We help you switch on Microsoft 365 Copilot safely, by fixing who can see what across SharePoint, Teams and OneDrive before Copilot makes it searchable.
Data loss preventionPolicy running in test modeManaged
Guest accessExpired project guests removedManaged
Admin rolesAdmin role removal to approveDecision needed
Copilot pilotActivity logs reviewedManaged
Illustration · not live data
01Who it's for
Is this service right for you?
It suits organisations on Microsoft 365 that plan to switch Copilot on and haven't recently reviewed who can access what.
Built for
Businesses with 5 or more staff on Microsoft 365
Government, health, legal and finance teams
IT managers and the people who look after IT
You probably need it if…
You're planning to buy or trial Microsoft 365 Copilot licences
SharePoint, Teams and OneDrive have grown for years without a permissions review
You hold sensitive HR, finance, health, legal or client records in Microsoft 365
Leadership has asked IT to turn Copilot on, and you want to do it safely
02What's included
What you get
Protect your data
Oversharing and permissions audit
We review SharePoint sites, Teams, OneDrive sharing links and group memberships to find content shared with everyone, external guests or broad groups. You get a ranked list of exposures, starting with the most sensitive data.
Sensitivity labels with Microsoft Purview
We design a short, practical set of Microsoft Purview sensitivity labels and apply them to your most sensitive locations first. Labels can restrict who opens a file, and Copilot honours those restrictions when it uses content.
Data loss prevention policies
We configure Microsoft Purview data loss prevention (DLP) to detect and block sensitive information, such as tax file numbers or health records, from being shared in ways it shouldn't. Policies start in test mode, so you can see their effect before anything is blocked.
Access & clean-up
Identity and access check
A review of Microsoft Entra ID, multi-factor authentication (MFA), conditional access and admin roles. Copilot is only as safe as the accounts using it, so a compromised account must not become a search engine for your data.
Retention and stale content clean-up
We help you set retention policies and archive or remove old content, so Copilot draws on current, accurate information rather than outdated drafts and abandoned project sites.
Roll out
Pilot, rollout and staff training
A phased rollout plan with a pilot group, a short Copilot usage policy and training on writing good prompts, checking outputs and knowing what not to ask Copilot to do.
03In detail
Copilot readiness, in depth
What is Copilot readiness?
Copilot readiness is the security and data work that decides what Copilot can reach once it is on. We treat it as a data protection project first and a productivity project second.
Why does Copilot expose oversharing?
Copilot searches across SharePoint, OneDrive, Teams, Exchange Online and other Microsoft 365 content the user can reach, then summarises what it finds. It doesn’t break permissions: Microsoft’s data, privacy and security documentation for Microsoft 365 Copilot explains that it only surfaces data the user already has permission to access. It makes existing permissions visible: without Copilot, few people stumble across an overshared folder; with Copilot, anyone with access can ask for “the latest salary review” and get an answer.
That is why the audit ranks exposures by the sensitivity of the data, not by the number of files. For example, a finding might read: “HR site shared with all staff through an everyone group, including salary and performance records. Fix: remove the group, restrict the site to HR and apply a Confidential label.”
Which Microsoft 365 controls limit what Copilot can reach?
Beyond permissions, Microsoft 365 has controls aimed at Copilot itself. DLP policies can stop Copilot from using files with your most sensitive labels, or from processing prompts that contain sensitive information, depending on your licence. SharePoint Advanced Management is included with Microsoft 365 Copilot licences, so we use its data access governance reports and Restricted Content Discovery to find and hide overshared sites, and Restricted SharePoint Search to limit Copilot to approved sites during the pilot. Microsoft’s Microsoft 365 Copilot deployment blueprint for oversharing recommends a similar sequence: find high-risk sites, restrict access in the meantime, then fix the permissions. We can check and supply the plans you need through software licensing.
Readiness is not a one-off. New sites, guests and sharing links keep appearing. We help you set up a regular access review and alerts for risky sharing, so your tenant is far less likely to drift back to where it started. Our Microsoft 365 team can run those reviews as part of ongoing administration.
For the governance side, including an AI acceptable use policy that covers Copilot alongside other tools, see AI security and governance.
04The process
How it works
1Step 01
Assess
We run the readiness checklist across your tenant and report the gaps, ranked by risk, with a written quote to fix them.
2Step 02
Remediate
We fix oversharing, apply labels and DLP, tighten identity settings and clean up stale content, highest risk first.
3Step 03
Pilot
A small group uses Copilot with monitoring switched on, and we check what it surfaces before wider release.
4Step 04
Scale
Copilot rolls out to more users in waves, with training for each group and a review of activity logs after each wave.
05Frameworks
How this maps to the frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
Price depends on the number of users, SharePoint sites and Teams in your tenant, how much external sharing and guest access exists and whether you already use Purview labels or DLP. Remediation is quoted separately once the gaps are known.
Oversharing and permissions audit across SharePoint, Teams and OneDrive
Is Microsoft 365 Copilot safe for our business data?
Copilot works within your existing Microsoft 365 permissions, so it is only as safe as those permissions are. It doesn't give users access to anything new, but it makes existing access much easier to use. If a salary spreadsheet is shared with everyone, Copilot can find it and summarise it. Fixing oversharing before rollout is the main safety step.
What is oversharing in Microsoft 365?
Oversharing is when files, sites or Teams are accessible to more people than need them. Common causes are sharing links set to anyone in the organisation, sites with an everyone group added, guests who were never removed and old project sites nobody owns. It can build up quietly over years and go unnoticed until a tool like Copilot makes it easy to search.
Do we need sensitivity labels before using Copilot?
They are strongly recommended for your most sensitive information. Microsoft Purview sensitivity labels mark content as confidential, can encrypt it and limit who opens it, and Copilot honours those restrictions. You don't need to label everything on day one. We start with the locations that hold the most sensitive data, such as HR, finance and client records.
How long does a Copilot rollout take?
It depends mostly on how much permissions clean-up your tenant needs. The assessment shows the size of the job. A tenant with tidy permissions can move to a pilot quickly, while one with years of open sharing needs remediation first. We recommend a pilot group before a full rollout in every case, so you can check what Copilot surfaces.
How much does a Copilot readiness assessment cost in Australia?
Copilot readiness is quoted after a scoping call, and you see the price before any work starts. The assessment cost depends on the number of users, SharePoint sites and Teams, how much content is shared with everyone in your organisation and whether sensitivity labels already exist. Fixing the gaps it finds is quoted separately, once their size is known.
Can you supply Microsoft 365 Copilot licences?
Yes. We supply and support Microsoft licences, including Copilot add-ons, through our software licensing service. We can also check which Microsoft 365 plans your users are on and whether those plans include the Purview and Entra ID features the readiness work relies on, so you don't buy Copilot licences before the foundations are in place.
Does Copilot readiness help with ASD Essentials?
Yes, in part. The identity work in a readiness project, including multi-factor authentication and restricting administrative privileges, supports two of the strategies ASD prioritises directly, and the identity services domain in ASD Essentials. The permissions, labelling and DLP work goes further, and supports ISO/IEC 27001:2022 controls on access, classification and data leakage prevention.
