Microsoft 365 Copilot Readiness Checklist for Small Businesses

Microsoft 365 Copilot can save real time: summarising long email threads, drafting documents from your own files and pulling together what was agreed in last week's Teams meeting. But it has one feature that catches businesses out. It can find anything a person already has access to, and in most businesses that's far more than anyone realises.

That old salary spreadsheet shared with "everyone" in 2021, the HR folder a whole Team can open, the client file sent with an "anyone with the link" share: Copilot doesn't break your permissions, but it makes whatever they expose very easy to find. This checklist is how we prepare small businesses before Copilot is switched on.

How Copilot Uses Your Data

Microsoft 365 Copilot works inside your Microsoft 365 tenant. When someone asks it a question, it searches the emails, chats, meetings and files that person can already open, and uses them to answer. Microsoft states that your prompts, responses and business data aren't used to train the underlying AI models.

So the risk isn't Copilot leaking data to the outside world. It's people inside your business seeing things they were never meant to, because permissions were set too loosely years ago.

1. Check Your Licences and Apps

• Microsoft 365 Copilot is a paid add-on licence on top of an eligible Microsoft 365 plan, such as Business Standard or Business Premium.
• Keep Microsoft 365 Apps, Outlook and Teams up to date, as Copilot features arrive through normal updates.
• Check what staff already have: Microsoft 365 Copilot Chat is available to work accounts and can work with web content and files people upload, which is a useful, lower-risk place to start.

2. Find and Fix Oversharing

This is the most important step. In SharePoint, OneDrive and Teams, look for:

• "Anyone" links that let anyone with the link open a file, often created years ago and forgotten.
• Sites or folders shared with "Everyone except external users", which means every person in your organisation.
• Public Teams that anyone in the business can join and search.
• HR, finance, payroll, board and client folders that more people can open than should.

The SharePoint admin centre has sharing settings and reports that help you find these. Tighten access to the people who genuinely need it, and set sensible defaults so new links are shared with specific people rather than everyone.

3. Tidy Out-of-Date Content

Copilot answers from what it finds. If your files are full of old drafts, superseded price lists and duplicate policies, it may quote the wrong version. Archive or delete stale sites and documents, and make sure the current version of anything important is clearly the one people, and Copilot, will find.

4. Label Your Most Sensitive Information

Sensitivity labels from Microsoft Purview let you mark documents and emails as, for example, Confidential, and apply protection such as encryption or restricted access. Microsoft 365 Business Premium includes the ability to create and apply these labels. Start simply with two or three labels for your most sensitive information, such as HR, financial and client-confidential.

5. Get the Security Basics Right

• Multi-factor authentication for every account, so a stolen password doesn't give an attacker a Copilot that can search everything.
• Conditional Access and device management, so company data is only reached from trusted devices.
• Remove accounts for people who have left, and review guest access.

6. Give Staff an AI Policy

Staff need to know which AI tools are approved, what must never be entered into them, and that AI output must be checked before it's sent to anyone. Our free AI acceptable use policy template is a good starting point.

7. Start With a Pilot

Give Copilot licences to a small group first, ideally people with plenty of email, documents and meetings. Agree what you'll measure, such as time saved on meeting notes or first drafts, and gather feedback for a few weeks. Fix any permission surprises the pilot uncovers before rolling out wider.

8. Keep Reviewing

Readiness isn't a one-off job. New sites, Teams and shares are created every week. Review sharing reports regularly, keep labels up to date, and check usage reports in the Microsoft 365 admin centre to see whether Copilot is actually being used and where training would help.

Want Us to Check It for You?

Our AI Readiness Check reviews the AI tools your team already uses, your Microsoft 365 sharing and permissions, and where AI will save the most time, then gives you a short, plain-English report. We also build AI automations for the jobs Copilot doesn't cover.