A Microsoft Copilot readiness assessment you can run yourself

01 / 10

Microsoft already generates half of this assessment for you

Most Copilot readiness checklists on the internet were written before this existed, so they open with a spreadsheet. Start somewhere better: Microsoft 365 admin center, Reports, Usage, Microsoft Copilot, Readiness tab. It is generally available, and its documentation was last revised on 18 August 2026 — which tells you how quickly this surface is still moving.

The report gives you prerequisite licence counts, how many users sit on an eligible update channel, assigned versus available licences, and a per-user table showing licence status, channel eligibility and thirty-day activity across Teams, Outlook and the Office apps. It exports to CSV. It also flags a suggested candidate for Copilot — the top quartile of unlicensed users by Microsoft 365 app usage, which is a defensible first pilot cohort chosen by evidence rather than by who asked loudest.

Two practical notes. The report appears within 72 hours of enablement, and usage data carries up to 72 hours of latency — so do not read a fresh tenant's numbers as final. And it answers exactly one of the three questions a real assessment has to answer.

02 / 10

What a readiness assessment is actually asking

Strip the vendor language away and there are three gates, and they fail differently:

Gate one: can Copilot run? A licensing and plumbing question. Failure here is silent — the button does not appear and nobody files a ticket, they just decide the product is disappointing.

Gate two: can it see what it should? A content question. Failure here produces confident, useless answers, because the good material was in a place the index does not read.

Gate three: can it be stopped from seeing what it should not? A permissions question. Failure here is the one that ends up in front of your lawyer.

Almost every published checklist covers gate one thoroughly, gestures at gate three, and skips gate two entirely. The order matters too: gate three is the one with the longest lead time, so it should start first even though it reads last.

03 / 10

Gate one — can Copilot run for these people?

The Readiness Report covers licences and update channels. It does not cover the rest of this list, and every item here is a documented Microsoft requirement rather than a matter of taste.

04 / 10

Required is not the same as recommended

This is the correction worth making loudly, because it is wrong nearly everywhere. Search for a Copilot readiness checklist and you will be told that multi-factor authentication, Conditional Access and Intune device compliance are prerequisites for Copilot.

Microsoft does not say that. Its Zero Trust guidance for Copilot says it recommends building a strong security foundation, and advises that if you are not using those protections you should pilot and deploy them before assigning licences. That is a strong recommendation and we agree with it. It is not a functional requirement, and Copilot does not check for it.

The distinction is not pedantry. Conflating the two is how a two-week readiness assessment becomes a six-month identity programme that nobody budgeted for, and how a genuinely blocking problem — half your users sitting on the wrong update channel — gets buried under work that was never in the way.

05 / 10

Gate two — can Copilot see what it should?

The semantic index reads a specific and fairly narrow set of things. Word, PowerPoint, PDF, OneNote and .aspx pages; PDF, PPTX and DOCX files up to 512 MB; the user's primary Exchange Online mailbox; and the SharePoint and OneDrive content they can already open. At tenant level it adds Copilot connector data.

What it will never read is the part worth checking against your own estate. Shared and delegate mailboxes are documented as not supported. Archived mailbox data and archived SharePoint data are out. And documents protected with legacy Information Rights Management are not used for grounding at all — Microsoft's advice there is to move to sensitivity labelling instead.

That last one is easy to miss because it is documented on the compliance-readiness page and not on the semantic-index page. No single Microsoft page carries the full exclusion list, which is precisely why an assessment should check for it rather than assume.

06 / 10

The archive lever, and why stale content is a readiness problem

Microsoft is unusually direct about this one: Copilot is not trained on archived content, maximizing response relevancy. Microsoft 365 Archive moves inactive material to a cold tier while preserving permissions, metadata and compliance standards — and takes it out of Copilot's reach.

Read that as a tool rather than a footnote. Microsoft's own governed-foundation guidance recommends using Archive to store inactive but high-value content while preventing Copilot from reasoning over it, and pairing retention labels with Archive to exclude files from Copilot use while preserving them for discovery obligations.

So the readiness question is not only what can Copilot reach but what should it stop reaching. A 2019 pricing deck that still ranks well in search is not a security incident. It is a quality problem, and archiving is the sanctioned fix.

07 / 10

Gate three — can Copilot be stopped from seeing what it should not?

This is the gate with the real lead time, and it is measurable today. The SharePoint admin center's data access governance reports each answer a specific question, and running them is the single highest-value hour in an assessment.

• Three constraints to plan around: data is retained for 28 days, activity-report collection must be switched on explicitly and pauses after three months of disuse, and reports take about 24 hours to populate. Start collection on day one of the assessment, not day ten.
• On Microsoft 365 E5 the access is deliberately partial — no snapshot reports, no remedial actions, and activity reports capped at 10,000 sites. Full access comes with SharePoint Advanced Management, which one assigned Copilot licence unlocks.
• In PowerShell the entry points are Start-SPODataAccessGovernanceInsight, Get-SPODataAccessGovernanceInsight and Export-SPODataAccessGovernanceInsight, with Start-SPOSiteReview to delegate remediation. The Everyone-except-external-users reports need module build 16.0.27215.12000 or later — an older module fails in a way that looks like an empty tenant rather than an error.
• To contain a site while you fix it, the toggle is literally named Restrict content from Microsoft 365 Copilot — or Set-SPOSite -RestrictContentOrgWideSearch $true. It applies to SharePoint sites only, not OneDrive, and on sites above 500,000 items it can take over a week to propagate.

08 / 10

The silent gates nobody tests for

Four things that pass every checklist and then produce a confused user in week two.

• Meeting recap. Copilot works during a meeting without transcription — it can take notes and actions live. But the meeting Recap tab is unavailable afterwards unless transcription or recording was on. If the tenant transcription policy is off and the organiser chose Copilot during and after, the feature simply does not appear.
• Shared mailboxes. They are not grounded, and acting on one needs the user's own Copilot licence plus full delegate access — folder-level permissions are not enough. For a small team running on info@, this is often the exact scenario the purchase was justified by.
• The Loop container. Loop workspaces and Copilot Pages and Notebooks share one underlying container, created if either policy permits it. Disabling one and assuming you have blocked the other is a mistake you find during an audit.
• Legacy IRM. Protected documents are excluded from grounding entirely. A tenant that standardised on IRM years ago can pass every licensing check and still get thin answers, for a reason no report will surface.

09 / 10

Scoring it, and what the score should make you do

The thresholds below are ours, not Microsoft's — Microsoft publishes no readiness score and no recommended pilot size for customers. They exist because an assessment that ends in a list of observations tends to end in nothing at all.

10 / 10

What measures this after you deploy, and what we sell

Two first-party surfaces are worth knowing before you promise a board a number. The Copilot Dashboard in Viva Insights unlocks in tiers: one Copilot licence gives you the readiness page and tenant-level adoption; group-level metrics, benchmarks, agent insights and sentiment need 50 or more licences. Allow up to seven days after assignment before data appears, and note that agent metrics are still in preview.

The satisfaction rate is the honest one, and it has a floor — it only displays with at least 30 responses from at least five unique users over a rolling 28 days. Below that you do not have a measurement, you have an anecdote. The AI adoption score is separate again, and benchmarks usage against a three-days-a-week target.

Microsoft also publishes an open-source automated readiness assessment under its GitHub organisation, which walks licensing, identity, Defender, Purview and agent posture. It is MIT-licensed and useful. We could not find it documented on Microsoft Learn or carrying any support designation, so treat it as a community tool published by Microsoft staff rather than a supported product, and read it before you run it against a client tenant.

The disclosure, plainly: we sell this. Copilot Pilot in a Box is the assessment plus a scoped pilot, and everything above is runnable without us — the reports are in your admin centre and the documentation is public. What you buy from us is the sequence, the gates, and someone accountable for saying no. Every claim here was verified against Microsoft's documentation on 19 August 2026; this surface changes monthly, so re-check the preview items if you are reading this much later.