Microsoft Copilot (formerly Microsoft 365 Copilot) answers questions using everything a person already has access to. In most offices that includes files nobody meant to share: an old salary spreadsheet in a team site, a folder shared with "everyone," a SharePoint site from a project that ended years ago. Copilot doesn't create those problems. It just makes them easy to find. An AI readiness assessment fixes the foundation first, so AI makes your team faster without surprising anyone.
What the assessment covers
- Oversharing review. Finding SharePoint sites, Teams and OneDrive files that are shared too widely, using SharePoint Advanced Management and Microsoft Purview reports.
- Access cleanup. Removing "everyone" access where it doesn't belong, fixing broken permissions, and making sure every site has an owner.
- Sensitivity labels. A simple set of labels, such as Public, Internal and Confidential, so sensitive documents carry protection with them and can be kept out of Copilot responses.
- Interim protections. Where cleanup will take time, temporary controls such as Restricted Content Discovery keep sensitive sites out of Copilot until they're fixed.
- AI use policy. A plain-language policy covering which AI tools are approved, what data can go into them, and how staff should check AI output.
- Licensing review. What your current Microsoft 365 licenses include, and whether Copilot licenses make sense for which people.
- Use cases and pilot plan. The handful of jobs where AI will save the most time, and a pilot group to prove it.
These steps follow Microsoft's own guidance for a secure Copilot deployment, which starts with fixing oversharing and putting guardrails in place before rollout.
Who it's for
Organizations planning to buy Microsoft Copilot, those that bought it and want to roll it out safely, and anyone whose leadership is asking "what's our AI plan?" It matters most where data is sensitive: healthcare, financial services, legal and anyone handling client records.
How the work runs
- Kickoff. We learn your goals for AI, your data and your concerns.
- Assessment. Permissions, sharing, labels, licensing and current AI use are reviewed.
- Findings. You get a prioritized list: what to fix before rollout, what can wait, and where AI will help first.
- Remediation. We fix the oversharing, set up labels and controls, and help you finalize the AI policy.
- Pilot. A small group starts using Copilot on real work while we gather feedback.
The timeline depends on the size of your Microsoft 365 environment and how much cleanup the assessment turns up.
What you get at the end
- A cleaner, safer Microsoft 365 environment.
- Sensitivity labels and Copilot protections in place.
- An AI use policy staff can actually follow.
- A licensing recommendation and a pilot plan with clear goals.
What comes next
Once the foundation is ready, AI agent automation builds on it, and AI data security keeps AI use in check across the organization. Our vCIO and IT strategy service keeps AI in your long-term technology plan. Mash IT is based in Lexington, Kentucky, and works with organizations across Central Kentucky.
Common questions
You can, but Copilot shows people everything they already have access to. If files are overshared, Copilot makes them easy to find. Fixing access first avoids that surprise.
Yes. Staff are probably already using AI tools. A short policy on what's approved and what data can go into them prevents the most common mistakes.
It depends on the size of your Microsoft 365 environment and how much cleanup the assessment finds. The assessment itself gives you a realistic plan for the rest.
Yes. The policy and the visibility we set up cover AI use in general, not just Copilot.