Microsoft 365 Copilot readiness assessment
Copilot doesn’t break your permissions.
It follows them.
Everything your staff have quietly been able to reach for years, Copilot can now find in a sentence. Before you buy the seats — or if you already have — find out exactly what it would surface.
Copilot creates no new permissions. It works with what people can already access, so a Microsoft 365 Copilot readiness assessment is really a review of the access, sharing and identity configuration already in your tenant.
+ VAT · one tenant · three working days from approval
What it inherits
It is not a new risk. It is an old one, made findable.
Oversharing has always been there. What changed is that finding it used to require knowing it existed.
Every link set to “anyone”
A file shared with an open link three years ago is reachable by anyone who asks Copilot the right question — no sign-in, no membership, no trace of how they found it.
Every guest nobody reviewed
Guests keep whatever they were given. Copilot will surface it to them as readily as to an employee, and most tenants have not reviewed a guest list since the guest was added.
Every folder a migration got wrong
Inherited permissions from a move or a merge sit dormant for years. Copilot does not respect intent, only permissions — and it reads faster than anyone ever has.
What a Copilot readiness assessment tells you
The In-Depth assessment, read for one question: what can Copilot reach today?
- Which specific files Copilot can currently reach, by name and location
- Which of them contain payroll, bank, HR or contract data
- Who can reach them — staff, guests, or anyone with the link
- Whether your tenant holds the licence tier that could monitor this, and what it would cost if not
- A verdict: ready, or not ready, with the findings that decide it
This is Vitals In-Depth, not a separate product. The file-level detail is the point: “how much is overshared” is the wrong half of the question when you are deciding whether to switch Copilot on next week.
The verdict
Vitals will refuse to call a tenant Copilot-ready while critical findings are open. Not a dashboard that leaves the call to you — a verdict, in the report, in writing.
If it says ready, you have something to show the board. If it says not ready, you have the list that makes it ready, in the order to do it.
Isn’t Microsoft building this?
Yes. Ask whether you can use it.
Microsoft is adding Copilot readiness to Purview — preview November 2026, general availability January 2027. It is a good tool and we would rather say so than pretend.
It needs E5 Compliance or the Purview add-on
Microsoft 365 Business Premium does not include it — not even with the Purview Suite add-on. If you are on Business Premium or Business Standard, the native answer is not available to you at a price you would recognise.
We tell you which you are, and what it would cost
Your report says whether your tenant already holds that tier. If it does, use it — we will say so. If it does not, we say that too, and what the upgrade would cost against what it is protecting. Microsoft will never tell you that you are over-licensed.
And the honest advice is usually the cheaper one: an overshared folder put right costs nothing a month and removes the risk. A licence costs every month and only shows it to you. We are not selling the licence either way.
What the assessment covers
Copilot readiness is one verdict drawn from the whole tenant review — see all 27 Microsoft 365 checks, see how the assessment works, or read about Vitals security and access to see exactly what is read and what is not.
Find out before you turn it on.
Twenty-seven checks, the files named, a verdict at the end. Three working days from the moment your administrator approves read-only access.