A Copilot readiness checklist is the list of checks an admin runs before switching on Microsoft Copilot (formerly Microsoft 365 Copilot): licences and prerequisites, who can open what, sensitivity labels, sites to hold back, agents, audit and training. Copilot only shows people content they can already open, so most checks are about your tenant, not about Copilot.
Each check below says where to look in Microsoft 365 and what "ready" means, so you can tick it off or hand it to the right owner. The steps match the ones we use in a Copilot readiness assessment, where a governance tool runs the same checks across the whole tenant and keeps running them after rollout.
What does a Copilot readiness check answer?
It is a short, evidence-based answer to one question: if Copilot were switched on today for a given group of people, what could it find for them, and would you be comfortable with that? Microsoft's technical prerequisites are short. The real work is in the state of your content: years of sharing links, sites nobody owns and files nobody labelled.
A readiness check is not a one-off audit either. It sets a starting point before a pilot, decides which fixes come first and which sites wait, and then becomes the routine that keeps the tenant in shape once Copilot is live.
What is on the Copilot readiness checklist?
Eleven checks. Licences and the sharing map can start in parallel, and most of the others build on that map. The six steps of our readiness assessment appear under the same names.
Copilot readiness checklist
Where to look for each check, and what ready means before the pilot starts.
| Check | Where to look in Microsoft 365 | Ready when |
|---|---|---|
| Licences and prerequisites | Microsoft 365 admin center, licences; Microsoft's Copilot requirements | Pilot users have an eligible plan, an Entra ID account, supported apps and network access, including copilot.cloud.microsoft. |
| Map sharing | SharePoint admin center, data access governance reports | The most exposed sites are listed, each with a named owner. |
| Let owners decide | Site access reviews, started from a data access governance report | Owners of the most exposed sites in the pilot's reach have completed their review. |
| Label what matters | Microsoft Purview, sensitivity labels; label report in the SharePoint admin center (E5 or G5) | Sensitive sites in the pilot's reach carry a label. |
| Clean what misleads | Site lifecycle policies (inactive site, site ownership) in SharePoint Advanced Management | Inactive and ownerless sites in scope have an owner decision: keep, archive or delete. |
| Hold back what is not ready | Restricted Content Discovery, site by site | Sites still being fixed are excluded, each with an owner and a release date. |
| Agents | Agent registry in the Microsoft 365 admin center; Power Platform admin center | Existing agents are listed, and public website knowledge is blocked or limited to approved sites. |
| Audit | Microsoft Purview Audit | A test search returns Copilot interactions for a pilot user, and someone owns the review. |
| Right-size licences | Microsoft 365 admin center, licence assignments | Seats go to a pilot group whose content is in order, not to inactive accounts. |
| People | Your training plan and usage rules | Pilot users know how Copilot finds content and how to report a file they should not see. |
| Keep it ready | Scheduled reports and owner reviews | Each check above has an owner and a frequency after go-live. |
Are licences and prerequisites in place?
Start here, because the answer decides who can be in the pilot. Microsoft Copilot is an add-on licence for an eligible Microsoft 365 or Office 365 plan, including the E3, E5 and Business plans, and Microsoft 365 E7 includes it. Organisations with up to 300 users on a Microsoft 365 Business plan can choose Copilot Business.
Keep two things apart when you count seats. Copilot Chat is included for work accounts on eligible plans. Copilot grounded in your work data needs a Microsoft Copilot licence, and that is the part this checklist prepares for.
The technical side is short. Copilot needs Microsoft Entra ID accounts, supported Microsoft 365 apps and network access to Microsoft 365, and some features need OneDrive. One network detail deserves a ticket to your proxy team: Microsoft names copilot.cloud.microsoft as the main address of the Copilot app, in place of m365.cloud.microsoft, so check that your proxy and firewall rules do not block it.
Then comes Right-size licences. Compare who holds a seat with who will actually use it. Seats left on disabled or inactive accounts are the easiest to reclaim, and a pilot group whose content is already in order makes early feedback much easier to read.
Ready when: every pilot user has an eligible plan and a seat, the app and network checks pass, and no seat sits on an account nobody uses.
Who can see what today?
Usually more people than anyone expects, and that is the first thing to measure. Copilot only shows people content they can already open, but overshared content becomes easier to find. A pricing file behind an old organisation-wide link was hard to stumble on; a casual question can now bring it back.
This is the Map sharing step. SharePoint Advanced Management comes with Microsoft Copilot as soon as one user in the tenant has a Copilot licence. It is also sold as an add-on and included in Microsoft 365 E7. Its data access governance reports in the SharePoint admin center show where sites may be overshared: sharing links, content shared with "Everyone except external users" and permission states across sites.
Then Let owners decide. From a report, a SharePoint admin can start a site access review. The site owner gets an email, fixes access on a dedicated review page and marks the review complete, and the admin sees the outcome and comments. Microsoft documents the review as started by an admin and completed by the site owner, and it covers SharePoint sites, not OneDrive. Our article on SharePoint Advanced Management walks through these reports and reviews in more detail.
Ready when: the most exposed sites are listed with an owner each, and the owners of the sites in the pilot's reach have completed their review.
Is sensitive content labelled?
Usually only in part, and the gaps are where it matters. When sensitivity labels encrypt content, Copilot respects each user's usage rights, so labelling the right content matters more than adding new labels.
The Label what matters step is about coverage, not about designing a new scheme. Start from the labels you already use in Microsoft Purview and find the sensitive sites and libraries that carry none: finance, HR, legal, board papers, deals in progress. The data access governance report on sensitivity labels shows which sites hold labelled files, which helps you spot sensitive sites with none, but it needs E5 or G5 licences (features included with a Copilot licence). Without it, start from the sites the business already knows are sensitive and ask their owners.
Ready when: the sensitive sites in the pilot's reach carry a label, and their owners know which label new content should get.
Which sites should Copilot not see yet?
The ones you are still fixing, and the ones nobody uses any more. Two controls help, and one older control should stay out of your plan.
Hold back what is not ready. Restricted Content Discovery keeps a site out of Copilot and organisation-wide search without changing who has access. Microsoft describes it as a temporary control while permissions are fixed, and it applies to SharePoint sites. It also turns off agents on that site: nobody can create one there or add its content to another agent. Give each restricted site an owner and a release date, or the list only grows.
Clean what misleads. Old drafts, duplicates and sites nobody owns stay within Copilot's reach as long as people can open them, and they can end up in answers. SharePoint Advanced Management can flag inactive or ownerless sites, ask owners to confirm them, then set them to read-only or archive them. Its inactive site policies email owners each month and cover SharePoint and Teams sites, not OneDrive. Agree with the business what counts as stale before anything is archived.
Older guidance may also mention Restricted SharePoint Search. Restricted SharePoint Search is being retired in favour of Restricted Content Discovery, so plan with the latter.
Ready when: every restricted site has an owner and a release date, and inactive sites in scope have an owner decision.
Who may create and share agents?
Decide this before the pilot, because agents arrive with Copilot. People with a Copilot licence can create agents from SharePoint sites and files, and an agent only uses content its user is allowed to open. Makers can also build agents in Copilot Studio.
Three places to check:
- The agent registry in the Microsoft 365 admin center lists the agents available in your organisation. The registry and basic actions, such as approving, blocking or reassigning an owner, come with Microsoft 365 plans.
- Power Platform data policies apply to Copilot Studio agents in every tenant. Admins can block public website knowledge, unauthenticated agents or HTTP calls, or allow only approved sites.
- In Managed Environments, admins can stop makers sharing an agent with whole groups and cap how many people can use it. These limits apply to agents that require sign-in.
The Power Platform inventory lists every agent, app and flow in the tenant, and lets admins block a published agent while they investigate. Our AI governance page covers the rules that follow: an owner, a purpose and an end date for each agent.
Ready when: existing agents are listed with their maker, public website knowledge is blocked or limited to approved sites, and someone is named to approve wide sharing.
Is audit switched on?
Check it before the first prompt, not after the first question from legal. Copilot interactions are recorded in the Microsoft Purview audit log, including which files were used. That record is how you answer a question such as which documents fed a given response.
Run a simple test. Ask a pilot user to try Copilot on a few files, then search the audit log for Copilot interaction records from that account. Then write down who runs that search after go-live, on what schedule, and which findings go to a site owner.
Ready when: a test search returns the pilot user's Copilot interactions, and the review has an owner.
Are people ready?
The tools are only half the check. The EU amended the AI Act in July 2026 and simplified its AI literacy rule without removing it: organisations using AI are still expected to take measures that support AI literacy among their staff. A pilot is the natural place to start.
Keep the pilot session short and practical:
- How Copilot builds an answer from content the user can already open
- Which drafts need a second reader before they leave the company
- What stays out of prompts, such as credentials or personal data you would not email
- Where to report a file Copilot should not have shown, and who picks it up
Treat those reports as findings: each one names a site whose sharing needs fixing, so route it to the site owner rather than closing it as a Copilot issue.
Ready when: pilot users have had the session, know the reporting route, and someone owns the reports that come in.
How do you stay ready after go-live?
By turning each check into a routine. New sites, shares and agents appear every day, and a tenant that was ready for the pilot drifts unless someone keeps checking.
This is the Keep it ready step. Give every line of the checklist an owner and a frequency, move the rules that work from report mode to enforcement in waves, and review agents with the same care as sites. Our guide to Copilot governance best practices covers what to run once Copilot is live.
How Neptune helps
Neptune is an integrator. We select the governance tool that fits your tenant and licences, implement it, and read the first inventory with you, site by site. That inventory maps the sites, teams and files Copilot could draw on, starting with sensitive content that carries no label. "Anyone" links, external shares and guests are ranked by risk and sent to each site owner. Outdated, duplicate and orphaned content is flagged before Copilot can turn it into a wrong answer, and Copilot seats held by disabled or inactive accounts are listed so they can go to the pilot group.
Owners review and approve in Microsoft Teams, so IT is no longer the bottleneck, and each decision is recorded. We train your admins to run the rules and your site owners to review their own sites. After rollout, the same checks keep running, we stay reachable to tune them and keep pace with Microsoft changes, and a customer success manager follows up once the project ends.
Sources
- License options for Microsoft Copilot
- Expanding Copilot for Microsoft 365 to businesses of all sizes (Microsoft 365 blog, 15 January 2024)
- Copilot Business FAQ
- Manage Microsoft Copilot Chat
- Microsoft Copilot requirements
- Data, privacy and security for Microsoft Copilot
- SharePoint Advanced Management prerequisites
- SharePoint Advanced Management features included with Copilot
- Data access governance reports
- Site access review
- Restricted Content Discovery
- Restricted SharePoint Search
- Site lifecycle management
- Inactive site policies
- Manage access to agents in SharePoint
- Agent registry
- Microsoft Agent 365 service description
- Data policies for Copilot Studio
- Sharing controls and limits in Copilot Studio
- Power Platform inventory
- Audit logs for Copilot and AI applications
- AI Omnibus enters into force (European Commission)
- Regulation (EU) 2026/1744 (AI Omnibus), Official Journal
