Copilot readiness assessment: fix what Copilot can see before you switch it on

A Copilot readiness assessment checks what Microsoft Copilot (formerly Microsoft 365 Copilot) could find in your tenant before you switch it on: what is shared and with whom, what is stale or unlabelled, who holds a licence and uses it, and which agents already exist. It is the first step of the rollout, and its checks keep running afterwards.

Last reviewed:

Talk to us about Copilot readiness Read the FAQ
Example dashboard: 70% of sites carry a sensitivity label: 214 Confidential, 402 Internal and 96 Public. External access review: 37 of 41 owners have answered, 412 guests keep access and 26 lose it.

Sensitivity label coverage

70%

Sites labelled

  • Confidential 214 sites
  • Internal 402 sites
  • Public 96 sites

External access review

Recorded for audit

  • Owners answered 37 of 41
  • Keep access 412
  • Remove access 26

Example data, for illustration only

The risks

Why most tenants are not ready for Copilot

Copilot works with the tenant you already have. Five problems tend to show up as soon as it is switched on.

  • Sharing nobody can see

    Years of "Anyone" links, organisation-wide links and external shares build up site by site. Nobody has the full picture, and Copilot makes that content easy to find.

  • Content that misleads

    Outdated, duplicate and orphaned files stay within reach as long as people can open them, and they can end up in answers.

  • Licences in the wrong place

    Copilot is an add-on licence. Seats end up on accounts that never open it, or stay with people who have left.

  • Agents that multiply

    People with a Copilot licence can create agents from SharePoint sites and files, and makers build more in Copilot Studio. Many are never reviewed.

  • Reviews that cannot keep up

    Access reviews kept in spreadsheets happen when someone finds the time. New sites, files and shares appear every day, far faster than anyone can check by hand.

The assessment

The Copilot readiness assessment, step by step

The assessment is the first step of the rollout, not a separate audit. The governance tool we put in your tenant runs the first inventory, and we read the results with you.

  1. Step 1

    Map sharing

    We check "Anyone" links, external shares and guests, site by site. You get a ranked list of the sites where Copilot would surface too much.

  2. Step 2

    Label what matters

    We check which sensitive sites and libraries have no sensitivity label. You get the list to label first, with the owner of each site.

  3. Step 3

    Clean what misleads

    We check for stale, duplicate and orphaned content. You get the spaces to archive or delete before they feed wrong answers.

  4. Step 4

    Let owners decide

    Each site owner gets a short review: keep or remove each risky share. You get recorded decisions, instead of IT guessing.

  5. Step 5

    Right-size licences

    We check who holds a Copilot licence, who uses it and which seats sit on inactive or disabled accounts. You get a pilot group and a list of seats to reassign.

  6. Step 6

    Keep it ready

    Daily rules keep watching sharing, labels, content and agents after rollout. You get checks that keep running, not a one-off report.

What we check

What does a Copilot readiness assessment cover?

Five areas, checked by the governance tool in your tenant: first for the assessment, then every day.

Oversharing and external access

Sharing is checked first, because Copilot surfaces what is shared.

Copilot oversharing starts with SharePoint oversharing. Copilot only shows people content they can already open, so overshared content becomes easier to find. The first inventory lists "Anyone" links, external shares and guests on every site. Each site owner then keeps or removes the risky shares, and the decision is recorded.

What we check

  • "Anyone" links, with and without expiry
  • External shares and guest accounts
  • Sharing on the sites Copilot can reach
  • Microsoft's data access governance reports, where you have them

How we deliver it

  • We rank sites by exposure and start with the worst.
  • Owners get a plain request, not a ticket.
  • Where needed, Restricted Content Discovery keeps a site out of Copilot while permissions are fixed.
  • We agree default sharing settings that make the next overshare less likely.

External access review

  • Translation agency guest Keep
  • Pricing sheet, "Anyone" link Remove
  • Merger site, external share Pending
  • Event team guest Keep
Example data, for illustration only

Sensitivity labels

Sensitive sites carry a label before Copilot reads them.

Labels only protect what they are applied to. Rules list the sites and libraries that should carry a sensitivity label but do not, and ask their owners to apply the right one. The labels you already use in Microsoft Purview stay as they are, and coverage is tracked over time.

What we check

  • Sites and libraries without a sensitivity label
  • Label coverage, tracked over time
  • The label taxonomy you already have

How we deliver it

  • We start from your existing labels.
  • Site owners are asked to label, by a date agreed with you.
  • Coverage is reported to you on a schedule.

Label coverage by site type

  • Team sites 78%
  • Communication sites 64%
  • Hub sites 92%
  • Private channel sites 41%
Example data, for illustration only

Stale and ownerless content

Old, duplicate and ownerless content stops feeding answers.

Old drafts, duplicates and spaces nobody owns stay within Copilot's reach as long as people can open them, and can end up in its answers. Rules flag sites and teams without an active owner, content left untouched for a period you set and duplicate documents. The owner decides to keep, archive or delete.

What we check

  • Sites and teams without an active owner
  • Content not modified for a period you set
  • Duplicate documents across sites
  • Inactive sites still in Copilot scope

How we deliver it

  • We agree with you what counts as stale, by type of site.
  • Owners decide: nothing is deleted without them.
  • Archiving follows a documented runbook.

Licences and pilot group

Copilot licences go to a pilot group that will use them.

Copilot is a paid add-on, so every idle seat costs money. Before you buy more, we compare who holds a licence with who uses it, list the seats on inactive or disabled accounts, and help you pick a pilot group whose content is already in order.

What we check

  • Eligible plans across your users
  • Assigned and active Copilot licences
  • Seats on disabled or inactive accounts
  • A pilot group, chosen with the business

How we deliver it

  • We check eligibility against your current plans.
  • Seats are reclaimed through a documented process.
  • The pilot group is trained on its own data.

After rollout

The tenant stays ready after rollout, agents included.

Readiness does not last on its own: new sites, shares and agents keep appearing. The same rules keep running every day after rollout. New oversharing, unlabelled sites and idle licences go to the right owner, and agents without an owner are flagged for IT to assign one. For agents, AI governance takes over with the same tool.

What we check

  • Daily checks on sharing, labels and content
  • Licence use after rollout
  • New agents in Copilot Studio and SharePoint
  • A trend you can show management

How we deliver it

  • Rules move from report mode to enforcement in waves.
  • Your admins learn to tune the rules.
  • We stay reachable after go-live.

Readiness assessment

4 of 6 steps

  • Sharing mapped
  • Sensitive sites labelled
  • Stale content cleaned
  • Owner reviews completed
  • Licences right-sized
  • Daily rules switched on
Example data, for illustration only

Before and after

Before and after the Copilot rollout

The assessment comes first. The same checks then run every day, so the tenant does not drift back.

AreaBefore rolloutAfter rollout
Sharing Risky links and external shares mapped, then reviewed by site owners. New overshares flagged every day and sent to the owner.
Labels Sensitive sites without a label found and labelled. New sites checked for a label every day.
Content Stale, duplicate and ownerless content archived or deleted. Inactivity rules keep spaces owned and current.
Licences Pilot group chosen, idle seats reassigned. Use tracked, seats moved to the people who use them.
Agents Existing agents listed with their maker and sources. AI governance rules: owners, reviews and end dates.

Prerequisites

What does Copilot need from your tenant?

Microsoft's technical prerequisites are short. Most of the work is in the state of your content.

  • An eligible licence

    Microsoft Copilot is an add-on licence for an eligible Microsoft 365 or Office 365 plan, including the E3, E5 and Business plans. There is no minimum number of seats.

  • Accounts, apps and network

    Copilot needs Microsoft Entra ID accounts, supported Microsoft 365 apps and network access to Microsoft 365. Some features need OneDrive.

  • Permissions you can stand behind

    Copilot answers from what each person can already open, so overly broad permissions need fixing before rollout, not after.

  • Labels and SharePoint controls

    When sensitivity labels encrypt content, Copilot respects each user's usage rights. SharePoint Advanced Management is available once at least one user has a Microsoft Copilot licence.

How Neptune delivers

An assessment you act on, not a report you file

The assessment comes from the governance tool we put in your tenant. We stay for the clean-up, and after it.

  • Select

    We choose the governance tool that suits your tenant, your licences and your plans for agents. We work with several vendors, not one.

  • Assess

    The tool runs the first inventory in your tenant. We read the results with you, site by site.

  • Prioritise

    You get a remediation plan ranked by risk and effort, so the worst exposure is fixed first.

  • Train

    Site owners learn to review access and apply labels on their own sites. Your admins learn to run the rules.

  • Support

    We stay reachable after rollout, tune the rules and keep pace with Microsoft changes.

FAQ

Copilot readiness questions, answered.

What does Microsoft 365 Copilot readiness involve?

Getting ready means checking that permissions match what each person should see, labelling sensitive content, clearing out stale files, giving licences to a pilot group that will use them and listing the agents that already exist. A readiness assessment covers all of this in one pass, and daily rules keep it that way. Microsoft 365 Copilot is now called Microsoft Copilot.

What is a Copilot readiness assessment?

It is an inventory of what Copilot would be able to reach in your tenant: sharing, sensitivity labels, stale and ownerless content, licences and agents. With Neptune it is the first step of the rollout, produced by the governance tool we put in place, not a separate audit. The findings become a remediation plan, and the same checks keep running afterwards.

Which licences do we need for Copilot?

Microsoft Copilot is an add-on licence for an eligible Microsoft 365 or Office 365 plan, including the E3, E5 and Business plans, and there is no minimum number of seats. Organisations with up to 300 users on a Microsoft 365 Business plan can choose Copilot Business.

Copilot Chat is included for work accounts on eligible plans. Copilot grounded in your work data needs a Microsoft Copilot licence. We check eligibility against your current plans before you buy.

Is our tenant ready for Copilot?

A tenant that has been in use for years usually carries broad sharing, stale content and uneven labels, simply because nobody had a reason to look. The first inventory answers the question with your own data, site by site, and ranks what to fix first.

How do we fix SharePoint oversharing before Copilot finds it?

Start with the sites that matter most. Data access governance reports in the SharePoint admin center show where sites may be overshared, and can start a site access review with the owner. Restricted Content Discovery keeps a site out of Copilot and organisation-wide search without changing who has access; Microsoft describes it as a temporary control while permissions are fixed.

A governance tool then repeats the owner reviews on a schedule and flags new risky links every day.

Can we keep the sensitivity labels we already have?

Yes. We start from your existing labels in Microsoft Purview and look for the sites and libraries that should carry one but do not. When labels encrypt content, Copilot respects each user's usage rights, so labelling the right places matters more than adding new labels.

Does Copilot readiness stop at rollout?

No. The same rules keep running every day: new oversharing, unlabelled sites, idle licences and new agents are flagged and sent to their owners. Agents then fall under AI governance, with owners, reviews and end dates.

Related pages

Insights

Further reading

All insights

Talk to us about Copilot readiness.

Tell us where you are with Copilot: planning, piloting or already live. We will explain how the assessment would run in your tenant and which tool fits.

Contact us Explore Microsoft 365 governance