What a pasted prompt can expose
A fictional bank tests the data boundary before access widens.
Coming
See every demonstrationFREE CHECK
Copilot readiness
Test the content and identity controls that shape what Copilot can return.
01 Source02 Boundary03 Human decision04 Evidence
WHAT TO REVIEW
Four questions for the team that owns the decision.
- Have you reviewed overshared Microsoft 365 content?
- Are sensitivity labels and retention rules in place?
- Is a pilot group defined with measurable tasks?
- Can users report a risky or incorrect answer?
Take the PDF with you.
Enter a work email, company and role to request the PDF. This action records an SIT inquiry for follow-up. Marketing emails require a separate choice.
Download the PDF directlyTHE CHECK
What does the Copilot readiness check test?
Whether overshared Microsoft 365 content has been reviewed, whether sensitivity labels and retention rules are in place, whether a pilot group with measurable tasks is defined, and whether users can report a risky or incorrect answer.
Four questions on the content and identity controls that shape what Microsoft 365 Copilot can return, with a PDF you can download directly and no email required.
THE MICROSOFT INSIGHT
What will Copilot return on day one?
Only content the signed-in user already has at least view permission to see, which means anything shared too widely is findable from day one.
Microsoft 365 Copilot returns only content the signed-in user already has at least view permission to see, so anything shared too widely is findable from day one. (Microsoft Learn, checked Oct 31, 2026)
Review the sharing before the pilot and the first finding is in your report. Review it after and the first finding is in a Copilot answer.
THE METHOD
How does the check become a pilot plan?
Each answer becomes a control, each control is marked tested or assumed, and the pilot group is scoped around the controls that are tested.
- Oversharing: the sites the pilot group reaches have been reviewed, or are kept out of discovery while they are.
- Labels: sensitivity labels and retention rules exist on the content that matters.
- Pilot: a group with measurable tasks and a named owner.
- Reporting: a user can flag a risky or wrong answer and someone owns the flag.
THE HOLD
Can a pilot start before the file cleanup is finished?
Yes, when the pilot group's access is tested and the sites still under review are kept out of organization-wide discovery with Restricted Content Discovery.
Restricted Content Discovery in SharePoint keeps a chosen site out of organization-wide search and Microsoft 365 Copilot answers while its permissions are reviewed, without changing who can open the files; Restricted SharePoint Search is retiring and new enablement has been blocked since July 31, 2026. (Microsoft Learn, checked Nov 1, 2026)
Scope the pilot and hold the unreviewed sites, and the rollout starts this quarter. Wait for the whole cleanup, and the CEO hears no.
THE NEXT RUNG
What comes after the check?
The read-only Copilot readiness and governance assessment, which tests the four controls inside your tenant and produces the Tested or Assumed record for the compliance officer, the CFO and the CEO.
Scoped separately from the pilot and the cleanup, quoted after a scoping call, Microsoft-funded where you qualify.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold the PDF and the four controls are marked tested or assumed.
- The pilot group is named with its measurable tasks.
- The sites that need review before discovery are listed.
- You have booked, or decided not to book, the read-only assessment.
HONEST ABOUT LIMITS
What this does not do yet
It does not stop a person typing a client's name into a prompt. Blocking a Copilot or Cowork response when the typed prompt contains chosen sensitive information types is in preview and rolling out to tenants. (Microsoft Learn, checked Oct 31, 2026, preview) The question about labels covers the controls that are generally available today.
It does not tell you what Copilot would return to a specific person: that takes the assessment inside your tenant.
It does not create a lead unless you ask for the PDF by email and say so.
THE ONE THING TO REMEMBER
Copilot shows people what they already have permission to see, so test the permissions before you widen the access.
Said another way: the pilot can start before the cleanup finishes when the pilot group's access is tested first.
Said a third way: yes to the CEO, in a tested order.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
How long does the check take?
A few minutes with the people who own the decision. The PDF downloads directly, no email required.
What is an overshared site?
A SharePoint site or folder that more people can open than should, often through Anyone or organization-wide links created years ago. Copilot makes its contents findable to everyone who can already open it.
Can we hold some sites back during the pilot?
Yes. Restricted Content Discovery keeps a chosen site out of organization-wide search and Copilot answers while its permissions are reviewed, without changing who can open the files.
What comes after the check?
The read-only Copilot readiness and governance assessment, then a scoped pilot that can start before the cleanup finishes.
How is the assessment priced?
Quoted after a scoping call, scoped separately from the pilot and the cleanup. Microsoft-funded where you qualify.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.