The oversharing review nobody wants to do, why sensitivity labels come before licences, and how to pick the two use cases per team that actually save time.
Most Copilot deployments we are called into have the same shape. Licences were bought, the tenant was told, an email went round, and three months later usage reports show a handful of people using it to summarise meetings they were already in. Nobody is against it. Nobody is using it either.
That is not a technology failure. It is what happens when a capability is switched on rather than rolled out.
Copilot can read everything your worst-permissioned user can read.
It honours existing permissions exactly — it does not grant new access, and that is the point people miss. If a SharePoint site is shared with “everyone in the organisation” because somebody needed a file in a hurry in 2021, Copilot will cheerfully summarise it when asked a reasonable question.
Nothing was breached. The oversharing was always there. Copilot just made it trivially easy to find, and turned a latent problem into an immediate one.
So the first phase of a Copilot rollout is not about Copilot at all.
Every site, folder and link shared organisation-wide or anonymously. In most tenants of any age this list is longer than anyone expects and contains at least one thing that makes somebody wince. Fix the worst, review the rest, and set a policy so it stops accumulating.
Where the estate is large enough to warrant it, SharePoint Advanced Management gives you site access reviews and restricted content discovery, which turn this from a manual crawl into a managed process.
Sensitivity labels through Purview, published to the people who will actually apply them. The temptation is a beautiful taxonomy of eleven labels. Resist it. Three or four labels that people use beat eleven that they ignore.
Retention and disposal, so Copilot is not confidently summarising a superseded contract from 2019 because it is the most detailed document on the topic. This is unglamorous and it materially improves answer quality.
What staff may and may not put into AI tools, which tools are approved, and what happens with client data. Most businesses we assess have people pasting client information into public chatbots right now with no guidance at all.
This one is no longer optional if you certify: SMB1001 Gold added a written policy for responsible and secure AI use in the 2026 edition.
The single biggest predictor of adoption is whether somebody was shown a specific thing that saves them time on a job they actually do. “Copilot can help with lots of things” is not that. “Here is how you get the action items out of a Teams meeting you missed” is.
Good candidates we see land consistently: meeting recaps and action items, first drafts of proposals from an existing template plus notes, inbox triage on a Monday morning, and turning a messy spreadsheet into a summary a manager can read.
Pick people who will use it, not people who asked loudest and not one representative from each department for the sake of symmetry. Ten enthusiastic users produce a case study. Forty assigned users produce a usage report that makes the case against.
Two things: are they using it, and did the task get faster. If the honest answer at ninety days is no, hand the licences back. We would rather tell you that than renew something that is not working — and being willing to say it is why clients let us near their tenants.
It is strong at summarising, drafting and finding things across content it can see. It is weak at anything requiring precision from a system it cannot see — your ERP, your practice management software, your job costing. If someone is expecting it to answer “what did we invoice this client last quarter”, they will be disappointed, and that disappointment tends to spread.
It also has no idea what it does not know. It will produce a fluent answer from thin source material, which is exactly why the data cleanup earns its keep.
For a good number of roles, the Copilot Chat that is already included covers the actual need. If someone wanted a better way to find things and draft short pieces of text, a per-seat licence is not what they were asking for.
Work out who genuinely benefits before ordering. It is a smaller number than the list you will be handed, and right-sizing at the start avoids the much harder conversation at renewal.
Australia now has a cyber security standard written for businesses with no security team. Here is what the five tiers actually ask for, which one you should aim at, and what changed in the 2026 edition.
Read the article
ContinuityGreen ticks are not evidence. What a real restore test looks like, how often to run one, and the three failure modes that only ever show up during an actual recovery.
Read the article
SecurityEight controls, three maturity levels, and a lot of businesses paralysed by the grid. Which ones to do first when you are a forty-person company, not a federal agency.
Read the article
The assessment is free, takes about ninety minutes on site, and ends with a written summary of what we found — yours to keep either way.
No obligation. We will tell you if you do not need us.
