Microsoft 365 Copilot can summarise a long email thread, draft a proposal from your own documents and recap a meeting you missed. It does that by working with everything the signed-in person can already access in Microsoft 365. That is its strength and its main risk: if your permissions are loose, Copilot will faithfully surface files people were never meant to see.
Use this checklist before buying licences, not after.
1. Licensing basics
- An eligible base plan. Copilot is an add-on licence on top of Microsoft 365 business or enterprise plans, including Business Basic, Standard and Premium.
- Who actually needs it. Licences are per user. Start with the roles that write, summarise or analyse the most, not the whole company.
- Apps up to date. Copilot features appear in current versions of the Office apps, Outlook and Teams, so make sure devices are on a supported update channel.
2. Find and fix oversharing
This is the most important step, and the one most often skipped.
- “Everyone” permissions. Look for SharePoint sites, libraries and folders shared with everyone in the organisation.
- “Anyone with the link” sharing. Review links that work for anyone, and consider switching that option off.
- Public Teams and groups. A public team’s files are open to every employee.
- Old sites and orphaned content. Projects that ended years ago, with permissions nobody remembers granting.
- Sensitive folders in the wrong place. Payroll, HR files and board papers sitting in general-purpose sites.
SharePoint admin reports and access reviews help find the worst cases. Fixing them is worthwhile whether or not you buy Copilot.
3. Label what is genuinely confidential
Sensitivity labels, available with Microsoft 365 Business Premium and higher plans, mark documents as confidential and can encrypt them so only the right people can open them. Copilot respects those protections. Start small, with two or three labels such as Internal, Confidential and Highly Confidential, applied to the documents that matter most.
4. Clear out stale content
Copilot draws on what it finds. If your libraries hold five versions of the same policy and a price list from 2019, answers will be less reliable. Archive or delete redundant, obsolete and trivial files before rollout, and make sure the current version of important documents is easy to identify.
5. Decide the rules
- An acceptable use policy that covers Copilot and any other AI tools staff use
- A clear statement that AI output is a draft, and a person is responsible for what is sent or published
- Guidance on client information: what may be used with AI and what may not
6. Pick use cases and a pilot group
Choose three or four concrete tasks where Copilot should save time: meeting recaps, first drafts of proposals, summarising long email threads, or analysing a spreadsheet. Give licences to a small pilot group who do those tasks every day, and ask them to note what works and what does not.
7. Train people on real work
Generic feature tours are forgotten within a week. Short sessions built around your own documents and tasks stick. Cover how to write a clear prompt, how to check the answer, and when not to use Copilot.
8. Measure, then expand
After a month or two, review usage reports and ask the pilot group what changed. Expand licences to the roles where the value is clear, and reassign licences from people who are not using them.
The checklist
- Eligible base licences, and a short list of roles for Copilot
- Oversharing reviewed: “Everyone” permissions, “anyone” links, public teams, old sites
- Sensitivity labels on confidential documents
- Stale content archived or removed
- An AI acceptable use policy in place
- Use cases chosen and a pilot group named
- Training built around your own work
- A review date set to measure results
Most of the readiness work is Microsoft 365 housekeeping: permissions, sharing links, labels and old data. Our Microsoft 365 and SharePoint services cover exactly that.