Copilot respects the permissions your people already have. It does not add new ones. That is the whole risk in one sentence: a decade of quick shares, open Teams files and forgotten folders becomes searchable in plain language on day one. These are the seven checks REDD runs on a tenant before licences go on.
The checklist
Run these first and Copilot becomes a productivity tool instead of a discovery tool.
Run the oversharing report before anything else. "Everyone except external users" on a finance folder is the most common finding, and Copilot will surface it in the first week.
Labels exist in most tenants and are applied in few. Copilot uses them to decide what it will and will not quote, so unlabelled confidential material is treated as ordinary.
Former contractors, ex-clients, the accountant from three years ago. Every guest with access to a site is a person Copilot will answer questions for inside that site.
An AI assistant makes a compromised account far more productive for the attacker. Copilot readiness starts with identity, not with licences.
Copilot searches what still exists. If nothing has been retired since 2018, everything since 2018 is in scope. Retention is the fastest way to shrink the surface.
Not everyone does. Start with the people whose work is reading, drafting and summarising, measure the return, and expand from there.
One page: approved tools, what must never be pasted in, who to ask. A rule people have read beats a policy nobody opens, and it is the first thing a client or auditor will ask for.
Why it matters now
Copilot answers from whatever the signed-in person can already open. Most tenants have years of oversharing nobody noticed because nobody searched in plain language.
The first surprise is usually an HR or finance folder shared to the whole company in 2019. Copilot finds it on day one.
The permission clean up is cheap and quick compared to explaining to a client what an assistant surfaced.
What REDD does with the answers
A review of your Microsoft 365 tenant: permissions, oversharing, labelling, identity and governance. A findings report and a remediation plan.
Twenty minutes with a REDD engineer on which AI tools your people use today and what those tools can reach.
The rollout itself, run by an ISO 27001 certified team: the right tools, the right people, the guardrails written down.
Common questions
Yes. Download the PDF here with no form, or ask for a readiness assessment and a REDD engineer will run the checks on your tenant with you.
No. The assessment is more useful before licences, because it tells you what to fix and who to licence first.
Most tenants are assessed within two weeks, with a findings report and a remediation plan. The permission clean up that follows depends on how much oversharing there is.
Checks 6 and 7 do. The permission and labelling checks are specific to Microsoft 365, which is where Copilot reads from.
A REDD engineer will run the readiness checks on your Microsoft 365 tenant and show you exactly what an assistant could reach right now, what to fix first, and what it costs. No obligation.
Get in touch
Send the basics and a REDD engineer will come back to you within one business day. Prefer to talk? Call 1300 697 333.