AI & Automation · What we build
Know what Copilot can find, before you turn it on.
Copilot answers from the information your people can already reach. The Copilot Readiness Review shows you what that is today, and ends with a written decision on whether a pilot should go ahead.
Why review first?
Copilot does not open new doors.
It walks through the ones already open. That is fine when access matches the work. It is harder to manage when old memberships, forgotten sharing links, unowned sites and stale documents are still sitting in the tenant. Those are not Copilot problems. Copilot just makes them easy to find.
Access that has drifted
People change roles, projects finish and guests move on. Access tends to outlive the reason it was granted.
Information nobody owns
When a site has no owner, nobody can say who should reach it or whether what is in there is still current.
Surprises after rollout
Found after the licences are assigned, an access problem stalls the pilot and gets fixed under pressure.
Copilot grants no new access. The review checks the access that is already there, before any licence is assigned.
What this looks like in practice
An ordinary question, answered from an HR folder left open.
Someone asks Copilot about the pay review. It answers, because an old permission on an HR folder was never removed and that person has technically been able to open it for months. Copilot did not break a rule. It surfaced one that was already broken.
The question worth answering
Why could that person open the HR folder in the first place, and who else can?
- The access pathAn old group membership, an inherited site permission or a sharing link that outlived its purpose.
- The intended audienceWho the business actually meant to reach this information, confirmed by the person who owns it.
- The action requiredWhat to correct, who owns the correction, and how we confirm it worked.
A conceptual example, not a client scenario. Copilot does not create the permission. It makes one granted three years ago far easier to stumble across.
What the review is
We check who can reach what, and what to fix before the pilot.
We take a read-only look at your Microsoft 365: your people, your guests, your groups and sites, who owns them and what has been shared outside. External sharing, sites with no owner and content nobody has touched in years point us at the places worth a closer look.
Then we go to the people who own that information and ask a simple question: who was meant to have access to this? You get back a list of confirmed problems those people have signed off, the order to fix them in, and a recommendation on whether to run the pilot.
- Read-only by designWe collect evidence. We do not change a site, a permission, a group, a sharing link or a document.
- Risk-based, not exhaustiveWe look across the whole estate, then spend the effort where it changes the answer.
- Validated by your peopleSomething a script flags is not a problem until the person who owns that information says it is.
- A hard scope lineFixing things is planned here and quoted separately, so the review stays a review.
How we run it
Four steps, from tenant evidence to a pilot decision.
A read-only pass over users, guests, groups, sites, ownership and sharing across the tenant.
External sharing, missing owners and stale content flag the sites and groups worth a closer look.
Information owners confirm the intended audience, the sensitivity and whether the access still makes sense.
Confirmed findings, prioritised actions and a clear recommendation on the pilot.
What you walk away with
Six things you own at the end.
The Copilot Readiness Review
A management-ready view of the work required before and during a controlled Copilot pilot.
Where the work focuses
Enough depth to decide, not a clean-up project.
The standard review inventories the whole tenant, works through a set of priority locations, and goes deeper on a smaller group of high-priority locations agreed with you up front. That is enough to size your pilot risk while keeping the engagement bounded and the fee fixed.
More locations, OneDrive, regulated-data requirements and full item-level analysis are available as scoped extensions.
- IncludedUsers, guests, Microsoft 365 Groups, SharePoint sites, what is shared outside, who owns what, what has gone stale, and owner validation.
- Not assumedThat broad access is automatically wrong. Sometimes it is exactly right, and the record says so.
- Quoted separatelyPermission changes, guest clean-up, labelling, content remediation, Copilot deployment and staff rollout.
The decision you need
One of four answers, and the reasoning behind it.
Every review ends the same way: one of four outcomes, in writing, with the evidence behind it attached.
The mandatory gates are passed. Start the controlled pilot and hold the agreed review cadence.
The pilot can go ahead once specific actions are done. Each one names the action, the owner and the location.
Evidence or owner validation is incomplete. The report sets out exactly what is needed to reach a decision.
Confirmed critical conditions need remediation first. The report names them and what remediation involves.
And then
A 90-day path from decision to routine.
Clear the blockers
Correct the confirmed critical access conditions and agree the locations the pilot will actually use.
- Confirmed critical access corrected
- Pilot locations approved
- Pilot group and guardrails agreed
Strengthen ownership
Put a name against every location that matters, and simplify the access groups around sensitive information.
- Owners assigned to priority sites
- Guest access reviewed
- Sensitive access groups simplified
Make it repeatable
Turn the one-off review into a routine, so the estate does not quietly drift back to where it started.
- Recurring access review in place
- Stale-site review scheduled
- Governance owned and reported
A sensible place to start
See what Copilot can reach in your tenant.
Tell us about your Microsoft 365 environment, the information that matters most, and the pilot you have in mind. We will scope the review to suit.