What should be on a Microsoft 365 Copilot readiness checklist?

By Hugh Donatello, LAN Service Group · Reviewed October 19, 2026

✓ Checked against Microsoft Learn documentation on October 19, 2026.

Why the checklist is mostly about permissions

Microsoft states that Copilot only surfaces organizational data to which individual users have at least view permissions, and that you should use the permission models in Microsoft 365 services such as SharePoint to make sure the right people have the right access. It also states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.

So Copilot does not create new access. It makes existing access easy to use. A folder shared with 'Everyone except external users' for years was always open to every employee; Copilot simply lets anyone find and summarize it with a plain-language question. Sharing links are narrower: Microsoft says creating an 'Anyone' or 'People in your organization' link does not by itself make a file searchable or reachable through Copilot, because it opens up only for each person who redeems it; sending the link by email or Teams chat redeems it automatically for up to 100 named recipients. That is why Microsoft's own deployment guidance starts with remediating oversharing, then guardrails, then regulatory requirements, and why most of the items below are about who can see what.

A note on names: Microsoft now calls the Microsoft 365 Copilot app Microsoft Copilot, its license pages call the paid add-on Microsoft 365 Copilot (Premium), and Purview pages still say Microsoft 365 Copilot. This checklist is for the add-on that grounds answers in your Microsoft 365 data in SharePoint, OneDrive, Exchange and Teams. Microsoft also says users without the add-on can use pay-as-you-go agents that have access to organizational content, so do the oversharing work before you enable those agents too.

The checklist at a glance

The table summarizes the seven areas. The free Excel version breaks them into 30 items, each with the Microsoft 365 tool, a status, an owner and the evidence to keep.

Tool and licensing details are from Microsoft Learn pages last updated between December 2025 and October 2026, checked on October 19, 2026. Microsoft changes Copilot licensing and feature names often; check the linked pages before you buy.

Oversharing: find it before Copilot does

Microsoft's setup guide gives a concrete starting point: export the top 100 most-used sites from the SharePoint admin center, run the permission state report, and cross-reference it with the Microsoft Purview Data Security Posture Management oversharing assessment. Purview's DSPM for AI runs a weekly data risk assessment for the top 100 SharePoint sites by usage without any activation step, so you may already have results to look at.

In the SharePoint admin center, the data access governance reports do most of the finding. The site permissions snapshot shows sites with the broadest access, such as sites open to thousands of users, external guests or 'Everyone except external users'. The activity reports show where people created the most sharing links, and where content was shared with all internal users, in the last 28 days. Microsoft suggests running the snapshot reports quarterly and the activity reports monthly.

Microsoft's foundational deployment guidance adds the SharePoint Advanced Management content management assessment, which looks for sites with oversized audiences, 'Everyone except external users' usage, broken permission inheritance, inappropriate sharing, and sites that are inactive or have no owner. Ownerless and inactive sites matter because nobody is responsible for fixing them, and stale content also lowers the quality of Copilot's answers.

SharePoint access reviews: how to fix what you found

Finding oversharing is the easy half. Fixing it needs the people who own the content, because they know who should have access. A SharePoint site access review lets an administrator send a review request from a data access governance report to the owners of overshared sites. You can start reviews for up to 100 sites at once from the report in the SharePoint admin center, or use PowerShell for more. Each owner gets an email focused on the specific issue, such as content shared with 'Everyone except external users', and the review stays pending until the owner completes it.

Microsoft notes that site access review supports SharePoint sites only, not OneDrive, and that site owners must be available to respond. In practice that means confirming each site has a current owner before you start, and planning OneDrive clean-up separately.

During the review, site owners remove excess users, groups and company-wide sharing links, rescope sharing links to the right people, and correct broken permission inheritance on libraries and folders. At tenant level, Microsoft recommends disabling 'Everyone except external users' and restricting company-wide sharing groups and Anyone links, so new oversharing is not created while you clean up the old.

Entra access reviews are a different tool: they review membership of groups, applications and roles in Microsoft Entra ID, and Microsoft says they need Microsoft Entra ID Governance or Microsoft Entra Suite licensing, with some capabilities working on Microsoft Entra ID P2. They are worth using if you have that licensing, because a group with the wrong members gives the wrong people access to every site that group can open.

Temporary protections while reviews run

Reviews take time. Two SharePoint Advanced Management controls reduce exposure in the meantime, and they work differently.

Restricted Content Discovery limits discovery of a SharePoint site's content in organization-wide search and Copilot responses, and removes Copilot entry points from the site. Microsoft describes it as a temporary governance control: it does not change permissions, people who already have access can still open the content directly, Copilot can still work on a document a user already has open, it is not supported for OneDrive, and an update can take more than a week to take effect on a site with more than 500,000 items. Microsoft also cautions against overusing it, because it reduces what Copilot can draw on.

Restricted access control limits a site to members of up to 10 specified Microsoft 365 or Entra security groups. Users outside the control group cannot open the site or its files even if they had permissions or a sharing link, and Microsoft states that Copilot and organization-wide search honor the policy. A user needs both site permission and membership of the control group. Use it for business-critical sites such as finance, HR or legal, and note that shared and private Teams channel sites need their own policy.

Microsoft's guidance is to remove interim protections once access and permissions are fixed. Treat them as a way to start a pilot sooner, not as the fix.

Sensitivity labels: what they do and do not do for Copilot

Sensitivity labels from Microsoft Purview are the second layer, but only some label settings change what Copilot can do. Microsoft states that when content grants a user the VIEW usage right but not EXTRACT, Copilot will not summarize it and can only reference it with a link. A label that applies encryption without EXTRACT, or a Purview DLP for Copilot policy that targets the label, keeps content out of Copilot summaries for other users. Two caveats: the person who applied the encryption always keeps EXTRACT, so their own encrypted content can still be returned to them, and unless DLP is used in Edge, Copilot in Edge can reference such content from an open browser tab. A label with no encryption and no DLP policy marks the content but does not stop Copilot from using it for someone who can open the file.

Two configuration points are easy to miss. First, enable sensitivity labels for Office files in SharePoint and OneDrive: until you do, those services cannot process the contents of files encrypted with a label, so search, eDiscovery, DLP and co-authoring do not work for them; files already encrypted before you enable it must be edited or uploaded again to benefit. Second, labels applied to containers such as Teams, Microsoft 365 Groups and SharePoint sites are not inherited by the items inside them, so a Confidential site label does not by itself label the files in the site.

We suggest starting small: publish a short label set, apply labels with encryption to the few areas that would hurt most if exposed, such as payroll, HR cases, legal matters and unreleased financials, and use the sensitivity label snapshot report to see where labeled files sit; Microsoft lists that report as needing E5 or G5 licensing. After remediation, Microsoft's guidance moves to default labels, auto-labeling and requiring a site sensitivity label when new sites are created.

Audit, retention and the pilot

Microsoft's setup guide asks for unified audit logging to be on, with audit-log retention set to your compliance needs. Microsoft states that Copilot interactions are logged as part of Audit (Standard), including references to the files and sites Copilot used for a response. Decide how long to keep Copilot interactions, or when to delete them, before broad rollout, and confirm eDiscovery can find them if you have legal or regulatory holds. Copilot audit records show what Copilot accessed and when. They are not the audit trail that 21 CFR Part 11 or GxP rules require for your validated systems, and Copilot output is not a controlled GxP record unless your quality unit decides how it will be handled.

Microsoft recommends three phases: a pilot with a small group, a wider deployment, and an operate phase that monitors usage and adjusts. We suggest choosing pilot users whose sites have already been reviewed, and having them try prompts that would expose a problem, such as asking for salaries, performance reviews or a named client's contract, then checking the audit log for what Copilot referenced. Microsoft's own guidance is to check, through Purview auditing and reports, that Copilot no longer surfaces restricted content.

If you handle controlled unclassified information (CUI) under DFARS and CMMC, protected health information (PHI) under HIPAA, or GxP records, decide before you assign licenses whether Copilot should reach that content at all. Confirm with the people who own those obligations, such as your compliance officer, privacy officer or quality unit, which Microsoft cloud, contract terms (for example, whether the service is covered by your HIPAA business associate agreement) and validation steps apply. This checklist covers the permissions work. Tidy permissions do not make Copilot use with that content compliant, and this checklist does not show that you meet those obligations.

What the free Excel checklist contains

The workbook has five tabs. How to use explains the status values and the order to work in. Checklist holds the 30 items in seven areas, each with why it matters, where to do it in Microsoft 365, a licensing note, a link to the Microsoft Learn page it comes from, and columns for status, owner, evidence and target date. Site review is a tracker with one row per SharePoint site: owner, sensitive content, oversharing found, whether an access review was sent and completed, and whether temporary protections or labels are applied. Summary counts done, in progress and not started items per area automatically, counts sites with no owner, and flags any site marked ready for Copilot without a completed, verified fix. Lists holds the drop-down values.

The workbook is free, with no form or sign-up. It is general guidance based on Microsoft's public documentation, not legal advice, and it is not published or endorsed by Microsoft. Microsoft changes Copilot features and licensing often, so check the linked Microsoft Learn pages when you use it.

Common follow-up questions

Sources

1. Microsoft Learn: Set up Microsoft Copilot and assign licenses
2. Microsoft Learn: Configure a secure and governed foundation for Microsoft Copilot
3. Microsoft Learn: Data, privacy, and security for Microsoft Copilot
4. Microsoft Learn: Considerations for Microsoft 365 Copilot security and compliance (Purview)
5. Microsoft Learn: Enable sensitivity labels for files in SharePoint and OneDrive
6. Microsoft Learn: Data access governance reports for SharePoint and OneDrive sites
7. Microsoft Learn: Initiate site access reviews for data access governance reports
8. Microsoft Learn: Restrict SharePoint site access with Microsoft 365 groups and Entra security groups
9. Microsoft Learn: Restrict discovery of SharePoint sites and content
10. Microsoft Learn: SharePoint Advanced Management features in Microsoft Copilot licenses
11. Microsoft Learn: What are access reviews? (Microsoft Entra ID Governance)
12. Microsoft Learn: Audit logs for Copilot and AI applications
13. Microsoft Learn: Data Security Posture Management for AI
14. Microsoft Learn: How shareable links work in OneDrive and SharePoint
15. Microsoft Learn: Microsoft Copilot overview