Microsoft Copilot Rollout Plan: Readiness, Permissions, Pilots

A Microsoft Copilot rollout plan has four steps: check readiness, clean up permissions, run a small pilot with named roles, then measure real use before you add more licences. We treat the permissions step as the most important. Microsoft's security documentation says Copilot only accesses data that users are authorised to access, so a file that is shared too widely today can appear in a colleague's Copilot answer tomorrow.

This article is general information based on Microsoft documentation read on 18 October 2026. Product names, licence tiers and admin screens change, so check each step against your own tenant.

What does Copilot see in your Microsoft 365 tenant?

Microsoft's Copilot overview describes the paid add-on licence, Microsoft 365 Copilot. With it, answers are grounded in your organisation's data through Microsoft Graph, and the data is pulled in automatically. Users without the add-on get Copilot Chat, which Microsoft describes as grounded in web content. It can also use a file the user uploads or has open in an app such as Outlook or Teams, and Microsoft offers agents in Copilot Chat that can reach organisational data, billed separately. Check the current terms on the overview page.

The Microsoft security overview says Copilot honours your existing security and data protection controls and works within current permissions. It also says overshared or poorly governed content can affect Copilot results and increase risk. In plain words, Copilot does not create new access. It makes existing access easy to use.

Take a family-owned retailer as an illustration. A finance folder shared with "everyone in the organisation" years ago was never found because nobody searched for it. A Copilot question about salary bands could now surface it. The fix is a permissions clean-up.

Step 1: How do you check readiness?

Start with a short checklist. Microsoft's setup guide lists the readiness activities below, and we suggest adding an owner for each item.

• Test environment: a place to try configuration and scenarios with the right licences.
• Identity: multifactor authentication for all users and reviewed Conditional Access policies.
• Audit: unified audit logging turned on in the Microsoft Purview portal, with a retention period you have chosen.
• Apps: Microsoft lists which Microsoft 365 Apps update channels support Copilot. Check your channel against that list before the pilot.
• Network: Microsoft lists endpoints that proxies and firewalls must allow, including ‎*.cloud.microsoft.
• Accounts: Microsoft states that assigning Copilot licences to guests or cross-tenant users is not supported, so list who is really in scope.
• Communication plan: what users hear, when, and where they ask for help.
• Roles: decide who administers Copilot. Microsoft offers an AI Administrator role that avoids giving Global Administrator rights.

Step 2: How do you clean up permissions before licences go out?

Do this before the pilot. Microsoft's guidance for SharePoint Advanced Management sets out the sequence. It also notes that SharePoint sharing defaults to the most permissive option, which is a good reason to review them.

The setup guide also suggests turning off "everyone except external users" at tenant level and starting an access review for overshared sites. Microsoft's Content Management Assessment hub runs a suite of reports and recommends re-running it every 30 days to track progress. Some of these features may need licences beyond Copilot, so confirm licensing with Microsoft or your licensing provider.

Sensitive files need labels as well. Microsoft's setup guide points to sensitivity labels in Microsoft Purview to classify and protect them. Treat this as a decision for your data owners, not only for IT.

Step 3: How do you run a Copilot pilot?

Microsoft describes three phases: pilot, deploy and operate. In the pilot, you assign licences to a small group and gather feedback. Microsoft suggests choosing early adopters across business groups, ideally people who already use Microsoft 365 features heavily, and using the Microsoft 365 apps usage report to find them.

We would add three rules of our own.

1. Name the roles and workflows. For example, a finance analyst summarising month-end email threads, or a project coordinator drafting meeting actions in Teams. "Everyone tries it" gives you nothing to compare.
2. Set the questions before day one. Which task, how long it takes today, who reviews the output, and what counts as a good result.
3. Plan reviews. Reviews at days 3, 7, 14 and 30, the rhythm our ENABLE Sprint uses, help keep the pilot tied to clear results. Licences go to the next group only after the review.

Pilot users also become your first champions. Microsoft's setup guide says early adopters can explain to peers where Copilot is most valuable and give IT a scalable way to answer questions.

Step 4: How do you measure Copilot use?

Use Microsoft's own reports and read their definitions. The Copilot usage report in the Microsoft 365 admin center shows three headline numbers over 7, 28, 90 or 180 days.

• Enabled users: unique users with Copilot licences.
• Active users: enabled users who tried a user-initiated Copilot feature in one or more apps.
• Active users rate: active users divided by enabled users.

Three limits matter. First, opening the Copilot pane does not count as active use. Submitting a prompt does. Second, Microsoft says activity data for a given day typically becomes available within 48 hours. Third, user names are hidden by default in usage reports, so decide with your privacy lead whether to show them.

Microsoft also warns that audit log data is built for security and compliance and should not be the basis for usage metrics. For readiness, adoption, impact and sentiment, the setup guide points to the Microsoft Copilot Dashboard in Viva Insights alongside the admin center reports.

A licence count is not a result. Pair the report with a short monthly question to pilot users: which task did Copilot help with, and what did you change before using the output? Where the active users rate stays low, ask why before you buy more licences. The cause may be training, access or a task that does not suit Copilot.

What does the whole rollout sequence look like?

1. Name an owner and a decision-maker, and check the readiness list.
2. Run the oversharing reports and fix or restrict the highest-risk sites.
3. Choose pilot roles and workflows, write the questions, and assign a small group of licences.
4. Review at days 3, 7, 14 and 30 with usage data and user comments.
5. Decide for each group: expand, change, or pause.
6. Deploy by department, keep running the reports, and re-run the assessment every 30 days.

How to start

If you are planning a rollout, the Enablement Lab can help. Our Claude and AI Platform Deployment service (ET1) covers Copilot deployment alongside other platforms, and the ENABLE Sprint (EB1) runs one team through real workflows with reviews. If licences are already bought and barely used, see our page on unused licences and the 30-Day Adoption Rescue (EB2). If you are not sure what is already exposed, the free AI Exposure Scan is a free 45-minute conversation that ends in a written next step.

Related lab: Enablement Lab ↗