Copilot readiness: prepare your Microsoft 365 for Copilot

What a Copilot readiness assessment does

A Copilot readiness assessment checks that your Microsoft 365 is safe and ready for Copilot before you pay for it. It reviews licences, sign-in security, who can open which files, sensitivity labels and retention, then sets up a pilot and training plan. The aim is simple: Copilot should only work with what each person is meant to see.

Many Kenyan organisations have run Microsoft 365 for years without a close look at file sharing. Folders were shared with “everyone” to get a job done, staff left without their files being moved, and old project sites were never closed. None of that caused much harm while files were hard to find. Copilot changes that, because anyone can now ask a plain-language question and get an answer drawn from every file they can open.

We prepare your tenant with you so that, when Copilot goes live, it is useful from the first day and does not expose payroll, HR records or client files to the wrong people. It is one step in how we walk with you on Microsoft Copilot, from choosing licences to measuring how much your staff actually use it. Paid Copilot licences are new in many markets, so we confirm availability for your tenant and plan before you commit.

Copilot readiness checklist

Work through these eight checks before Copilot reaches your staff. Most organisations can do the first few quickly; permissions and labels usually take the most care.

1. Licences and eligible plans. Each paid Copilot user needs a Copilot licence on top of a qualifying Microsoft 365 plan, and Copilot Chat is available to users with an eligible Microsoft 365 subscription. Microsoft also lists a work account in Microsoft Entra ID, an Exchange Online mailbox for email and calendar features, a OneDrive account for some features, current Office apps and a network that does not block Copilot traffic (Microsoft Learn: Microsoft Copilot requirements, checked 4 October 2026). For organisations of up to 300 users, the choice is usually the Copilot Business add-on or a “with Copilot” bundle.
2. Identity and multifactor sign-in. Copilot can reach everything a user can reach, so a stolen password becomes more damaging. Switch on multifactor sign-in for everyone, remove accounts belonging to staff who have left, and review who holds admin roles. Business Premium adds conditional access to block risky sign-ins and unmanaged devices.
3. Permissions and oversharing review. Find SharePoint sites, Teams and OneDrive folders that are shared more widely than they should be: “anyone with the link” shares, sites open to the whole company, broken permission inheritance, and sites with no owner or no recent activity. Microsoft’s guidance is to identify the riskiest sites first, limit what Copilot can draw from them while you fix them, then remove the excess access and give every site an accountable owner. SharePoint Advanced Management, which is included with Microsoft 365 Copilot, helps with site access reviews.
4. Sensitivity labels. Agree a short set of labels, such as Public, Internal, Confidential and Highly confidential, and apply them to board papers, HR records, payroll and client files. Labels with encryption limit who can open a file, and Copilot respects those limits. Business Premium includes Microsoft Purview Information Protection and data loss prevention for this.
5. Data retention. Decide how long to keep files, email and Copilot interactions, and remove what you no longer need. Microsoft notes that clearing out old and obsolete content also improves the quality of Copilot’s answers. Keep an independent backup too, so a deletion or ransomware attack does not cost you records you must keep.
6. The Data Protection Act angle. If you handle personal data of clients, members, patients, students or staff, the Data Protection Act 2019 applies. Tight permissions, sensitivity labels, data loss prevention and audit logs are technical controls that help you protect that data around Copilot. They are one part of compliance: you also need your own policies, processes and, where needed, legal advice.
7. Pilot group. Choose a small group of staff from different teams, such as finance, HR, operations and leadership, who will use Copilot on real work. Agree in advance which tasks they will try and how you will judge whether Copilot helps, then use what you learn to decide who gets licences next.
8. Training. Plan practical sessions on writing clear prompts, checking Copilot’s output and handling confidential information. Microsoft’s onboarding guide suggests welcoming users with clear guidance and collecting their feedback after licences are assigned (Microsoft Learn: Copilot adoption and onboarding guide for IT admins, checked 4 October 2026). Our training and advisory service builds sessions around your own tasks.

Start with Microsoft’s own readiness report

Before anyone reviews your tenant, your administrator can open Microsoft’s free Copilot readiness report in the Microsoft 365 admin center, under Reports, then Usage, then Microsoft Copilot. It shows how many users hold a qualifying licence, how many are on an app update channel that Copilot needs (Current Channel or Monthly Enterprise Channel), and which users are active in Teams, Outlook and Office documents. Once you have bought Copilot licences, it also flags suggested pilot candidates based on how heavily people use those apps (Microsoft Learn: Microsoft Copilot readiness report, checked 4 October 2026).

The report covers licences, devices and usage. It does not tell you which SharePoint sites are overshared or which files hold personal data, which is why the permissions, labels and retention checks above still matter. While those reviews run, Microsoft describes restricted content discovery in SharePoint Advanced Management as a way to keep specific sites out of Copilot’s answers until they are tidied (Microsoft Learn: What is Microsoft Copilot?, checked 4 October 2026).