Capability

Copilot and AI readiness

Copilot does not create oversharing. It surfaces the oversharing you already had, instantly and to anyone who thinks to ask for it.

Every over-permissioned SharePoint site, every document shared with Everyone, and every unlabelled file full of salary data was already discoverable in theory. Copilot makes it discoverable in practice, by someone who simply asked a question in plain English. That is why a Copilot rollout so often turns into a permissions project, and why it is much cheaper to find that out before you switch it on than afterwards.

What we assess

  • Where oversharing actually is. Sites and libraries shared with Everyone or Everyone Except External Users, broad sharing links that were never meant to be permanent, and the content behind them.
  • Whether labelling would hold. Whether sensitivity labels exist, whether they are applied to anything meaningful, and whether Copilot would honour them in their current state.
  • The blast radius of a question. What a typical staff member could surface on day one, and what an over-privileged account could.
  • Governance and audit. Whether prompts and responses are retained and auditable to whatever standard your obligations actually require.
  • Shadow AI. Which AI tools staff are already using and what they are putting into them, which is usually more than anyone expects.
  • Agents as identities. What agents and app identities can reach, whose permissions they inherit, and who approved them.

What we do

  • Pre-rollout readiness assessment, so you know the size of the problem before a licence is assigned
  • Remediating oversharing at source: site permissions, sharing links and access reviews, rather than hiding it behind a search boundary
  • Sensitivity label design and rollout so classification is applied automatically rather than left to the person saving the file
  • Restricted SharePoint Search as a deliberate, temporary control while the underlying permissions work is done
  • Purview DSPM for AI configuration, plus retention and audit over prompts and responses
  • Agent and app identity governance, including consent, scope and lifecycle

Found: A readiness assessment ahead of a Copilot rollout found 340 SharePoint sites shared with Everyone Except External Users, including the HR site holding performance reviews and remuneration bands.

Fixed: Rollout paused for three weeks. Sharing remediated at source, an access review process introduced, and labels applied to the sensitive libraries before any Copilot licence was assigned.

Nothing here was caused by Copilot, and none of it was new. It had been true for years and nobody had a practical way to notice. Three weeks before launch is a far better time to find it than three days after.

The rest of the stack

This does not sit on its own

The findings that matter most usually cross between these areas. We look at all of them, whether or not that is what you asked us to look at.

Data

Data protection and endpoint

Purview sensitivity labels, DLP and retention, plus Intune, device compliance and endpoint hardening. Protecting the data itself, and the devices it lands on.

Learn more → Identity

Identity and access

Entra ID, Conditional Access, privileged access, authentication methods, guest access and app consent. If an attacker gets in, this is almost always how.

Learn more → Detection

Threat protection and detection

Defender across endpoint, identity and Office 365, and Microsoft Sentinel. Coverage, tuning, detection quality, and what your log ingestion is actually costing you.

Learn more →

Want a look at your copilot and ai readiness?

An assessment can be scoped to this area alone, or to the whole estate. Tell us what is worrying you and we will tell you which is worth paying for.

Get in touch