Microsoft 365 Copilot readiness: a guide for SA councils and small organisations

Microsoft 365 Copilot is now on the roadmap of many South Australian councils, not-for-profits and small businesses. It drafts emails, summarises meetings and long documents, and answers questions using the organisation’s own files. The part that is easy to miss is how it finds those files. Copilot works over the email, chats, meetings and documents each person can already open. It does not create new access, but it makes existing access very easy to use. If a SharePoint site holding staff investigations was shared with everyone in the organisation years ago, a curious question to Copilot may surface it. That is why Copilot readiness is mostly a permissions and information management exercise, not an AI project. This guide covers how Copilot uses your data, where the real risks are, a readiness checklist, and how to run a pilot that tells you whether it is worth the licences. It is general guidance, not legal advice.

How Copilot uses your organisation’s data

When someone asks Copilot a question in Word, Outlook, Teams or the Copilot app, it searches the content that person is permitted to see through Microsoft Graph, such as their mailbox, OneDrive, the SharePoint sites and Teams they belong to, and meeting transcripts they can access. It then uses that content to ground its answer. A few points matter for governance:

• Permissions are the control. Copilot respects the same permissions as search and file access. If the permissions are wrong, Copilot will faithfully use the wrong permissions.
• Sensitivity labels carry through. Content protected with Microsoft Purview sensitivity labels and encryption is only used for people who hold the rights to open it, and labels can flow through to content Copilot helps create.
• Data handling commitments. Microsoft states that prompts, responses and organisational data accessed through Microsoft Graph are not used to train its foundation models. Australian data location is available for core Microsoft 365 data, but confirm the current residency commitments for each feature you enable, including web grounding, agents and third-party connectors, because some of these can send queries outside the Microsoft 365 service boundary.
• Different products, different reach. Microsoft offers a free Copilot Chat experience for business users alongside the paid Microsoft 365 Copilot licence that grounds answers in your work content. Packaging and pricing change often, so check what each plan currently includes before you budget.

The real risk is oversharing

Most organisations that review their Microsoft 365 tenant find content shared far more widely than anyone intended. The usual causes are predictable:

• Sites and Teams shared with “Everyone except external users” or an all-staff group, often as a quick fix years ago.
• “Anyone with the link” and “People in your organisation” sharing links that were never meant to be permanent.
• Public Teams created for a project, then left open after it finished.
• Old project sites, migrated file shares and departed staff members’ OneDrive content with no current owner.
• Guest accounts for contractors and partners that were never removed.

None of this is caused by Copilot, and all of it was already a risk. Copilot simply changes the effort needed to find it from “knowing where to look” to “asking a question”.

A readiness checklist

1. Get the identity basics right. MFA for every account, legacy authentication blocked, separate admin accounts and Conditional Access requiring a compliant or managed device (see our Zero Trust and Conditional Access guide). These are the same steps that support the Essential Eight and they protect you whether or not you adopt Copilot.
2. Give every site and Team an owner. Inventory SharePoint sites and Teams, assign a named owner to each, and archive or delete those that are inactive. Stale content produces stale answers.
3. Find and fix oversharing. Use sharing and data access governance reports, such as those in SharePoint Advanced Management, to find sites shared with everyone, heavy use of organisation-wide links and sites with no owner. Fix the highest-risk sites first: HR, finance, legal, procurement, executive and anything with personal or health information.
4. Use a stopgap for sensitive sites. While the clean-up runs, Microsoft provides options to restrict which sites can be discovered through organisation-wide search and Copilot. Use them for known sensitive sites so a rollout does not wait for a perfect tenant, then remove the restriction once permissions are fixed.
5. Classify what matters. Create a small set of sensitivity labels, four at most, aligned to the classification scheme you already use. SA public sector organisations should align labels to the classification requirements that apply to them under the SA ISMF. Apply default labels to sensitive sites rather than relying on staff to remember.
6. Add data loss prevention. DLP policies for the sensitive information you actually hold, such as tax file numbers, bank details, health information or Medicare numbers, stop it leaving through email or sharing, and recent Purview capabilities extend some of these protections to Copilot interactions.
7. Decide how AI interactions are kept. Prompts and responses can document decisions. For councils and agencies, records obligations under the State Records Act 1997 and freedom of information requests under the Freedom of Information Act 1991 may reach them. Agree retention settings with your records manager before the pilot, not after.
8. Write a short acceptable use policy. Staff remain responsible for what they send and publish, outputs must be checked before use, and Copilot is not used for decisions about people without human review. Our responsible AI adoption checklist covers the wider governance.

The secure Microsoft 365 workplace reference architecture in our Learn section shows how these controls fit together, with the design decisions, failure modes and a phased plan.

Run a pilot that measures something

Buying Copilot for every user on day one is the most common and most expensive mistake. A short, structured pilot gives you evidence instead.

• Pick a cross-section. Fifteen to thirty people across roles such as customer service, finance, project delivery, executive support and field supervisors. Include sceptics as well as enthusiasts.
• Baseline first. Before licences are assigned, record how long a handful of common tasks take: drafting a report, preparing meeting minutes, answering a policy question, summarising correspondence.
• Run for six to eight weeks with short training at the start and a channel for people to report surprising or overshared results. Every report of a document surfacing to the wrong person is a permissions fix, and worth celebrating.
• Measure and decide. Compare the baseline tasks, survey participants, review usage reports and estimate the value per role against the licence cost. License the roles where the evidence is clear.

Public sector teams designing a pilot may find the Digital Transformation Agency’s published evaluation of the Australian Government’s whole-of-government Copilot trial a useful reference for how a trial can be structured and assessed.

What differs for councils, agencies and small businesses

• Councils hold rates, planning, customer request and sometimes community service records in Microsoft 365 alongside corporate files. Records and freedom of information obligations make retention decisions for AI interactions especially important, and elected member access should be considered separately from staff access.
• SA Government agencies should work within the SA ISMF, their information classification requirements and any current whole-of-government guidance on generative AI, and confirm residency for every feature enabled.
• Small businesses and not-for-profits often have the simplest path. Microsoft 365 Business Premium includes many of the controls described here, such as Conditional Access, Intune device management and sensitivity labels, for organisations within its user limit. The work is usually one to two weeks of identity and sharing clean-up rather than months.

Questions to ask before you engage anyone

1. Will you review our permissions and sharing before recommending Copilot licences?
2. Which reports will you use to find oversharing, and will we keep access to them afterwards?
3. How will sensitivity labels map to the classification scheme we already use?
4. Where will our data, prompts and responses be stored and processed, including for any agents or connectors?
5. How will we measure whether the pilot worked, and what would make you recommend not proceeding?
6. What will it cost per year in licences, backup and support after the pilot?

This article reflects common practice as at late 2026. Microsoft 365 features, licensing and data handling commitments change frequently, so confirm current details with Microsoft documentation and your advisers before committing.

Talk to an Adelaide team

If you are weighing up Copilot, talk to us about a Copilot readiness review or call 0402 401 584. We can start with a short, fixed-price review of identity, sharing and classification that produces a prioritised fix list and a pilot plan you can use with any supplier. You can also read about our AI consulting, managed IT and cyber security and AI agents and chatbots services.