Licensing fit

Which base plan do most of the people who will use Copilot have?

Microsoft 365 or Office 365 E plan (E3, E5) Microsoft 365 E7 Microsoft 365 Business plan (Basic, Standard, Premium) Frontline plan (F1, F3) Education plan (A1, A3, A5) Government plan (G plans in GCC, GCC High or DoD) A standalone Exchange, SharePoint, OneDrive or Teams plan Microsoft 365 Apps on device-based licensing A consumer plan, or no Microsoft 365 plan Not sure

How many people will need Copilot?

Up to 300 More than 300 Not sure

What do you want people to have first?

Copilot Chat comes with eligible plans at no extra cost; the full Copilot is a paid add-on or part of E7.

Copilot Chat only Copilot Chat plus agents that use company data Full Copilot for a pilot group Full Copilot for everyone

Identity and core services

Do all the people who will use Copilot sign in with Microsoft Entra work accounts?

Yes, all of them Some still use local or on-premises-only accounts No Not sure

Where are their mailboxes?

All in Exchange Online Hybrid, most in Exchange Online Mostly on-premises Exchange Not sure

Do they have OneDrive?

Yes Some of them No Not sure

Which Microsoft 365 Apps build do their computers run?

Current Channel or Monthly Enterprise Channel Semi-Annual Enterprise Channel Office LTSC or another perpetual version Web apps only Not sure

Network and clients

Is the whole *.cloud.microsoft domain allowed, with WebSockets, and not broken by TLS inspection?

Microsoft provides a connectivity test for Copilot.

Yes, tested with the connectivity test Partly, or not tested Blocked, or only some addresses allowed Not sure

Are third-party cookies allowed for the Office web apps and Safe Links?

Yes Blocked by policy Not sure

Oversharing exposure

Have you run an oversharing assessment?

For example the SharePoint Advanced Management content assessment, data access governance reports or a Purview data risk assessment.

Yes, in the last 30 days Yes, longer ago Never Not sure

What did it show, or what do you expect?

Few broad links, and every site has an owner Some sites open to everyone and some without owners Many sensitive sites shared broadly Not sure

Are your sharing defaults tightened?

"Anyone" links restricted and company-wide links limited. SharePoint starts with the most permissive setting.

Yes Partly No, still the defaults Not sure

What protects high-risk sites while you fix them?

Restricted Content Discovery Restricted SharePoint Search Nothing yet Not needed: the sites are fixed Not sure

Data protection

Do you use sensitivity labels?

Yes, with automatic labeling Yes, applied by hand No Not sure

Is data loss prevention set up for Copilot?

Yes Planned No Not sure

Which security and compliance tier do you have?

E5 or E7 E3 Business Premium Business Standard or Basic Not sure

Governance and compliance

Have you decided audit and retention for Copilot interactions?

Yes In progress No Not sure

Is an AI usage policy published to staff?

Yes A draft exists No Not sure

Do regulations apply to how you use AI?

For example sector rules or the EU AI Act.

Yes, and we have assessed them Yes, not assessed yet No Not sure

Adoption readiness

Is an executive sponsor named?

Yes No

Have you chosen champions or early adopters from one team or process?

Yes Not yet

Have you picked the first scenarios, with ways to measure success?

Yes, with a baseline to compare against Picked, no measures yet No

How will you measure use and impact?

The Copilot Dashboard Admin usage reports only No plan yet

Agents and cost control (optional)

Will people without a Copilot license use agents that read SharePoint or connected data?

Yes No Not sure

Is usage-based billing set up with spending limits?

Yes, with limits, and automatic opt-in to new services reviewed Yes, without limits No

Who can create and share agents?

Restricted, with admin approval Everyone (the default) Not sure

Is your organization ready for Microsoft Copilot?

Licensing fit

Identity and core services

Network and clients

Oversharing exposure

Data protection

Governance and compliance

Adoption readiness

Agents and cost control (optional)

Your result

Was this page useful?

Suggest a correction

Thank you. Your correction was sent.

Licensing fit

Identity and core services

Network and clients

Oversharing exposure

Data protection

Governance and compliance

Adoption readiness

Agents and cost control (optional)

Your result

Was this page useful?

Suggest a correction

Thank you. Your correction was sent.

Fill out the form below to request your copy.