Copilot Readiness Checklist: Fix Oversharing and Purview Labels Before Your 30-Day Trial

Microsoft is subsidizing Copilot adoption through December 31, 2026 with 30-day Microsoft 365 Copilot Business trials and discounted Purview licensing. A trial only pays off if Copilot can find the right content and cannot find the wrong content. This checklist covers what to fix before the trial starts.

Why readiness comes first

Copilot respects existing permissions. That is the whole problem. Most tenants have years of oversharing: sites where “Everyone except external users” has read access, documents shared with anyone-with-the-link, and Teams channels that were never cleaned up. Copilot surfaces all of it, accurately, to anyone who asks. Readiness work is permission hygiene plus sensitivity labeling, done before the first prompt.

The checklist

1. Run the oversharing report. Use SharePoint Advanced Management or the Copilot readiness reports in the Microsoft 365 admin center to list sites and files with broad access. Sort by sensitivity and fix the top of the list first.
2. Apply sensitivity labels that mean something. Three to five labels (for example Public, Internal, Confidential, Highly Confidential, PHI or PCI where applicable) with encryption and access policies on the top tiers. Auto-labeling for the patterns your regulators care about.
3. Turn on Restricted SharePoint Search or Restricted Content Discovery for the sites you have not cleaned yet. This keeps Copilot from indexing them until you are ready.
4. Fix identity. Conditional Access and MFA for every Copilot user; retire shared accounts; review guest access.
5. Define the pilot cohort and the measures. Twenty-five licenses is the trial size. Pick roles with repeatable knowledge work (analysts, project managers, service desk leads) and agree on three measures before day one, such as hours saved per week, first-draft turnaround, and satisfaction.
6. Decide the agent question early. Copilot Studio agents and the multi-tenant agent management preview mean users will build agents. Publish a policy on who may build, what data agents may touch, and how they are inventoried.
7. Plan the change. Champions, a prompt library for your industry, weekly office hours, and a 30-day success plan. Microsoft’s Copilot Success Planner is a reasonable skeleton.

What regulated organizations add

• Healthcare: PHI labeling and auto-labeling, Purview audit for Copilot interactions, and a policy on clinical use.
• Financial services: records retention for Copilot outputs, model-risk documentation for any agent that influences a decision, and Communication Compliance where required.
• Government: GCC or GCC High tenant considerations and the current Copilot feature parity for your environment.

Measuring the trial

Report weekly on adoption (active users, prompts per user), value (hours saved by role, self-reported and sampled), and control (labeled documents, oversharing items remediated, agents inventoried). A trial that ends with those three numbers has a business case. A trial that ends with anecdotes does not.