Copilot readiness audit: what we found before the first licence

What a Copilot readiness audit reveals before the first licence

A public sector organization asked us for a Copilot readiness audit before buying a single licence. More than a thousand accounts, no Copilot licence in place. We then worked through the findings in workshops with its IT team. Here is what we found, in the order it surprised us.

The first blocker was not security

You expect a Copilot audit to start with exposed data. Here, the first finding was more down to earth: most staff simply could not use Copilot in their Office apps.

The rest of the platform held up, with the vast majority of controls compliant. But an organization that buys licences at this stage pays for a tool half its people cannot see. The three findings:

• Fewer than a third of users had adopted the Office desktop apps. Many worked on mobile only.
• Fewer than half of the accounts were on an eligible update channel. Microsoft's Copilot readiness report only counts users on Current Channel or Monthly Enterprise Channel as ready. Good news: since version 2606 (July 2026), Microsoft is merging the Semi-Annual channel into Monthly Enterprise.
• Products Microsoft has retired were still licensed.

Oversharing was concentrated, not widespread

The data side painted a different picture than you might expect. Not a problem everywhere: a problem in one specific place.

A single shared site held more than 90% of the tenant's files labelled "unrestricted". The same site contained about twenty files labelled confidential but with no protection applied, and active links to specific external people. Several sites had no identified owner.

That is good news in disguise: a targeted clean-up removes most of the risk. Copilot answers in the user's security context, so it only shows what that person can already open. The danger is everything they can open without knowing it.

There was a blind spot too: without SharePoint Advanced Management, you cannot generate the reports on "anyone" links and on the "Everyone except external users" group. SharePoint Advanced Management is included with the Copilot licence, which changes the math.

What we fixed in the workshops

The remediation plan was split into three horizons: 30, 90 and more than 90 days. With the client's IT team, we moved forward on:

• Deploying the Office desktop apps to the devices that did not have them.
• Fixing the update channel for blocked accounts.
• A Conditional Access policy dedicated to the Copilot pilot group, with MFA.
• Reviewing high-risk admin roles.
• Revising sensitivity labels, with staff communication planned before rollout.
• Data loss prevention (DLP) configured on a pilot group, never on everyone at once: a rule that is too broad blocks normal work, like copying data from one HR file to another.

Label everything first, or move in blocks?

The most useful debate came later in the workshops. The IT team asked the right question: if Copilot sees everything the user sees, do you need to classify all your data before opening licences? For a department that touches almost every site, like HR or senior management, that would mean never being ready.

The approach we settled on: roll out in blocks. Start with the IT team to break in the process, fix what gets stuck, then expand department by department. For each block, structure the data it touches. In parallel, a DLP policy on the Copilot location prevents the tool from processing files and emails that carry certain labels, even when the user has access. This feature requires an E5 or A5 level licence.

“For a test, you pick specific users. To roll out at scale, you have to go and fix things everywhere.”

- Microsoft 365 Specialist, io4

What any organization can take from this

• First check whether your people can use Copilot at all: desktop apps, update channel, base licences. Here, that is where the project was stuck.
• Find where exposure is concentrated before launching a global classification project. Here, a single site carried most of the risk.
• Pilot Copilot and DLP on the same small group, then expand department by department.
• Tell staff before rolling out labels.

A workplace project before a licensing project

Copilot is not first and foremost a licensing project. It is a workplace and access governance project, and the readiness audit tells you which of the two is the bigger job in your organization.