Before you scale Microsoft 365 Copilot, inspect the data it will use
Before scaling Microsoft 365 Copilot, organisations need to understand the information it will rely on. Storm explores why trusted data, clear ownership, appropriate permissions and defined use cases are essential to turning Copilot adoption into measurable business value.
)
Microsoft 365 Copilot works with information employees can already access. It does not resolve duplicate records, outdated documents or excessive permissions.
Ask Copilot to summarise a customer account. Depending on the employee’s access, it might draw on recent emails, a CRM export, an old proposal in SharePoint and several versions of the same account plan.
Copilot did not create those inconsistencies, just highlights then because they are easier to encounter in the way Copilot works.
Copilot operates within the permissions of the signed-in user and therefore can only access emails, chats and documents that the user is authorised to see, but it does not correct excessive permissions or decide which version of a document is the right one to use. Microsoft identifies overshared and poorly governed content as a specific source of risk for Copilot deployments. Microsoft explains the permissions model in its Copilot architecture and security guidance.
This makes Copilot readiness an information-management problem as much as a technology project.
Start with a use case, not a licence count
A readiness review should begin with a task that employees want Copilot to improve.
For example, a finance team might want help explaining forecast variance. Customer service agents might need faster access to case histories and approved knowledge articles. A leadership team might want a reliable summary of operational performance.
Each use case depends on different information and carries different risks. Before choosing the technology or expanding the rollout, identify:
The task Copilot will support
The information required to complete it
The authoritative source for that information
The employees who should have access
The person accountable for its accuracy
The control or human review required before the output is used
The result that will demonstrate whether the use case is worthwhile
This prevents organisations from starting with a broadly defined AI ambition and leaving employees to discover the useful applications themselves.
An AWS-sponsored study reported by MIT Sloan surveyed 334 respondents in CDO or equivalent roles. Forty-six per cent identified data quality and finding the right use cases as the two largest obstacles to realising value from generative AI. The same research found that many organisations had not yet adapted their data strategies for generative AI.
Define data quality for the job
Organisations do not need to correct every data problem before piloting Copilot. They do need to know what “good enough” means for each selected use case.
The UK Government Data Quality Framework assesses data through six dimensions: accuracy, completeness, uniqueness, consistency, timeliness and validity. The importance of each dimension depends on how the data will be used.
For a finance variance analysis, current actuals and consistent account definitions may matter most. A customer service use case depends on complete case histories and current, approved guidance. An executive report requires stable definitions so that the same metric does not mean different things across departments.
The practical questions are:
Are important records missing?
Do several systems contain conflicting versions of the same information?
How quickly does the information become outdated?
Can users distinguish an approved document from a working draft?
Who corrects an error when one is found?
Is the source appropriate for the decision Copilot is being asked to support?
Without these answers, an apparently fluent response can still be based on incomplete or obsolete information.
Review permissions before expanding Copilot
Copilot respects existing Microsoft 365 access controls.
A document shared too broadly several years ago may still be available to employees who no longer need it. Old Teams workspaces can contain duplicated files. SharePoint sites may have inherited permissions that nobody currently owns. Sensitive documents may lack the classification or retention controls expected by the organisation.
A Copilot readiness review should examine:
SharePoint and Teams sites containing sensitive or business-critical information
Broad access groups and inherited permissions
Content shared beyond its intended audience
Sites and document libraries without active owners
Duplicate, obsolete or unclassified documents
Retention, deletion and review arrangements
The goal is to make deliberate access decisions and remove permissions that nobody still needs.
Governance must assign decisions
A policy document alone will not govern an AI deployment. Governance needs to identify who makes decisions and what happens when information, permissions or outputs are wrong.
The NIST AI Risk Management Framework treats governance as work that continues throughout the life of an AI system. It connects technical controls with organisational policies, accountability and risk tolerance.
For a Microsoft 365 Copilot rollout, that should translate into named responsibilities:
Business owners approve use cases and define acceptable outcomes.
Content owners identify authoritative sources and remove obsolete material.
Microsoft 365 administrators manage access controls and investigate oversharing.
Security, compliance and legal teams set requirements for sensitive information, retention and acceptable use.
Employees understand when Copilot output requires verification or human approval.
Programme owners monitor adoption, recurring failures and measurable value.
If nobody owns one of these decisions, the AI readiness assessment should record the gap rather than marking governance as complete.
Choose the remediation before choosing the platform
Not every Copilot readiness problem will require a new data platform. If the problem is an unmanaged SharePoint estate, the answer may be clearer ownership, corrected permissions and an archive process. If business reporting depends on manually combining several systems and spreadsheets, the organisation may need data integration, common definitions and stronger quality controls.
A modern data platform or Microsoft Fabric may be appropriate when a use case depends on governed information from several operational systems. The use case should justify that investment. “AI readiness” by itself is not a sufficient specification.
What a useful readiness assessment should produce
A readiness assessment should end with decisions and accountable actions, not a general maturity score.
Area | Evidence required | Readiness outcome |
Use case(s) | Defined task, users, source information and success measure | Sponsor approves the intended outcome |
Information | Named authoritative sources, owners and quality rules | Owner confirms the information is fit for the use case |
Permissions | Review of relevant sites, groups and shared content | High-risk access issues are corrected |
Controls | Classification, retention, acceptable-use and human-review requirements | Security and compliance owners approve the pilot |
Adoption | Pilot users, training, support and feedback process | Employees know how to use and verify Copilot |
Measurement | Baseline and agreed operational measures | The organisation can decide whether to expand, change or stop the use case |
The resulting plan should identify which issues must be resolved before a pilot, which can be monitored during it and who owns each action.
Pilot with evidence, then decide whether to scale
Begin with a small number of use cases whose data, owners and expected outcomes are understood. During the pilot, record where Copilot relies on outdated information, where users have to correct its output and whether the task becomes faster or more reliable.
Use that evidence to decide whether to expand the rollout, narrow the use case or pause while information problems are addressed.
Before purchasing more licences, ask each use-case sponsor to name the information Copilot will depend on, the person who owns it and the measure that will demonstrate value. If those answers are missing, the next investment should be in readiness work rather than additional licences.
Storm’s Microsoft 365 Copilot, SharePoint and Data & AI Advisory teams help organisations assess their Microsoft 365 environment, select viable use cases and turn identified data or governance gaps into an accountable delivery plan.
)
)
)