ISO Certified ISO 27001:2022 & 9001:2015 Certified

Get supportCall 1300 920 866ContactChange to TTA
An automated production line, illustrating a Microsoft 365 Copilot readiness assessment for an Australian group of operating businesses

A Copilot readiness assessment that made a decade-old tenant safe to switch on

An Australian group of more than 400 staff wanted certainty that Copilot would not surface content people were never meant to see. We measured the whole tenant, then fixed what we found.

View the full story Talk to our team

Certainty about what Copilot could reach, before the first licence

An Australian group of more than 400 licensed staff, working across several operating businesses, was preparing to adopt Microsoft 365 Copilot. Before buying a licence, it wanted certainty that its own information was not available more widely than intended.

Copilot grants no new permissions. It works with the access each person already has, but a plain question returns and summarises whatever that person is entitled to see, so buried content becomes easy to surface. That makes a rollout a permissions exercise, not an AI one. We measured the whole tenant, then remediated what we found before any licence was assigned.

“The report did not hand us a list of risk categories. It told us the locations, with the numbers against them. That is what made it possible to decide what to fix first.”

Chief Technology Officer, the client group
19,670Sharing links open to everyone in the business
37,921Sensitive items found across the tenant
1Files carrying a sensitivity label
20Pilot users, on a tenant already corrected

The exposure was internal, and larger than expected

The external boundary was already sound. No anonymous sharing links existed anywhere in the tenant, one item was shared outside the business, and external sharing was set to the most restrictive option available. The exposure was internal, and every figure here is a count taken from an export, with the named locations attached.

Among the 37,921 sensitive items were 27,210 Australian bank account numbers, 2,500 passport numbers and 249 tax file numbers.

30,860Sensitive items behind organisation-wide links
64Locations open to everyone in the business
150 of 433Licensed users who could not complete MFA
549Guest accounts that had never signed in

One personal storage area, used for years as a shared file store for a finance function, held 92 per cent of the tenant's medium-risk items and roughly three quarters of all sensitive content. The exposure was concentrated rather than spread thin, so one migration would move most of it.

Fixing the foundations before the licences

The cheapest wins landed first. Identity work needed no new licensing, so a multi-factor authentication campaign started immediately, taking coverage from two thirds of licensed staff to all of them. The 549 dormant guest accounts were removed, and the directory group extending company-wide sharing to every guest was rescoped to internal staff only.

Business Standard includes no conditional access, sensitivity labels or device management. All three sit in Microsoft 365 E3, and the group had already outgrown the seat cap on the Business plans, so one uplift resolved both constraints. Conditional access followed, enforcing multi-factor authentication and blocking legacy authentication. Prerequisites are published on Microsoft Learn.

The departmental file store was migrated onto a permissioned SharePoint site with real ownership, the two open site collections were closed, the 64 widely accessible locations were reviewed one at a time, and the default sharing link was changed to specific people with an expiry. Sensitivity labels were published across the finance and human resources estates, backed by data loss prevention rules for the types covered by the Australian Privacy Principles.

Copilot went live afterwards with a pilot of 20 users on managed devices, part of whose job was confirming that the shielded content stayed out of reach.

283 to 433Licensed users able to complete MFA
31,103 to ~2,300Medium-risk items, and high risk to none
608 to 57Guest accounts holding standing access
52.99% to 78%Microsoft Secure Score

All of it was worth correcting on its own. Copilot made it urgent. The readiness question is not whether the technology is safe, but whether the access it inherits reflects what the business intends.

Five questions worth answering about your own tenant:

  • How many sharing links grant access to everyone in the organisation, and what sits behind them?
  • Which sites, teams and folders are open to the whole business, and were they all meant to be?
  • Are any personal OneDrive accounts being used as departmental file stores?
  • Can every licensed user complete multi-factor authentication today, and is it actually enforced?
  • Does any content in the tenant carry a sensitivity label?

Read the full case study

What the review covered, the finding that shaped the plan, and how the tenant was corrected. Seven pages.

View the case study (PDF)

Take the project plan for your own tenant

The seven phases of an access and permission review, what happens in each and the effort involved. Written for any tenant, not only this one.

Download the project plan (PDF)

Related services and industries

The work behind a safe Copilot rollout, and the services that support it.

Microsoft 365 Copilot IT Security Assessments Microsoft 365 IT Audits IT Support Services More client case studies

Copilot readiness assessments: common questions

What is a Copilot readiness assessment?

It is a security, access and permission review of a Microsoft 365 tenant, carried out before Copilot is enabled. It measures sharing and external access settings across SharePoint Online, OneDrive and Microsoft Teams, identifies files, sites and links reachable more widely than intended, locates sensitive content, and reports how Copilot would inherit each user's access. The output is a written report with risk-rated recommendations and a roadmap for safe enablement.

Does Microsoft 365 Copilot give people access to files they could not already see?

No. Copilot works with the access each person already has and grants no new permissions. What changes is how easily content is found: a plain question returns and summarises whatever the user is entitled to see, so content that was technically reachable but practically buried becomes easy to surface. That is why existing sharing settings decide whether a rollout is safe.

How do you check for oversharing in Microsoft 365 before enabling Copilot?

We measure the whole tenant rather than a sample. Every figure is a count taken from an export, with the named locations attached. The review covers sharing settings, default link types, external sharing and link expiry, an inventory of active sharing links, every site, team, group and personal storage location, and a scan for Australian financial and personal information types mapped to the locations holding them.

What Microsoft 365 licensing do you need for a safe Copilot rollout?

It depends on the controls you need. Business Standard does not include conditional access, sensitivity labels or device management, and the Business plans carry a 300-seat cap. All three capabilities sit in Microsoft 365 E3. We confirm the prerequisites against your current position before recommending any change.

Is a Copilot readiness assessment worth doing if we are not deploying Copilot?

Yes. The findings stand on their own as a security exercise. In this engagement, sensitive financial records in personal storage, company-wide links with no expiry and a third of staff unable to complete multi-factor authentication were all worth correcting regardless of the Copilot decision. We offer the review as a fixed piece of work either way.

Can we help you with your next project?

A readiness review stands on its own as a security exercise, whether or not Copilot is switched on afterwards. If you would like to know what is reachable in your tenant today, tell us where you are up to.

Yes to what's next.

✓

Thanks, we have got it.

One of our team will be in touch shortly.