Run a data access governance report in SharePoint Advanced Management to find sites shared with everyone, and start with the ones that hold HR, finance or client data.
Permissions and oversharing · must fix
Finish the access review for the remaining sites in order of sensitivity, and ask each site owner to confirm who should have access.
Permissions and oversharing · must fix
Schedule site access reviews twice a year so the cleanup doesn't drift.
Permissions and oversharing
Remove "Everyone except external users" from sensitive sites, and change the default sharing link to specific people.
Permissions and oversharing · must fix
Keep removing organization-wide sharing. For sites you can't clean up before launch, use Restricted Content Discovery so Copilot doesn't surface them.
Permissions and oversharing · must fix
Keep organization-wide sharing restricted and review exceptions every quarter.
Permissions and oversharing
Give every site and team an owner, and archive or delete the ones nobody uses. Copilot can surface old content as if it were current.
Permissions and oversharing · must fix
Turn occasional cleanups into policy: an inactive site policy that asks owners to confirm or archive, and a rule that every site has two owners.
Permissions and oversharing · must fix
Keep the inactive site and ownership policies running.
Permissions and oversharing
Define three or four sensitivity labels, such as Public, Internal, Confidential and Highly confidential, and apply them to your most sensitive libraries first.
Security and governance
Set default labels on sensitive libraries and turn on auto-labelling for the data types you care about, so coverage doesn't depend on people remembering.
Security and governance
Check label reports monthly after launch to confirm content Copilot creates carries the right label.
Security and governance
Create DLP policies for your key sensitive data types. Start in simulation mode so you see what they would block before you enforce them.
Security and governance
Extend DLP to Microsoft 365 Copilot so it can't process content with your most sensitive labels, and test it with pilot users.
Security and governance
Review DLP matches after launch and tune any policy that blocks legitimate work.
Security and governance
Require multi-factor authentication for every account before anything else. Copilot makes a compromised account far more useful to an attacker.
Security and governance
Add Conditional Access policies for device compliance and risky sign-ins, starting in report-only mode.
Security and governance
Review Conditional Access policies as you add Copilot and agent scenarios.
Security and governance
Check each candidate user's Microsoft 365 plan against Microsoft's current Copilot prerequisites before you ask for a quote.
Licensing and value
Plan licence changes for users on ineligible plans, or leave them out of the pilot.
Licensing and value
Keep plan eligibility in mind when you add users after the pilot.
Licensing and value
Choose pilot users by the work they do, favouring roles heavy in email, meetings and documents, not by seniority.
Licensing and value
Turn your rough list into a pilot group of 20 to 50 people across three or four roles, each with a manager who wants it to work.
Licensing and value
Use pilot results by role to decide where the next licences go.
Licensing and value
Pick three or four target tasks, such as drafting a proposal or writing up meeting notes, and agree how you'll measure them before the pilot.
Licensing and value
Add a baseline to the usage reports: time the target tasks before the pilot, and survey users at the start and the end.
Licensing and value
Report results to your sponsor at the end of the pilot and use them to set the seat count.
Licensing and value
Name an executive sponsor and a day-to-day rollout owner before any licence is assigned.
Adoption and change
Name a day-to-day owner who runs training, collects feedback and reports usage to the sponsor.
Adoption and change
Keep the sponsor involved with a short monthly update on usage and results.
Adoption and change
Replace the launch announcement with role-based sessions built around real tasks, such as preparing for a client meeting or summarizing a long thread.
Adoption and change
Turn the general session into role-based training, and schedule a follow-up two to four weeks after launch.
Adoption and change
Refresh training as Microsoft ships new Copilot features, which happens most months.
Adoption and change
Recruit one or two champions per team and open a channel where people ask questions and share what works.
Adoption and change
Add champions and a shared prompt library alongside the help desk, so people learn from colleagues doing the same job.
Adoption and change
Keep the prompt library current and retire prompts that no longer work well.
Adoption and change
