Copilot readiness assessment: how to run it and what to do with the data you uncover

What a Copilot readiness assessment should produce

A Copilot readiness assessment answers one question: if Microsoft 365 Copilot were switched on tomorrow, what could each user surface, and should they be able to? Copilot draws on content the user can already reach, so years of loose sharing in SharePoint, OneDrive and Teams become visible in seconds. The assessment finds that exposure, fixes it and hands the client a governed tenant.

Done well, it also produces a second deliverable most partners throw away: a map of the client's history, workload by workload, with the oldest content dates and the systems outside the tenant that hold the rest. That map belongs to the client. For the right company it is the starting point for a conversation about licensing those records to AI developers through SourceX, which manages data licensing from rights review to delivery and payment.

Prerequisites

• A sponsor with authority over the tenant and its content, ideally the owner, CEO, CFO or COO, not only the IT manager.
• Read-only admin access for discovery, agreed in the statement of work.
• Written agreement that discovery uses metadata, reports and site purpose, not opening users' files.
• A list of systems outside Microsoft 365 that hold business records: CRM, ERP, helpdesk, engineering and finance.
• Counsel's list of any litigation holds, so nothing under hold is changed.

How to run the assessment in eight steps

1. Confirm licensing and identity basics. Check eligible licenses, MFA coverage, conditional access and stale accounts. Disabled-but-licensed users and forgotten guest accounts are common findings.
2. Inventory the content estate. List sites, Teams, OneDrive accounts and mailboxes with owners, creation dates, last activity and storage used. Note the oldest content in each, including libraries migrated from old file servers.
3. Find oversharing. Pull sharing reports for organization-wide links, anyone links, broad groups on sensitive sites and broken permission inheritance. Rank findings by sensitivity, not by volume.
4. Classify what you found. Sort content into active work, historical record, sensitive (HR, legal, finance, health, client-owned) and redundant, obsolete or trivial.
5. Remediate by restricting, not deleting. Remove broad links, tighten site membership, apply sensitivity labels and exclude historical libraries from search where needed. Leave archives in place; deletion is an owner decision, not a readiness task.
6. Set retention deliberately. Agree retention policies with the client and counsel. A policy that purges content after a short period can quietly erase years of history the owner may later value.
7. Write the history map. For each workload and each outside system, record the oldest year, record types, owners, approximate scale and export route. Metadata only.
8. Present both deliverables. The remediation report goes to IT. The history summary goes to the owner with one question: is this history worth assessing as an asset?

Content that needs care before anyone acts on it

Some content raises legal questions before Copilot or licensing even come up, and Teams meeting recordings and transcripts are the obvious example. Federal law, at 18 U.S.C. section 2511(2)(d), generally permits a person who is a party to a communication, or who has one party's prior consent, to record it, but some states require every party's consent. California's Penal Code section 632 prohibits recording a confidential communication without the consent of all parties. Flag recordings by location and date and let counsel decide on notices and use.

Flag, rather than touch, HR investigations, legal matter folders, health information and files that belong to the client's own customers. This is general information, not legal, tax or financial advice. Confirm with the client's counsel before acting.

Common mistakes

Illustrative example

Illustrative, fictional scenario. A Microsoft partner runs a Copilot readiness assessment for an industrial distributor with about 220 full-time employees. Discovery shows a tenant created in 2015, a sales SharePoint migrated from file servers with folders back to 2009, nine years of shared customer-service mailboxes, a Teams channel for every key account, and an ERP and helpdesk outside Microsoft 365.

The partner removes organization-wide links on 40 sites, labels the pricing and HR libraries, and excludes the pre-2015 archive from search instead of deleting it. In the readout, the history summary prompts the CFO to ask what those records might be worth. The partner explains the option, discloses the referral share and sends a referral link. The distributor applies and completes its own data inventory with SourceX; the partner never moves or describes any content.

Raising the history summary with the owner

How rewards work for Microsoft partners

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Nothing is payable until the buyer pays and SourceX receives its fee; an introduction, a meeting or a signed agreement on its own does not trigger it, and rewards are not guaranteed. The reward is a share of SourceX's fee and never comes out of the client's payment. Check who qualifies before raising it: the client needs 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license its records and an authorized sponsor.

Next step

Add a history summary slide to your readiness readout template and test it on your next assessment. Then register as a partner. For the wider offer, see MSP AI services; the company data readiness survey is a useful companion to the history summary, and the IT due diligence checklist applies if you assess tenants for acquirers. Before any server or laptop refresh, run through the ITAD data destruction checklist, and use the network opportunity finder to decide which clients to approach next.