
Purpose and Ownership
A short intake capturing purpose, business owner, data sources, intended audience, and whether the agent acts or only answers. Agents that only answer follow a lighter path; agents that act do not.
-
Gate 2 · Review
Data Reach and Failure Modes
Data reach reviewed against the oversharing position. Connector permissions verified end to end. Failure modes assessed for any agent that writes, sends, approves, or spends.
-
Gate 3 · Publish
Scoped Audience, Logged Interactions, Review Date
Published to a defined audience rather than the whole tenant. Interactions captured in Purview Audit, retention aligned to the organisation's legal position, and a review date recorded in the register.
-
Standing · Register
Owner, Purpose, Identity, Data Reach, Review Date
Reviewed quarterly and reported to the risk committee. Agents require lifecycle management for the same reasons service accounts always have, and they proliferate considerably faster.
Start with an Honest Position
Three minutes across six pillars will identify which of these five engagements is required, and in what order.