Plenty of Copilot trials fail quietly. The licences get assigned, a handful of enthusiasts use it for a fortnight, everyone else forgets it exists, and thirty days later someone in finance asks what the money bought.
The cause is rarely the technology. It is that nobody checked whether the tenant was ready before the clock started. Microsoft Copilot readiness is the work you do in the weeks before a trial, and it is the part most companies skip.
What Does Microsoft Copilot Readiness Actually Mean?
Microsoft Copilot readiness is the state of a Microsoft 365 tenant where licensing, identity, mailbox location, network access and data permissions all meet Copilot’s requirements before a single user is given a licence. A ready tenant produces useful, appropriate answers on day one. An unready one produces either nothing at all or far too much.
Microsoft splits the prerequisites into two groups, and the split matters:
- Required to deploy: licensing, an Exchange Online mailbox, a Microsoft Entra ID account, supported operating systems and browsers, and open network endpoints.
- Strongly recommended: SharePoint governance, Purview labelling and a phased rollout.
The required list is what stops Copilot working. The recommended list is what stops Copilot embarrassing you. Teams that clear the first and ignore the second are the ones pausing a rollout in week two.
Why the Weeks Before a Trial Decide the Result
A trial is a fixed window. Spend the first fortnight discovering that half your users sit on a hybrid mailbox and your finance site is open to the whole business, and you have burned the window on remediation instead of evaluation.
The answer you get at the end is then not an answer about Copilot at all. It is an answer about your tenant hygiene, and you will have paid for the privilege of learning it. Structured programmes such as Copilot in 30 only work if the groundwork is already done.
Is Your Tenant Actually Ready for Copilot?
Get an independent read on your licensing, mailbox configuration, SharePoint permissions and sensitivity labelling before the trial clock starts, so your thirty days measure what Copilot can do rather than what your tenant cannot.
Get a Strategic ConsultationWhat Are the Minimum Requirements for Microsoft Copilot?
A qualifying Microsoft 365 or Office 365 base plan, a Copilot add-on licence, a Microsoft Entra ID account, a primary mailbox in Exchange Online, a supported browser, and network endpoints that are not blocked. Miss any one of these and Copilot either fails to appear or works with a limp.
Qualifying base plans include Microsoft 365 Business Basic, Business Standard and Business Premium, Microsoft 365 E3, E5 and E7, Microsoft 365 F1 and F3, Office 365 E1, E3 and E5, and the A-series education plans. Copilot is an add-on, so it always sits on top of one of these rather than replacing it. Microsoft publishes the full minimum requirements to deploy Microsoft Copilot and keeps the list current.
Two of these catch organisations out again and again:
- Mailbox location. A user’s primary mailbox has to be in Exchange Online. On-premises and hybrid mailboxes do not support mailbox grounding, which is the mechanism that lets Copilot summarise threads and draft replies. Anyone mid-migration will get a hollowed-out version of the product.
- Update channel. Users need to be on Current Channel or Monthly Enterprise Channel. Estates parked on Semi-Annual Enterprise Channel for stability reasons will trail behind feature releases and give you a misleading read.
Mobile has its own floor: iOS 16 or later, iPadOS 16 or later, and Android 10 or later. Worth checking if your pilot group includes field staff.
Why Does Copilot Surface Files People Should Not See?
Because it respects the permissions you already have, and those permissions are almost always wider than anyone believes. Copilot does not break your access controls. It reads what a user could already have found through search, and it finds it far faster than they ever would have bothered to.
The exposure is almost always internal. That is what catches people off guard. The usual culprits:
- Sites shared with “Everyone except external users”, often set years ago and never reviewed since.
- Broken permission inheritance, where a folder or file no longer matches the site it sits in.
- Ownerless sites left behind by leavers and reorganisations.
- Default sharing links set to organisation-wide.
- Old drafts, superseded contracts and salary spreadsheets nobody archived.
None of this is new. It has simply been invisible, because finding it required somebody to go looking. Copilot removes that friction, and the first HR document that surfaces in a general query is how most organisations discover they had a problem all along.
How Do You Fix SharePoint Oversharing Before a Copilot Trial?
Find it, contain it, then remediate it, in that order. Most Microsoft Copilot readiness projects stall because someone tries to fix permissions across an entire estate before knowing where the risk actually sits.
Microsoft’s own sequence is the one worth following:
- Find it. Run a data risk assessment in Microsoft Purview Data Security Posture Management to surface sites holding sensitive data with overly permissive access, along with risky sharing links. A default assessment runs weekly across your top 100 SharePoint sites by usage.
- Contain it. Apply SharePoint Restricted Content Discovery to the worst offenders. That keeps those sites out of Copilot and agent results while you sort them out, without blocking the people who legitimately need access.
- Remediate. Fix ownership, repair inheritance, retire dead sites and reset default sharing so the problem does not quietly rebuild itself.
Tenants with Copilot licences get SharePoint Advanced Management included, which gives you a content management assessment covering oversharing, broken inheritance and ownerless sites. Most organisations already own the tooling for this. They have simply never run it.
Do Sensitivity Labels Stop Copilot Reading a File?
They can, if you configure them to. A Purview sensitivity label carrying encryption and user-defined permissions can block Copilot from extracting file content, and a data loss prevention policy for Copilot can keep labelled content out of grounding altogether.
Two things to check before you lean on this:
- Coverage. Labels only protect what has been labelled. A scheme applied to twelve per cent of your content protects twelve per cent of your content, no matter how well designed it is.
- Legacy IRM. Documents protected with legacy Information Rights Management are excluded from Copilot grounding entirely. If your teams still rely on IRM, move them across to sensitivity labelling or those files simply will not be available.
Labelling is the part of Microsoft Copilot readiness with the longest lead time, because it needs business input on what counts as confidential and who decides. Start it before the licences arrive, not afterwards.
Where Is UK Copilot Data Actually Processed?
Your files stay where your tenant sits. Your prompts and responses may not. This is the question UK organisations in regulated sectors should be asking before a trial, and it is missing from nearly every Microsoft Copilot readiness checklist written outside the UK.
Microsoft offers in-country data residency for Microsoft 365 and Copilot across 27 countries, which governs where your content is stored. Processing is a separate matter. In November 2025 Microsoft announced in-country processing of Copilot interactions, meaning the prompts and responses handled by the language models, and named the UK in the first wave.
That timeline has since moved. Microsoft’s April 2026 update now expects local inferencing for Copilot interactions in the UK by the end of 2026, alongside Australia, India, the UAE and the United States. Until that lands, UK prompt processing is not guaranteed to stay within the country. The UK also sits outside the EU Data Boundary, so assurances written for EU customers do not transfer.
For most commercial organisations this is a line in the risk register and nothing more. For financial services, healthcare, legal and public sector bodies it is a conversation to have with your DPO before the trial rather than after an auditor asks.
Who Should Be in Your Pilot Group, and What Should You Measure?
Pick people whose work Copilot can visibly improve, spread across enough functions to give you an honest read, then measure use rather than licence assignment. A pilot made up entirely of willing IT staff tells you nothing about whether the finance team will touch it.
A workable shape for a first cohort:
- Three or four departments with genuinely different workloads, such as sales, finance, HR and operations.
- A mix of enthusiasts and sceptics. The sceptics produce the more useful feedback by some distance.
- At least one senior sponsor who will use it personally rather than delegate it.
- Users already on a supported update channel with an Exchange Online mailbox, so you are testing the product and not the plumbing.
Give each group two or three specific tasks rather than open-ended access. “Summarise this week’s meetings and draft the follow-ups” produces measurable feedback. “Have a play with it” produces nothing you can take to a board.
On measurement, track active use by department weekly, time saved on named tasks as reported by the people doing them, and retention in the final week against the first. A spike in week one means very little. If usage in week four has collapsed, the issue is training or fit rather than the product itself. Our breakdown of what Copilot changes about the working day is a useful primer for pilot users, and our Copilot deployment guide covers what happens once the trial ends.
The Microsoft Copilot readiness report in the Microsoft 365 admin centre is a sensible place to build this list from. It shows licence eligibility, app usage and technical blockers across your estate on a rolling 28-day view.
Conclusion
Copilot is not a product you switch on and evaluate at arm’s length. It reflects the state of your tenant back at you, at speed, in front of your users. If the permissions are loose, it will find the loose permissions. If half the business is still on a hybrid mailbox, you will be assessing half a product.
Organisations that get a clean read from a trial are the ones who spent the preceding weeks on licensing, mailbox placement, SharePoint permissions and labelling, then chose a pilot group that looks like the actual business rather than the keenest volunteers. That preparation is unglamorous, and it is the whole game.
Transputec works with UK organisations on Microsoft Copilot readiness, covering tenant assessment, permissions remediation, sensitivity labelling and pilot design through our Microsoft Copilot consulting and Modern Workplace practices. If a trial is anywhere on your horizon, the time to look properly at your tenant is now, while there is still room to fix what you find.
FAQs
What Is Microsoft Copilot Readiness?
Microsoft Copilot readiness is the process of preparing a Microsoft 365 tenant so Copilot works correctly and safely from day one. It covers licensing, identity, mailbox location, network access, SharePoint permissions and sensitivity labelling. Microsoft treats the first five as required and the rest as strongly recommended, though in practice the recommended items are what decide whether a trial succeeds or stalls.
What Do You Need Before Starting a Microsoft Copilot Trial?
A qualifying Microsoft 365 or Office 365 base plan, Copilot add-on licences, Microsoft Entra ID accounts, primary mailboxes in Exchange Online, supported browsers and unblocked network endpoints. Beyond that technical floor you need a permissions review and a defined pilot group, otherwise the trial ends up measuring your tenant rather than the product. Our guide to the Copilot in 30 programme sets out how a structured trial is run.
How Long Does a Microsoft Copilot Readiness Assessment Take?
For a mid-sized estate, a focused assessment of licensing, mailbox configuration and permissions usually runs over a small number of weeks rather than months. Remediation is the variable. Cleaning up oversharing across a large SharePoint estate takes considerably longer than reviewing licences, which is why identifying the problem early matters more than fixing all of it at once.
Does Microsoft Copilot Keep UK Data in the UK?
Stored content follows your tenant’s data residency, and Microsoft offers in-country residency across 27 countries including the UK. Processing of prompts and responses is a separate question. Microsoft now expects in-country inferencing for UK Copilot interactions by the end of 2026, so until then prompt processing is not guaranteed to remain in the UK. Regulated organisations should raise this with their DPO before a trial begins.
Can Copilot See Files Employees Are Not Meant to Access?
Copilot only surfaces content a user already has permission to open, so it cannot break your access controls. What it can do is make existing oversharing obvious very quickly. Running a Purview data risk assessment and applying Restricted Content Discovery to high-risk sites before a trial is the practical fix, and both are available to tenants holding Copilot licences.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
