Call
Talk to an expert

Secure AI

Microsoft 365 Copilot Readiness

We help you switch on Microsoft 365 Copilot safely, by fixing who can see what across SharePoint, Teams and OneDrive before Copilot makes it searchable.

Ask about Copilot Readiness
Your Microsoft 365 tenantSample view
  • HR SharePoint siteEveryone group removedContained
  • Sensitivity labelsConfidential label appliedManaged
  • Data loss preventionPolicy running in test modeManaged
  • Guest accessExpired project guests removedManaged
  • Admin rolesAdmin role removal to approveDecision needed
  • Copilot pilotActivity logs reviewedManaged
Illustration · not live data

In short

Microsoft 365 Copilot readiness is the work you do before switching Copilot on, so it is less likely to surface files people shouldn't see. Copilot can show users anything they have access to. Catharsis, a Sydney cyber security company certified to ISO/IEC 27001:2022, finds oversharing, tightens permissions, sets up sensitivity labels and data loss prevention, then plans a phased rollout.

01Who it's for

Is a Copilot readiness assessment right for you?

It suits organisations on Microsoft 365 that plan to switch Copilot on and haven't recently reviewed who can access what.

Built for

  • Businesses with 5 or more staff on Microsoft 365
  • Government, health, legal and finance teams
  • IT managers and the people who look after IT

You probably need it if…

  • You're planning to buy or trial Microsoft 365 Copilot licences
  • SharePoint, Teams and OneDrive have grown for years without a permissions review
  • You hold sensitive HR, finance, health, legal or client records in Microsoft 365
  • Leadership has asked IT to turn Copilot on, and you want to do it safely

02What's included

What a Copilot readiness assessment includes

Protect your data

Oversharing and permissions audit

We review SharePoint sites, Teams, OneDrive sharing links and group memberships to find content shared with everyone, external guests or broad groups. You get a ranked list of exposures, starting with the most sensitive data.

Sensitivity labels with Microsoft Purview

We design a short, practical set of Microsoft Purview sensitivity labels and apply them to your most sensitive locations first. Labels can restrict who opens a file, and Copilot honours those restrictions when it uses content.

Data loss prevention policies

We configure Microsoft Purview data loss prevention (DLP) to detect and block sensitive information, such as tax file numbers or health records, from being shared in ways it shouldn't. Policies start in test mode, so you can see their effect before anything is blocked.

Access & clean-up

Identity and access check

A review of Microsoft Entra ID, multi-factor authentication (MFA), conditional access and admin roles. Copilot is only as safe as the accounts using it, so a compromised account must not become a search engine for your data.

Retention and stale content clean-up

We help you set retention policies and archive or remove old content, so Copilot draws on current, accurate information rather than outdated drafts and abandoned project sites.

Roll out

Pilot, rollout and staff training

A phased rollout plan with a pilot group, a short Copilot usage policy and training on writing good prompts, checking outputs and knowing what not to ask Copilot to do.

03In detail

Copilot readiness, in depth

What is Copilot readiness?

Copilot readiness is the security and data work that decides what Copilot can reach once it is on. We treat it as a data protection project first and a productivity project second.

Why does Copilot expose oversharing?

Copilot searches across SharePoint, OneDrive, Teams, Exchange Online and other Microsoft 365 content the user can reach, then summarises what it finds. It doesn’t break permissions: Microsoft’s data, privacy and security documentation for Microsoft 365 Copilot explains that it only surfaces data the user already has permission to access. It makes existing permissions visible: without Copilot, few people stumble across an overshared folder; with Copilot, anyone with access can ask for “the latest salary review” and get an answer.

That is why the audit ranks exposures by the sensitivity of the data, not by the number of files. For example, a finding might read: “HR site shared with all staff through an everyone group, including salary and performance records. Fix: remove the group, restrict the site to HR and apply a Confidential label.”

Which Microsoft 365 controls limit what Copilot can reach?

Beyond permissions, Microsoft 365 has controls aimed at Copilot itself. DLP policies can stop Copilot from using files with your most sensitive labels, or from processing prompts that contain sensitive information, depending on your licence. SharePoint Advanced Management is included with Microsoft 365 Copilot licences, so we use its data access governance reports and Restricted Content Discovery to find and hide overshared sites, and Restricted SharePoint Search to limit Copilot to approved sites during the pilot. Microsoft’s Microsoft 365 Copilot deployment blueprint for oversharing recommends a similar sequence: find high-risk sites, restrict access in the meantime, then fix the permissions. We can check and supply the plans you need through software licensing.

The identity side of the work runs through our user and identity management service where needed. Most of these controls also belong in our wider cloud and Microsoft 365 security service, so the work keeps paying off after Copilot is live.

What happens after Copilot is switched on?

Readiness is not a one-off. New sites, guests and sharing links keep appearing. We help you set up a regular access review and alerts for risky sharing, so your tenant is far less likely to drift back to where it started. Our Microsoft 365 team can run those reviews as part of ongoing administration.

For the governance side, including an AI acceptable use policy that covers Copilot alongside other tools, see AI security and governance.

04The process

How a Copilot readiness assessment works

  1. Assess

    We run the readiness checklist across your tenant and report the gaps, ranked by risk, with a written quote to fix them.

  2. Remediate

    We fix oversharing, apply labels and DLP, tighten identity settings and clean up stale content, highest risk first.

  3. Pilot

    A small group uses Copilot with monitoring switched on, and we check what it surfaces before wider release.

  4. Scale

    Copilot rolls out to more users in waves, with training for each group and a review of activity logs after each wave.

05Frameworks

How this maps to the frameworks

Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.

Copilot Readiness: framework mapping
ControlASD EssentialsASD maturity model (current)ISO/IEC 27001NIST CSFISO/IEC 42001
Permissions and oversharing reviewIdentity servicesNot applicableA.5.15, A.8.3Protect (PR.AA-05)Not applicable
Sensitivity labelsNot applicableNot applicableA.5.12, A.5.13Protect (PR.DS-01)Not applicable
Data loss prevention policiesNot applicableNot applicableA.8.12ProtectNot applicable
Identity and conditional access checkIdentity servicesMulti-factor authenticationRestrict administrative privilegesA.5.15, A.8.2, A.8.5Protect (PR.AA-03)Not applicable
Copilot usage policy and trainingGovernance and cultureNot applicableA.5.10, A.6.3Protect (PR.AT-01)A.9.2
Copilot activity monitoringVisibility and responseNot applicableA.8.15, A.8.16Detect (DE.CM-03)A.6.2.6

06Pricing

Pricing and how to start

Pricing

Quoted for your environment

What changes the price

Price depends on the number of users, SharePoint sites and Teams in your tenant, how much external sharing and guest access exists and whether you already use Purview labels or DLP. Remediation is quoted separately once the gaps are known.

  • Oversharing and permissions audit across SharePoint, Teams and OneDrive
  • Identity, MFA and conditional access review
  • Purview labelling and DLP recommendations
  • A ranked remediation plan and phased rollout plan
Get a quote

Not included: ongoing Microsoft 365 administration after rollout. Our Microsoft 365 service can take that on.

07FAQ

Copilot readiness, answered.

Can't see your question? Ask a specialist and get a straight answer.

Ask a specialist
Is Microsoft 365 Copilot safe for our business data?

Copilot works within your existing Microsoft 365 permissions, so it is only as safe as those permissions are. It doesn't give users access to anything new, but it makes existing access much easier to use. If a salary spreadsheet is shared with everyone, Copilot can find it and summarise it. Fixing oversharing before rollout is the main safety step.

What is oversharing in Microsoft 365?

Oversharing is when files, sites or Teams are accessible to more people than need them. Common causes are sharing links set to anyone in the organisation, sites with an everyone group added, guests who were never removed and old project sites nobody owns. It can build up quietly over years and go unnoticed until a tool like Copilot makes it easy to search.

Do we need sensitivity labels before using Copilot?

They are strongly recommended for your most sensitive information. Microsoft Purview sensitivity labels mark content as confidential, can encrypt it and limit who opens it, and Copilot honours those restrictions. You don't need to label everything on day one. We start with the locations that hold the most sensitive data, such as HR, finance and client records.

How long does a Copilot rollout take?

It depends mostly on how much permissions clean-up your tenant needs. The assessment shows the size of the job. A tenant with tidy permissions can move to a pilot quickly, while one with years of open sharing needs remediation first. We recommend a pilot group before a full rollout in every case, so you can check what Copilot surfaces.

How much does a Copilot readiness assessment cost in Australia?

Copilot readiness is quoted after a scoping call, and you see the price before any work starts. The assessment cost depends on the number of users, SharePoint sites and Teams, how much content is shared with everyone in your organisation and whether sensitivity labels already exist. Fixing the gaps it finds is quoted separately, once their size is known.

Can you supply Microsoft 365 Copilot licences?

Yes. We supply and support Microsoft licences, including Copilot add-ons, through our software licensing service. We can also check which Microsoft 365 plans your users are on and whether those plans include the Purview and Entra ID features the readiness work relies on, so you don't buy Copilot licences before the foundations are in place.

Does Copilot readiness help with ASD Essentials?

Yes, in part. The identity work in a readiness project, including multi-factor authentication and restricting administrative privileges, supports two of the strategies ASD prioritises directly, and the identity services domain in ASD Essentials. The permissions, labelling and DLP work goes further, and supports ISO/IEC 27001:2022 controls on access, classification and data leakage prevention.

Talk to our team

Talk to us about Copilot readiness.

No obligation. You talk to the people who do the work.