A Copilot readiness assessment is a review of your Microsoft 365 tenant before you assign Copilot licences: what your people can already see, what state your SharePoint and Teams content is in, and whether anyone will still be using the seats in six weeks.
Six things are worth checking. Permissions and oversharing, stale and ownerless sites, whether sensitivity labels are applied rather than merely configured, what you can restrict while you fix the rest, a pilot built to find problems, and usage after rollout. Most of that list is not about Copilot at all.
Microsoft 365 Copilot inherits the permissions each user already has. It does not grant access, it does not create a new permission model, and it does not decide that a document looks confidential. It searches what the person in front of it could already have found, and it finds it in two seconds instead of never. Switching it on points a very good search engine at your own company, and most organisations discover their sharing is looser than they believed.
Microsoft also ships a free readiness report in the admin centre. It will probably tell you that you are ready. It checks licences and update channels, and it does not look at a single permission.
What has to be true before you switch anything on?
Five technical prerequisites, and they are quick to confirm. Every user needs an eligible base subscription, a Microsoft Entra ID account, a primary mailbox in Exchange Online, a supported browser, and network access to Microsoft's Copilot endpoints. Microsoft's own minimum requirements page is the list to work from, because the eligible plans have widened over time and a good deal of published advice is out of date on this point. Office 365 E1, E3 and E5 are on Microsoft's current list, as are Microsoft 365 Business Basic, Business Standard and Business Premium, alongside the enterprise E3 and E5 plans.
The mailbox condition is the one that catches people. Copilot uses mailbox content to summarise threads and draft replies, and Microsoft supports that only where the primary mailbox sits in Exchange Online. Hybrid and on-premises mailboxes do not get it, which means a partly migrated organisation has a set of users who will have a visibly worse experience than their colleagues and no idea why.
Then there is the free report. In the Microsoft 365 admin centre, under Reports, Usage, Microsoft Copilot, the Copilot readiness report shows how many users hold a prerequisite licence, how many are on Current Channel or Monthly Enterprise Channel, how many seats are assigned against how many are available, and which unlicensed people are heavy Teams and Outlook users. It flags the top 25% of unlicensed users each week as suggested candidates for a seat.
It is a useful licensing tool and a misleading readiness tool. Nothing in it touches sharing links, permission inheritance, site ownership or sensitivity labels. A tenant can score full marks on Microsoft's readiness report and still surface the redundancy list to the whole company on day one. Read it as a seat allocation report, which is what it is, and do the rest of the work yourself.
How do you find out who can already see what?
Start by running the assessments Microsoft gives you, because they cost nothing on top of a Copilot licence. SharePoint Advanced Management is included with Microsoft 365 Copilot licences, and its Content Management Assessment identifies sites with oversized audiences, Everyone Except External Users group usage, broken permission inheritance, inappropriate sharing, and sites that are inactive or ownerless. Microsoft Purview Data Security Posture Management adds data risk assessments that flag overshared sites holding sensitive content and risky sharing links.
The four things to pull out, in order of how badly they tend to bite: anything shared with Everyone Except External Users, anonymous "anyone with the link" links that never expire, sites where permission inheritance has been broken at folder or library level, and external guests who left a project two years ago.
Effort: a day to run the assessments and read the output for a tenant under a few hundred sites. Remediation is the part that takes weeks, and how many depends entirely on what the report says.
What goes wrong: the assessment gets run, the output is alarming, and it goes to a governance working group. Six weeks later nobody has removed a single sharing link, because no one person was made accountable for the remediation and the licences were already paid for. Name an owner before you run the report, not after you read it.
What do you do about stale sites and ownerless Teams?
Old content is a quality problem before it is a security problem. Copilot does not know that the 2023 pricing deck was superseded, that the policy in the abandoned Teams site was replaced, or that the person who wrote the process document left. It weighs an out-of-date document exactly as it finds it, and a confidently wrong answer sourced from a real internal file is far more damaging to trust in the tool than no answer at all.
SharePoint Advanced Management includes inactive site policies, which find sites with no activity and prompt owners to confirm whether they are still needed. Ownerless sites are the harder category, because there is nobody to ask. Microsoft 365 Archive is the middle option for content that has to be kept but should not be reasoned over.
Effort: half a day to produce the list of inactive and ownerless sites. Then a tedious few weeks of chasing people to claim or close them.
What goes wrong: the archive-everything instinct. Bulk-archiving anything untouched for a year removes exactly the reference material that makes Copilot answers useful, and the first thing people notice is that it cannot find things it should. Archive by inactivity plus ownerlessness, not by date alone.
Are your sensitivity labels applied, or only configured?
Having a label scheme is not the same as having labelled content, and this is where most organisations overestimate themselves. A published set of Confidential, Internal and Public labels does nothing for Copilot until those labels are actually on files, sites and emails. Copilot respects the protections a label carries. It cannot respect a label that was never applied.
Microsoft Purview auto-labelling and default labels are how you close the distance without asking 400 people to classify their own documents, which is a request that has never once worked. Site-level sensitivity labels are worth doing first because they set privacy and sharing behaviour for everything created inside the site from then on.
Effort: a week to define or review the label taxonomy with legal and the data owners, then a few weeks of auto-labelling running in simulation before you enforce anything.
What goes wrong: the taxonomy grows to eleven labels because everyone in the room wants their own. Three or four labels people can remember will be applied. Eleven will not.
What can you restrict while you fix the rest?
You do not have to finish remediation before anyone gets a licence, and this is the practical route for a team under pressure to show something for the money. Restricted Content Discovery takes named SharePoint sites out of organisation-wide search and Copilot responses while their permissions are reviewed, and removes the Copilot button and AI actions from those sites. It changes nothing about who can open the files directly, so the finance team still works normally. Purview Data Loss Prevention policies for Copilot do the equivalent job at file level, excluding content carrying a given sensitivity label from grounding.
Two limits worth knowing. Microsoft describes Restricted Content Discovery as a temporary control and warns that overusing it degrades the quality of Copilot answers across the tenant, which is a real trade and not boilerplate. And propagation is not instant: Microsoft states that for sites with more than 500,000 items an update can take more than a week to reflect fully in search and Copilot.
Effort: an hour to apply to a handful of sites through the SharePoint admin centre or PowerShell. Then up to a week of waiting before you can trust a test.
What goes wrong: the temporary control becomes the permanent architecture. Somebody restricts 200 sites, the remediation programme loses its funding, and two years later half the tenant is invisible to a tool the company still pays for. Put a review date on every restriction the day you apply it.
How do you run a pilot that would actually find a problem?
A pilot that cannot fail tells you nothing, and most Copilot pilots are built so that they cannot. The standard version gives 30 seats to enthusiastic volunteers in one friendly department, runs for a month, and produces glowing feedback that predicts nothing about the other 400 people.
Build it the other way. Take two functions holding material that would cause a problem if it travelled, HR and finance being the obvious pair, and include people who did not ask to be involved. Then give the group a specific instruction: spend twenty minutes trying to find something you should not be able to see. Ask about salary bands, about redundancy planning, about a colleague's review. If the answer comes back, you have found your problem in week one at a cost of nothing, which is the entire point of a pilot.
Effort: two weeks of elapsed time, two hours a week per participant, one person to collate what surfaced.
What goes wrong: only volunteers take part. Volunteers are the people who would have got value from Copilot with no help at all, so a pilot made of them measures your most motivated 5% and calls it the average.
How do you tell six weeks later whether the licences are being used?
Go back to the same admin centre report and open the Usage tab, which sits alongside the Readiness tab you started with, and read active users per app rather than total assigned seats. The Copilot Dashboard in Viva Insights gives the fuller view for leadership. Note the lag before you draw conclusions: Microsoft says the report appears within 72 hours and the usage data can carry up to 72 hours of latency, so a Monday morning reading describes last week.
Look for the split. Copilot in Teams meetings usually holds up, because the summary arrives without anyone deciding to use anything. Copilot in Word and Excel is where seats go dark, because using it there requires someone to change how they start a task. That gap is the whole adoption problem in one chart, and it is a training and change question rather than a licensing one.
This is also where the readiness work has to justify itself. In ivee's research with 500 UK AI decision makers, surveyed in August 2026, 96% could not show the numbers on their organisation's AI spend. Copilot is unusually easy to be part of that 96% with, because the licence renews automatically and nobody has to defend it. Before renewal, put an hours-saved figure against the seats, even a rough one: the free ROI calculator works out an annual figure from hours saved per person per week, team size and industry, and it takes about a minute.
Effort: half an hour a month, indefinitely.
What goes wrong: assigned seats get reported as adoption. A hundred licences assigned and thirty people active is a number that only ever gets found by someone who went looking for it.
How long does this take, and what does it cost?
The assessment itself is days. The remediation is months, and it is the honest answer nobody wants at the point of purchase. Running the SharePoint Advanced Management and Purview assessments, reading the output and writing up what you found is roughly a week of one competent administrator's time for a mid-sized tenant. Fixing what they surface is a quarter, sometimes two, and it involves chasing site owners rather than configuring anything clever.
The direct cost is often zero, which surprises people. SharePoint Advanced Management and Restricted Content Discovery come with the Copilot licences you have already bought, and the readiness report is part of the admin centre. What you are actually spending is administrator time and site owner patience.
Sequence it so the remediation is not blocking. Restrict the high-risk sites, roll out to functions whose content is already clean, and remediate the rest while people are using it. Waiting for a perfect permissions estate before anyone touches Copilot is how a tool gets paid for through an entire renewal cycle without being switched on.
What usually goes wrong
The single biggest failure is treating a data governance problem as a training problem. If the Content Management Assessment comes back showing broken inheritance across half the tenant and sharing links with no expiry, no amount of prompt training fixes that, and running the training first means teaching people to be efficient with a tool that is about to expose something. That is remediation work for your Microsoft partner, your internal SharePoint administrator, or a specialist governance firm. It is not training work, and ivee does not do tenant remediation, so if that is the answer you need, we will say so.
The mirror-image failure is more common and costs more. The permissions get fixed, the labels get applied, the pilot runs clean, and then the licences are handed out with a link to a video. Six weeks later the meeting summaries are being used and nothing else is. According to ivee's August 2026 survey of AI decision makers, 75% say either that they have no idea, or that fewer than 1% of their workforce knows how to build and deploy an AI automation, which is a fair description of how much capability sits behind most rollouts.
The third one is less obvious. Nobody decides what Copilot is for. A readiness assessment answers whether you can switch it on safely, and it says nothing about whether it is worth switching on, which is a different question about specific work in specific teams. If you want the general version of that question rather than the Microsoft-specific one, what a full AI readiness assessment measures covers the four areas that fail independently. And if the technical side is clean and the usage is the problem, the fix starts with how people should actually be prompting Copilot day to day.
Copilot readiness is mostly a data governance project wearing a Copilot badge, and then an adoption project that nobody budgeted for. Neither of those is a reason not to do it. Both are reasons to know which one you are looking at before the invoice arrives.
Not sure which of the two problems you have?
If your permissions are a mess, you need remediation and we will point you at the right people. If they are fine and the seats are sitting idle, that is what we do. Book a call and we will tell you which one you are looking at.
