AI readiness and governance
before you roll out Copilot.
We review whether your Microsoft 365 data, permissions and AI agents are ready for wider use of Copilot and AI tools, using exports you choose to share, and give you a written report of oversharing risks, governance gaps and the fixes to do first.
Who it is for
Organisations planning or already piloting Microsoft 365 Copilot, Copilot Studio agents or other AI tools, that want to know what an AI assistant could surface, who owns each agent, and whether activity can be audited.
What we review
- Copilot readiness basics. licensing plan, which users will have access first, and the data and sites they will reach.
- Oversharing in SharePoint and OneDrive. sites and libraries open to broad groups, sharing links that anyone can use, and content that people could reach but were never meant to see. Microsoft documents oversharing controls that change over time; check current documentation.
- Permissions model. site and team ownership, broken inheritance, external sharing settings and guest access.
- Sensitivity labels. which labels exist, how they are applied (by users, by default on document libraries or automatically), how much important content carries one, and what each label does, such as encryption and content markings.
- Data lifecycle. stale and duplicate content that adds noise and risk to AI answers, and retention settings.
- Agent inventory and ownership. Copilot Studio and other agents: who owns each, who can use or publish it, which knowledge sources and connectors it reaches.
- Agent identity and permissions. which identity each agent runs as, what each connector can reach, the least-privilege test for each, and approval steps before any action that changes data.
- Power Platform data policies. how data policies in the Power Platform admin center govern Copilot Studio features, knowledge sources, connectors and publication, and how makers are controlled.
- Shadow AI. which other AI tools staff use with company data, and consent grants to AI applications in Entra ID.
- Audit and logging. whether auditing is enabled (Microsoft states Copilot and AI application activity is logged as part of Audit (Standard) when your organisation enables auditing), how long records are kept and who reviews them.
- Policy and accountability. an acceptable-use policy, a risk register, and a named owner for AI decisions.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- An oversharing heat map for the sites in scope
- An agent register: owner, purpose, data reached, permissions
- Findings with severity and the evidence behind each one
- A fix-first list, a 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over Microsoft 365 and any AI tools
- Exports or reports named in the scope, such as SharePoint sharing and permissions reports, label settings and an agent list
- Your intended AI use cases and pilot users
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the exports and reports in the agreed scope. We do not read document content or sign in to your tenant.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not read your documents or mailboxes, enable or disable Copilot, change sharing or labels, or build or publish agents. We give no assurance about the output of any AI tool.
What needs separate approval. Any change to permissions, labels, sharing, policies or agents, any pilot, and any follow-up check after changes.
Questions before an enquiry
Do you read our documents?
No. We review permission and label reports, not content. If a finding needs a sample, the scope agrees what is shared and how.
Does Copilot ignore permissions?
Microsoft says Copilot grounds its responses in data users already have permission to access. That is why oversharing matters: content people can technically reach can appear in answers. Check current Microsoft documentation.
Can you set up Copilot or labels for us?
Not under this review. Setting up is a separate scope with change approval.
We do not use Copilot yet. Is this relevant?
Yes, if you will. Fixing oversharing and agent ownership first is cheaper than finding problems after rollout.
Which free tools help?
The agent governance checklist and the AI agent audit log checker work in your browser. The Copilot licence value check and Copilot Studio credit estimator help with licensing questions.
Free tools, reading and vendor documentation
- Agent governance checklist (free)
- AI agent audit log checker (free)
- Copilot licence value check (free)
- Copilot Studio credit estimator (free)
- Microsoft 365 Copilot and SharePoint oversharing
- AI agent identity and least privilege
- AI agent audit trail
- AI agent audit log: what to record
- Copilot limitations: when it is not the right tool
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.