AI Readiness Assessment Before Microsoft Copilot

An AI readiness assessment is a structured check of your Microsoft 365 tenant before you switch on Microsoft Copilot, the product Microsoft previously called Microsoft 365 Copilot. It confirms that licences and accounts are in place, finds the sites and files that too many people can open, sets the rules staff will follow, and plans a pilot you can measure. The reason to do it first is simple: Copilot works with whatever each user can already reach, so a loose permission can surface as soon as someone asks the right question. We run these assessments as a Copilot implementation partner in Dubai.

What does an AI readiness assessment cover?

It covers seven areas, each ending in a decision or a fix.

• Licences: who gets a Copilot licence first, and whether their Microsoft 365 plan qualifies.
• Identity: every user has a Microsoft Entra ID work account, leavers are disabled, and admin rights sit only with the people who need them.
• Permissions: SharePoint sites, Teams and OneDrive folders that are open to more people than they should be.
• Sensitivity labels: whether confidential content is labelled and, where needed, encrypted.
• Retention: how long Copilot prompts and responses are kept, and who can search them.
• AI policy: what staff may put into AI tools, and how they check what comes back.
• Pilot design: which users, which tasks, and which numbers decide whether to expand.

Which licences and accounts does Microsoft Copilot need?

Each user needs an eligible Microsoft 365 base licence, a Microsoft Copilot licence for the licensed features, and a work account in Microsoft Entra ID. Microsoft's requirements page notes that Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat.

The same page also lists:

• An Exchange Online mailbox for experiences that use email, calendar or meeting data.
• A OneDrive account, which some Copilot features need.
• Microsoft 365 Apps deployed to users who need Copilot in the desktop apps.
• Teams meeting transcription or recording, if you want Copilot to use meeting content after the meeting ends.
• Network rules that allow the Microsoft 365 and Copilot endpoints.

Two details are easy to miss. First, Copilot is not available with device-based licensing for Microsoft 365 Apps for enterprise, so check how each user's apps are licensed. Second, Copilot Chat is available to users with an eligible Microsoft 365 subscription without a Copilot licence, so your staff may already be able to use an AI assistant at work. Start the policy work before buying Copilot licences.

For admin work, use Microsoft's AI Administrator role, which manages Copilot and AI settings without Global Administrator permissions.

How do you find and fix oversharing before rollout?

Find the content that is open to more people than it should be, fix or restrict the highest-risk sites, and only then switch Copilot on. Microsoft states that Copilot only surfaces organisational data to which individual users have at least view permissions. So Copilot inherits every old sharing decision in your tenant: the finance folder shared with the whole company years ago, or the project site open to everyone except external users. Copilot does not create these gaps. It exposes them.

Microsoft notes this includes permissions given to people outside your organisation, such as through shared channels in Microsoft Teams, so review guest and external access too.

Microsoft's Copilot deployment guidance is built around three pillars: remediate oversharing, set up guardrails and meet regulations. It also notes that SharePoint Advanced Management is included with the Microsoft Copilot licence. A practical order of work:

1. Measure. Run the data access governance reports in SharePoint Advanced Management to identify sites that might contain overshared or sensitive content, including items shared with "Everyone except external users".
2. Delegate. Start site access reviews, which hand the review of overshared sites to their site owners.
3. Contain. For high-risk sites you cannot fix before go-live, use restricted content discovery to stop them surfacing in Copilot, or restrict access to the site to specific groups.
4. Label. Check the sensitivity label snapshot report, then label confidential content. Where a label applies encryption, Microsoft says Copilot honours the usage rights granted to the user. See sensitivity labels.
5. Monitor. Keep the reports running after launch.

Microsoft Purview adds tools to prevent data loss and support compliance for Copilot and the data it references, covered on our Purview DSPM for AI page.

What policies should be in place before staff use AI?

At minimum, you need an acceptable use policy, a rule for what data may go into prompts, and a requirement to review AI output before anyone sends it or relies on it.

• Acceptable use: which AI tools are approved, and what must never be pasted into any of them.
• Data handling: which labels or data types stay out of prompts. Admins choose which agents are allowed, and Microsoft advises checking each agent's privacy statement and terms of use for how it handles your data.
• Output review: Microsoft's own guidance tells users to use their judgement when reviewing Copilot output before sending it to others. Name who signs off AI-assisted documents that go to clients.
• Retention: Microsoft stores prompts and responses as part of each user's Copilot activity history, and admins can set retention policies for them in Microsoft Purview. Agree the period with your compliance owner.
• Training data: Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. Put that in the staff briefing.

For a framework, the NIST AI Risk Management Framework is intended for voluntary use. Its Generative AI Profile, NIST AI 600-1, released in July 2024, can help organisations identify risks unique to generative AI and proposes actions to manage them. Our AI governance framework page goes further, using the same NIST framework.

Where is Copilot data processed for UAE organisations?

Storage and processing are separate questions. Stored Copilot prompts and responses for a UAE tenant are covered by Microsoft's data residency commitments, while in-country processing for the UAE is, in Microsoft's update of 3 April 2026, expected by the end of 2026.

• Storage: Microsoft states that tenants with a UAE sign-up country are covered by its Product Terms data residency commitments for Microsoft 365 Copilot. Stored prompts and responses sit in the region set by your tenant's data residency configuration.
• Processing: Microsoft Learn's privacy page says customers outside the EU may have their queries processed in the US, EU or other regions. When we checked in November 2026, Microsoft's announcement on in-country processing carried an update dated 3 April 2026, which said local data inferencing for Microsoft 365 Copilot interactions is expected to become available in the UAE by the end of 2026.
• Model choice: Microsoft offers third-party models in Copilot, such as Anthropic and OpenAI models. Admins decide whether to use them, and additional terms may apply, so review that setting.

If a contract or regulator requires processing inside the UAE, record that requirement during the assessment, note what Microsoft commits to on the day, and decide which data stays out of Copilot until the position changes. Re-check before go-live, because Microsoft's own note says it is refining the timeline and scope.

How should you run and measure a Copilot pilot?

Choose a small group with real, repeatable tasks, agree the measures before licences are assigned, and decide in advance what result justifies expanding.

• Who: people from a few teams with different work, such as finance, sales and operations, plus a site owner to report permission surprises.
• What: a short list of named tasks per team, such as summarising long Outlook threads, drafting first versions of proposals, or recapping Teams meetings. Our guide to what Copilot does day to day has more examples.
• Adoption measures: the Copilot usage report in the Microsoft 365 admin center shows enabled users, active users and the active users rate, which is active users divided by enabled users, over the last 7, 28, 90 or 180 days. Microsoft also points IT leaders to the Copilot Dashboard in Viva Insights to explore readiness, adoption and impact.
• Value measures: for each named task, record the time taken before and during the pilot, plus a short user survey. Usage alone does not prove value.
• Safety measures: log every case where Copilot surfaced something a user should not have seen, then fix the permission, not the prompt.
• Decision: at the end, expand, extend or stop, based on the numbers agreed at the start.

We have implemented Microsoft 365 Copilot, now named Microsoft Copilot, in more than 40 tenants. Every project starts with permissions, sensitivity labels and the use cases teams will actually adopt, and adoption is then tracked through the Copilot Dashboard rather than assumed.

What should the assessment hand you at the end?

You should finish with five documents you can act on:

1. A licence plan: who is licensed first, and any base licence changes needed.
2. A fix list ranked by risk: sites to restrict, labels to publish, guests to remove and settings to change.
3. A short AI policy ready for staff to sign.
4. A data location note recording Microsoft's current UAE position and any data you will keep out of Copilot.
5. A pilot plan with users, tasks, measures and a decision date.

If you would like this done for your tenant, book a Copilot readiness call and we will start with your permissions.