Is Your Business Ready for Microsoft Copilot? A 12-Point Readiness Check

Your business is ready for Microsoft Copilot when four things are true: the right licenses and secure sign-ins are in place, your files are shared only with the people who should see them, your sensitive data is labeled and protected, and your staff have a written AI policy and some training. This Copilot readiness checklist turns those four gates into 12 pass/fail checks. The second gate, file permissions, matters most, and it is usually where the cleanup work sits.

A note on names: Microsoft 365 Copilot is now called Microsoft Copilot, though some licenses and admin screens still use the old name (Microsoft Learn (opens in a new tab)). Both mean the paid Copilot that works inside Word, Excel, Outlook, Teams and your company files.

Why Copilot readiness starts with permissions#

Copilot does not break into anything. It works through the access your people already have. In Microsoft's words, Copilot "only surfaces organizational data to which individual users have at least view permissions" (Microsoft Learn (opens in a new tab)).

Copilot respects the permissions you set, but a Microsoft 365 setup that has run for years often carries loose sharing nobody remembers. A folder opened to the whole company years ago used to be hard to stumble across. Now anyone can ask a plain question and get an answer built from it.

Picture a 30-person firm where the HR folder sits in a SharePoint site that was opened to everyone so a manager could grab one form. Nobody has clicked into it since. After Copilot goes live, a staff member asks what project managers earn. Copilot can draw on the files that person can open, and that person can open the old HR site. Copilot did what it was built to do. The permissions were the problem.

Gate 1: Licensing and identity#

1. Every Copilot user is on an eligible plan, and you picked the right Copilot plan#

Copilot is an add-on. Microsoft 365 Business Basic, Business Standard and Business Premium are all on Microsoft's list of plans that qualify for Copilot (opens in a new tab). For organizations with 300 or fewer users on those Business plans, Microsoft sells Microsoft Copilot Business. Microsoft says it delivers the same capabilities as Microsoft Copilot and supports up to 300 seats per tenant (Microsoft Copilot Business FAQ (opens in a new tab)).

As of September 2026, the same FAQ says Copilot Business is an annual commitment with monthly or annual billing, and there is no month-to-month option. Buy for a pilot group first, not the whole staff.

2. Office apps are on a supported update channel#

Copilot is available in every Microsoft 365 Apps update channel except Semi-Annual Enterprise Channel, and Microsoft points you to Current Channel or Monthly Enterprise Channel (Microsoft's Copilot setup guide (opens in a new tab)). The Copilot readiness report (opens in a new tab) in the Microsoft 365 admin center (Reports, then Usage) shows which users are technically eligible and which are on an eligible channel.

3. Sign-ins are locked down and the account list is clean#

Microsoft's setup guide lists multifactor authentication (MFA) for all users and a review of conditional access policies as part of getting ready. Add some housekeeping: disable accounts for people who left, review guest accounts, and keep the number of global administrators small, which Microsoft also recommends (Microsoft Learn (opens in a new tab)). A stolen account with a Copilot license lets the thief ask for summaries instead of digging through folders.

Gate 2: Data and permissions in SharePoint, OneDrive and Teams#

This gate usually takes the most work, and it is where Microsoft's own guidance starts. Its deployment blueprint for a secure Copilot rollout puts "remediate oversharing" first of three pillars (Microsoft Learn (opens in a new tab)).

4. Tenant sharing settings are tightened#

Microsoft says it plainly: "By default, SharePoint sets sharing settings to the most permissive option" (Get ready for Copilot with SharePoint Advanced Management (opens in a new tab)). In the SharePoint admin center, open Policies, then Sharing. Limit external sharing to what the business needs, make "specific people" the default link type, and set expiration dates on "Anyone" links. Microsoft's setup guide also recommends disabling "Everyone except external users" (a built-in group covering all your staff) at the tenant level.

5. You know where the overshared content is#

Start with a short list you already know: payroll, HR files, the owner's folders, bank details and client records. Then find where each one lives and who can open it. A quick test helps: have a regular employee search SharePoint for words like "salary" or "payroll." Whatever turns up is a rough preview of what Copilot can draw on for that person.

Microsoft says that once at least one user in your organization has a Microsoft Copilot license, your SharePoint admins get the SharePoint Advanced Management features that support a Copilot rollout (opens in a new tab). Their data access governance reports show the sites with the most "Anyone," organization-wide and specific-people links created in the last 28 days, plus the top 100 sites where content was shared with the entire organization in that window. Even a small pilot purchase gives you these reports.

6. Teams and sites have owners, and dead ones are archived#

Microsoft's Copilot prep guide lists ownerless, inactive and public sites among its risk signals, along with sensitive content that has "Anyone" links. The permissions to review include access you gave people outside your company, such as shared channels in Microsoft Teams. Give every team and site a current owner, remove guests who no longer work with you, and archive or delete what nobody uses. For a site that must stay open, Restricted Content Discovery keeps it out of Copilot and organization-wide search without changing permissions, though people who recently worked with its files may still see them.

Gate 3: Sensitivity labels and data loss prevention#

Permissions decide who can open a file. Sensitivity labels and data loss prevention (DLP) add a second layer that travels with the file.

7. A simple label set is published#

If you are on Microsoft 365 Business Premium, sensitivity labels for email and files and Purview Data Loss Prevention are already included in your plan (opens in a new tab). Microsoft's lightweight data security guide (opens in a new tab) starts by creating a few parent labels, publishing them to all users and setting a default label for new documents, and says every feature in that step is available with Business Premium or above. For many small businesses, four labels are enough: Public, General, Confidential and Highly Confidential.

8. Your most sensitive files actually carry a label#

Labels only help on the files that matter. Take the list from check 5, label those files Confidential or Highly Confidential (or set a default label on the document libraries that hold them), and turn on encryption for the top tier. When a label applies encryption, a user needs both the VIEW and EXTRACT usage rights before an AI app like Copilot will return that data (Microsoft Purview protections for generative AI (opens in a new tab)). Microsoft also recommends enabling sensitivity labels for SharePoint and OneDrive so labels work on files stored there.

9. DLP rules and audit logging are on#

Purview DLP can now target Copilot directly. A policy can stop Copilot from using files and emails with chosen sensitivity labels when it writes a response. Another can block prompts containing sensitive information such as Social Security or credit card numbers, a control Microsoft listed as a preview when we checked in September 2026 (Purview DLP for Copilot (opens in a new tab)). Microsoft's setup guide notes that some of these controls may need extra licenses.

Also confirm audit logging is on. Microsoft says Copilot prompts and responses are captured in the unified audit log (opens in a new tab), your record if a question ever comes up.

If you fall under HIPAA, the FTC Safeguards Rule or similar requirements, map your labels and DLP rules to those obligations. This is general information, not legal advice. Our compliance management team can help you line the two up.

Gate 4: People, policy and training#

10. You have a written AI use policy#

Keep it to one or two pages. Name the AI tools staff may use with company data. List the data that never goes into any AI tool. Require a person to check anything Copilot drafts before it reaches a customer. Tell people what to do if Copilot shows them something they should not see, because that is a permissions problem to fix, not a secret to keep. Microsoft itself says generative AI responses "aren't guaranteed to be 100% factual" and that users should review output before sending it to others (Microsoft Learn (opens in a new tab)).

11. Users are trained before they get a license#

Microsoft's Copilot adoption hub (opens in a new tab) has foundational user training and a prompt gallery. Our Microsoft Copilot cheat sheet has copy-paste prompts for Outlook, Word, Excel and Teams. For an instructor in the room, see our hands-on AI training for business, and we run a free monthly AI workshop.

12. You have a pilot plan with a scorecard#

Microsoft's setup guide describes three phases: pilot with a small group, deploy to a larger group, then monitor and adjust. Once you own Copilot licenses, the readiness report (opens in a new tab) also flags the top 25% of unlicensed users, based on their Microsoft 365 app usage, as suggested candidates. Pick five to 10 people. Give each two or three real tasks, such as meeting recaps, proposal drafts or long email threads to summarize, and write down how long those take today. Review after 30 days.

The printable Copilot readiness checklist#

Print this table, score each line, and keep it with your Microsoft 365 admin notes.

How to read your score: a fail in gate 2 or gate 3 can put the wrong file in front of the wrong person, and a fail on check 3 leaves the door open to account thieves. Other fails in gates 1 and 4 mostly slow a rollout down. If checks 4, 5 or 6 fail, fix them before licensing anyone beyond a small pilot whose own access you have reviewed.

Frequently asked questions#

Book a Copilot readiness review#

If you would rather not run all 12 checks alone, book a Copilot readiness review with us. Start with a free 15-minute discovery call, tell us where you are, and we will point to the gates that need work first. Our engineers serve Microsoft 365 businesses around La Crosse, Onalaska and Holmen and in Fort Myers and Lee County. For a wider view of where AI fits in your business, see our AI Business Maturity Assessment, which typically takes 2 to 4 weeks, or our AI adoption services, which include Copilot training.