Copilot Readiness: Requirements, Built-In Checks and the 5 Fixes Before Rollout

Copilot readiness means two things: your tenant meets Microsoft’s technical requirements, and your data is safe to put in front of an assistant that can find anything a user is allowed to open. The technical half (licenses, accounts, apps, update channels, network) usually takes days. The data half (oversharing, labels, access reviews) takes weeks, and it’s where most rollouts stall.

Copilot doesn’t create new access. Microsoft documents that it only surfaces organizational data a user already has at least view permission to, using the same permission model as the rest of Microsoft 365. So whatever is overshared, mislabeled or left over from old projects becomes something it can surface in an answer. Organizations that fix five things first tend to have smooth rollouts; those that skip them tend to have a pause, a cleanup and a restart. This guide covers both halves, the readiness checks Microsoft already gives you, and a go or no-go checklist.

A note on names: Microsoft now calls Microsoft 365 Copilot simply Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat. Some licenses and pricing pages still use the old names during the transition. Below, “Copilot” means the paid, licensed experience and “Copilot Chat” the one included with eligible plans.

Copilot readiness checklist at a glance

Checked against Microsoft Learn (Microsoft Copilot requirements, License options for Microsoft Copilot and the Microsoft Copilot readiness report) and microsoft.com pricing on October 8, 2026.

Part 1: technical and licensing readiness

Microsoft publishes the requirements on Microsoft Learn. These are the ones that most often hold up a pilot:

• Licenses. Each user needs a Copilot license on top of a qualifying plan. Qualifying plans include Microsoft 365 E3 and E5, Business Basic, Standard and Premium, Office 365 E1, E3 and E5, the F1 and F3 frontline plans, and a long list of standalone plans; Microsoft 365 E7 includes Copilot. Copilot isn’t available with device-based licensing for Microsoft 365 Apps for enterprise.
• Accounts and admin roles. Users need a work or school account in Microsoft Entra ID. The AI Administrator role lets someone manage Copilot without Global Administrator rights.
• Mailboxes and OneDrive. Experiences that use email, calendar or meetings need an Exchange Online mailbox, and some features need a OneDrive account. Copilot isn’t available in group mailboxes.
• Apps and update channel. Microsoft’s readiness report counts users on Current Channel or Monthly Enterprise Channel as eligible, so devices on slower channels need to move first. Check your privacy settings too: if you turn off connected experiences that analyze content, Copilot isn’t available in Word, Excel, PowerPoint, Outlook and OneNote.
• Teams meetings. For Copilot to use meeting content after a meeting ends, transcription or recording has to be configured.
• Browser and network. Copilot in Word, Excel and PowerPoint for the web needs third-party cookies enabled. Allow the whole *.cloud.microsoft domain (Microsoft doesn’t support allowing only selected URLs inside it), and make sure proxies and TLS inspection don’t break WebSocket connections.

What Copilot costs

On microsoft.com today, Microsoft 365 Copilot for enterprise is listed at $30.00 per user per month paid yearly, or $31.50 paid monthly with an annual commitment. For businesses with up to 300 users, Microsoft 365 Copilot Business is listed at $21.00 per user per month paid yearly, with a promotional $18.00 for the first year on annual commitments bought between July 1 and December 31, 2026. These are US list prices; check the price for your region and agreement before you budget.

Before buying, check what people already have. Copilot Chat is included at no extra cost with eligible Microsoft 365 plans and comes with enterprise data protection. It’s mostly web-grounded, but users can upload files, and in Outlook it can work across their email, calendar, meetings and chats even without a Copilot license. That’s one more reason to start the permission cleanup before you buy a single license, and it gives everyone outside the pilot a governed option in the meantime.

Microsoft’s built-in Copilot readiness checks

You don’t need a third-party tool to check technical readiness. Microsoft provides several, and they’re worth running before the pilot starts:

• The Copilot readiness report in the Microsoft 365 admin center (Reports, then Usage, then Microsoft Copilot). Its Readiness tab shows users with prerequisite licenses, users on an eligible update channel, and assigned and available Copilot licenses. For customers who buy Copilot licenses, it also flags suggested candidates: the top 25% of unlicensed users by Teams, Outlook and document activity, refreshed weekly. Microsoft says that data isn’t meant for evaluating employee performance.
• The Copilot License Details diagnostic (aka.ms/CopilotLicenseDetails) checks whether a specific user meets the licensing requirements.
• The SharePoint Advanced Management Content Management Assessment in the SharePoint admin center identifies potentially overshared content and inactive or ownerless sites, with recommendations. Microsoft suggests rerunning it every 30 days. SharePoint Advanced Management is included with Copilot licenses.
• Microsoft Purview data risk assessments in Data Security Posture Management run a default weekly assessment that flags oversharing risks and recommends protections.
• The connectivity test for the Copilot app confirms your network can reach the *.cloud.microsoft domain.

What these tools can’t tell you is whether your organization is ready: whether people have read a policy, whether anyone owns the pilot, or which tasks you’ll measure. That’s what a six-dimension AI readiness assessment covers, and it’s why the five fixes below matter more than any single setting.

Part 2: the five fixes that make Copilot safe to roll out

Microsoft’s requirements page says a secure, governed data foundation isn’t required but is strongly recommended. The five fixes below come from the AI readiness assessment, and each has a detailed guide in this series. Do them in this order.

Fix 1: oversharing

This is the most common reason to delay a Copilot rollout. Sites shared with everyone, organization-wide sharing links, old team sites nobody owns: before Copilot, these were protected by the fact that nobody went looking. Afterward, a simple question can surface them. Microsoft notes that SharePoint sets sharing to the most permissive option by default, so don’t assume yours were tightened.

The fix is a focused cleanup, not an audit of every file. Start with SharePoint Advanced Management’s data access governance reports: the site permissions baseline, the “Everyone except external users” report and the sharing links reports show where access is broadest. Remove broad access on your most sensitive sites, assign owners, run site access reviews so owners confirm who should be there, and change sharing defaults. While cleanup continues, Restricted Content Discovery keeps a sensitive site out of Copilot and organization-wide search without changing its permissions; Microsoft positions it as a temporary protection, not the fix. The 30-day plan is in fix SharePoint oversharing before you turn on Copilot.

Fix 2: sensitivity labels and DLP

Labels tell Microsoft 365 which content is sensitive, and DLP enforces what can happen to it. Copilot honors the usage rights of label-applied encryption, and when Copilot in Word, PowerPoint or Outlook creates something from a labeled file, the new content inherits the label. Purview DLP can also stop Copilot from processing files and emails with specific labels, and from responding to prompts that contain sensitive information types. Start with four labels and your two or three most sensitive data types, in audit mode before enforcement. The rollout is in sensitivity labels and DLP before AI: the 30-day rollout.

Fix 3: access reviews

Oversharing is about sites; access reviews are about people. Years of role changes leave people in groups they no longer need, and Copilot will search on their behalf across everything those groups can reach. Review membership of the groups that grant access to finance, HR, legal and executive content, starting with the people in your pilot group. Guidance on reviews that actually remove access is in identity is your AI control plane.

Fix 4: policy and training

People need to know what they’re allowed to do with Copilot and how to get value from it. Publish a short acceptable use policy that covers data tiers and makes people responsible for checking output (Microsoft itself says generated responses aren’t guaranteed to be 100% factual). Pair the rollout with practical training built on real tasks from each team. Untrained users try Copilot a few times, get a vague answer to a vague question, and stop. Microsoft’s adoption site (adoption.microsoft.com) has a Copilot IT checklist, a Copilot Champion Playbook and the Microsoft Scenario Library to build training from. The free AI acceptable use policy template covers the policy.

Fix 5: a measured pilot

Don’t license everyone at once. Start with a pilot group of a few dozen people across several roles, choose two or three specific tasks for them, and measure how long those tasks take before the pilot starts. That baseline is what turns “people like it” into a renewal case. Baseline before you build covers the method.

Choosing the pilot group

If you’re piloting with one team before a company-wide rollout, pick a team whose own access has already been reviewed, give them two or three tasks to measure, and agree up front what result would justify expanding. For a cross-team pilot:

• Mix roles: people who write a lot, people who attend a lot of meetings, people who search for information all day. Different roles reveal different value. The readiness report’s suggested candidates are a reasonable starting list of heavy Microsoft 365 users.
• Include IT, so the team that will support Copilot learns it first.
• Include a few skeptics. They’ll find the weaknesses early.
• Be careful with executives. Senior leaders usually have the broadest access, so they’re the most likely to see overshared content. Include them after the permission cleanup, not before.

Getting value, not just safety

A safe rollout that nobody uses is a wasted license. During the pilot, collect the prompts that work for each role: summarizing a long email thread before a meeting, pulling action items from a recording, drafting a document from existing files, finding patterns in a spreadsheet. Put the best ones in a shared library, and name a champion in each pilot team to share tips. People tend to adopt a tool when they see a colleague use it well on a task they recognize, which is why champions often do more than formal training.

The asset: a Copilot rollout gate checklist

Use this as a go or no-go gate before licensing goes beyond the pilot group.

1. Pilot users confirmed eligible in the readiness report or the License Details diagnostic, on Current Channel or Monthly Enterprise Channel.
2. The *.cloud.microsoft domain allowed and the Copilot connectivity test passing.
3. Broad sharing removed from the most sensitive sites, each with a named owner.
4. Default sharing links changed to specific people.
5. Restricted Content Discovery on for any sensitive site still waiting for cleanup.
6. Sensitivity labels published, with auto-labeling for the most sensitive data types.
7. DLP in place for email, cloud storage, endpoints and Copilot.
8. Access reviews completed for sensitive groups.
9. User consent to third-party apps restricted.
10. Acceptable use policy published and acknowledged.
11. Training delivered, with examples from each team’s own work.
12. Pilot baselines captured and results measured.
13. Microsoft Purview auditing turned on (Copilot interactions are then logged automatically under Audit Standard).
14. Usage reports reviewed, with a plan to reassign unused licenses.
15. A named owner for the rollout and its results.

After the pilot

Expand in waves, team by team, repeating the permission and access checks for each new group’s content. Keep measuring: usage shows whether people are using it, and the baseline tasks show whether it’s worth it. Check usage reports monthly, and reassign licenses that go unused.

What if you can’t do all five first?

You don’t have to finish everything before a small pilot. A pilot group of a few dozen people can start once their own access has been reviewed and the most sensitive sites are cleaned up or fenced off. What you shouldn’t do is license the whole organization before fixes 1 and 3 are done. Those two are what stand between a useful assistant and an unplanned disclosure.

Copilot readiness is one part of AI readiness

Copilot is often an organization’s first AI rollout, but it won’t be the last. The same five fixes prepare you for whatever comes next, because they’re foundations rather than Copilot settings. To see the full picture across data, security, infrastructure, skills, use cases and governance, start with the AI readiness assessment guide, or work through the 24 questions in the AI readiness checklist.

Where does your team actually stand?

The free AI Readiness Score asks 10 questions across all six dimensions and gives you a score and your red flags in about 3 minutes.

Get your free AI Readiness Score →

The sample report follows a Microsoft 365 organization through exactly this sequence. Flip through all 38 pages.

Related guides

• Fix SharePoint Oversharing Before You Turn On Copilot
• Sensitivity Labels and DLP Before AI: The 30-Day Rollout
• Identity Is Your AI Control Plane: SSO, RBAC, and Access Reviews
• AI Acceptable Use Policy Template: Free Download, Examples and a 30-Day Plan
• Baseline Before You Build: Metrics That Make AI Pilots Fundable