Six control areas are scored from 0 to 100 against the Microsoft 365 Copilot prerequisites and weighted by data-exposure impact. Open any card to see what is checked and the reasoning behind the score.
Key observations
Identity is not the main risk
At 88, Entra ID with PIM is the strongest area. Remaining effort is better directed elsewhere.
Content exposure determines the Go decision
At 47, this area lowers the overall score. 26 sites still have broad access.
Label coverage is holding the wider rollout
61% on key repositories against the 90% Zertain threshold. Approving auto-labelling is the quickest improvement.
Readiness validation and the Go / No-Go recommendation are covered on the Validation and Deliverables screens. The Copilot operating model and the policy updates required before deployment follow the control areas below.
Copilot operating modelR responsible · A accountable · C consulted · I informed
ActivityM365 admin (GDC IT)Security & ComplianceService deskSite & data ownersGovernance board
Copilot licence assignment & admin settingsA/RCI–I
Security monitoring – audit, DSPM for AI, alertsCA/RI–I
Label, DLP & retention policy changesCA/RICI
Oversharing exceptions & site access reviewsCA–RI
User support & incident triageACR––
Acceptable-use policy, training & exceptionsIRI–A
Agents, connectors & agent sharing approvalRC–CA
Policy updates required before deployment
PolicyUpdate neededOwnerStatus
Information classification policyAdd Copilot handling of labelled content and default library labelsSecurity & ComplianceDrafted
Acceptable use policyGenerative-AI addendum: permitted use, prohibited data, human review of outputGDC GovernanceIn draft
Records retention scheduleAdd a retention class for Copilot prompts and responsesGDC RecordsProposed
External sharing & collaboration policyAnonymous links off for sensitive sites; owner-approved exceptions onlySecurity & ComplianceProposed
Access review standardQuarterly owner attestation of access on sensitive sitesSite & data ownersProposed
Decision: allow or block web groundingWhether Copilot may use web search to ground responsesGDC GovernanceDecision pending