Is your Microsoft 365 ready for Copilot? A small-business checklist

Microsoft 365 Copilot does not get new access to anything. It uses the permissions each person already has, across Outlook, OneDrive, SharePoint and Teams. That is good design, and it is also the problem: years of quick sharing decisions mean many people can open files they have never seen, and Copilot will happily find and summarise them.

Ask Copilot “what are people paid here?” in a tenant where the HR folder was once shared with everyone, and it will answer. Nothing was hacked. The permissions simply said yes.

• SharePoint sites and Teams set to public, or shared with “Everyone except external users”
• Files and folders shared with “Anyone with the link” links that never expire
• OneDrive folders of former staff, still shared after they left
• Old project sites nobody owns any more

Make sites private unless they genuinely need to be open, remove broad groups, and set sharing links to expire. Microsoft 365's sharing reports are the place to start.

Payroll, HR, client records, finance, legal. List them, check exactly who can open each one, and narrow it to the people who need it. If you have Business Premium, sensitivity labels let you mark and protect those files so the protection travels with them.

If you handle protected health information or other regulated data, confirm your obligations cover AI use before the rollout, not after.

Copilot that works across your own files is an add-on licence on top of an eligible Microsoft 365 business plan, assigned person by person. Staff with a work account can also use Copilot Chat, which answers from the web with Microsoft's enterprise data protection but does not read your files on its own. Microsoft changes Copilot's plans and prices often, so check the current terms before buying.

Licences are per person, which makes a pilot easy: you do not have to buy for everyone at once.

Pick three to five people whose work is heavy on email, documents and meetings. Give them licences, a short session on their own tasks, and a few weeks. Ask them to keep note of what saved time and what got something wrong. That evidence decides whether to roll it out further, not the demo.

A one-page AI use policy tells staff which tools are approved, what must never go into them, and that they own whatever they send. See how to write an AI use policy.

• MFA enforced on every account, admins included
• Public sites and org-wide sharing reviewed and narrowed
• “Anyone” links removed or set to expire
• Former staff accounts and their shared files cleaned up
• Sensitive folders identified, with access limited to the people who need it
• Regulated data obligations confirmed for AI use
• A pilot group chosen, with the tasks to measure written down
• A one-page AI use policy shared with everyone

The AI readiness check covers the same ground in ten questions.