---
name: Copilot Readiness Assessment
description: Scores a Microsoft 365 tenant for Copilot readiness across licensing, sensitivity labelling, oversharing, Conditional Access and audit retention.
lastReviewed: 2026-09-30
---

# Copilot Readiness Assessment

> **TL;DR:** This skill produces a read-only maturity scorecard that tells you whether a Microsoft 365 tenant is ready to safely activate Microsoft 365 Copilot or Microsoft Agent 365, and what to remediate first.

## What does the Copilot readiness assessment check?

The Copilot readiness assessment is a read-only review that scores a Microsoft 365 tenant on five areas before Microsoft 365 Copilot or Microsoft Agent 365 is activated: licensing, Microsoft Purview sensitivity labelling, SharePoint oversharing, Microsoft Entra Conditional Access, and audit retention. It returns a Ready, Conditional or Defer position. The scoring rubric is EDUC4TE's own, not an external standard.

The five areas combine features Microsoft's licence comparison lists as affecting Copilot results (Purview labelling and audit, Entra Conditional Access) with SharePoint sharing guidance. Copilot respects existing permissions, so anything a user can already reach is something Copilot can surface for that user. The result is a defensible position grounded in your current cloud configuration rather than an assumption that the tenant is safe.

## When should you run this skill?

Run the Copilot readiness assessment before any Microsoft 365 Copilot or Microsoft Agent 365 rollout, so oversharing, labelling gaps and weak identity controls are found while they are still cheap to fix, and run it again after remediation to confirm the scorecard has moved from Defer or Conditional towards Ready. Typical prompts:

- "Assess M365 Copilot readiness"
- "Is this tenant Copilot-ready?"
- "Score our tenant against the EDUC4TE Copilot readiness rubric"
- "Pre-rollout review for Microsoft Agent 365"

## Policy defaults and baselines

These targets are EDUC4TE's scoring rubric. Where a row names Microsoft behaviour, the supporting page is listed in Sources. The numeric targets (70 per cent labelling coverage, 365 days retention) are EDUC4TE's chosen thresholds, not Microsoft requirements.

| Control area | Baseline target | Basis |
|---|---|---|
| Licensing | Microsoft 365 E3 or E5 with the Microsoft 365 Copilot add-on, or Microsoft 365 E7 | Microsoft Learn licensing pages |
| Sensitivity labelling | 70%+ coverage on sites holding sensitive content | EDUC4TE threshold |
| SharePoint sharing | No broad "Anyone" links on sensitive sites | Microsoft Learn SharePoint Advanced Management guidance |
| Conditional Access | MFA for all users; a compliant or Microsoft Entra hybrid joined device as an alternative to MFA | Microsoft Learn Conditional Access templates |
| Audit retention | Auditing enabled; 365 days as the EDUC4TE target | EDUC4TE threshold; Microsoft defaults are in Sources |

## How this skill works, step by step

1. Confirm the licensing baseline: Microsoft 365 E3 or E5 with the Copilot add-on, or Microsoft 365 E7.
2. Measure sensitivity labelling coverage across SharePoint and OneDrive (EDUC4TE target: 70%+ on sites holding sensitive content).
3. Run a SharePoint oversharing baseline: "Anyone" links, "Everyone except external users" exposure and broken permission inheritance.
4. Confirm Conditional Access posture: MFA for all users, or a compliant or Microsoft Entra hybrid joined device as an alternative.
5. Confirm auditing is enabled and compare retention with the 365-day EDUC4TE target.
6. Score each control area: Met / Partial / Not Met.
7. Calculate overall maturity: Ready / Conditional / Defer.
8. Produce the scorecard and remediation action list.

## Output format

| Control area | Description | Status | Evidence | Remediation |
|---|---|---|---|---|

Followed by:

- Overall maturity: Ready / Conditional / Defer
- Top three remediation actions with owner and target date
- Estimated weeks to readiness

## Scope and safety

Read-only by default; the skill never changes tenant configuration. This skill does NOT:

- Activate Copilot or assign licences.
- Modify tenant configuration (read-only).
- Replace a formal compliance or security audit.

## Licensing and permissions

### Licences and add-ons

| Capability used | Licence position on Microsoft Learn |
| --- | --- |
| Microsoft 365 Copilot activation being assessed | Add-on for Microsoft 365 E3 and E5; included in Microsoft 365 E7 |
| Microsoft Agent 365 activation being assessed | Stand-alone per-user subscription, or included in Microsoft 365 E7; Microsoft says it works best with Microsoft E5 as a prerequisite |
| Microsoft Purview sensitivity labelling coverage check | Microsoft 365 E3 supports manually applied labels; E5 adds automatic labelling and container labels |
| Microsoft Entra Conditional Access posture check | Microsoft Entra ID P1 (included in Microsoft 365 E3) |

### Least-privilege roles

- Global Reader: reads settings and administrative information across Microsoft 365 services without taking management actions. Microsoft lists limits, for example the OneDrive admin center does not support it.
- Reports Reader: reads sign-in logs, audit logs and usage reports, with no admin permissions.

Microsoft Graph permission scopes are not listed here. Microsoft does not document, on the pages cited below, a permission set for this specific assessment, so choose the least-privileged read scopes for each API you call from that API's own permissions reference.

## Frequently asked questions

### Is my Microsoft 365 tenant ready for Copilot?

A tenant is ready when Copilot can only surface content each user should already see. Copilot retrieves data through Microsoft Graph and respects existing permissions and sharing settings, so readiness depends on cleaning up oversharing, labelling sensitive content, and enforcing identity controls before licences are assigned.

### What licences do I need for Microsoft 365 Copilot and Microsoft Agent 365?

Microsoft 365 Copilot is an add-on for Microsoft 365 E3 and E5, and is included in Microsoft 365 E7. Microsoft Agent 365 is sold as a per-user subscription and is also included in E7. At least one user must hold a qualifying Agent 365 licence to enable it.

### How long does Microsoft 365 keep audit logs by default?

Audit (Standard) retains records for 180 days. For users with an E5 licence, Audit (Premium) keeps Microsoft Entra, Exchange, OneDrive and SharePoint audit records for one year by default, and other activities for 180 days. Retention up to 10 years needs an additional add-on licence.

### Does this assessment change anything in my tenant?

No. The assessment is read-only. It reads licensing, sharing, labelling, Conditional Access and audit settings, then produces a scorecard and remediation list. Any fix, such as tightening sharing settings or creating a policy, is a separate change that your administrators make and approve.

## Related skills

- [Microsoft 365 Copilot Readiness Guide for SharePoint and Data](/sharepoint/copilot-readiness-guide): Read alongside, for the oversharing-first approach to Copilot readiness.
- [SharePoint Oversharing Audit](/sharepoint/sharepoint-oversharing-audit): Run after, to review sharing links and site permissions across SharePoint Online.
- [Purview Label Coverage](/purview/purview-label-coverage): Run after, to see how much SharePoint content carries a Purview sensitivity label.
- [Copilot Control System Governance Validator](/cowork/copilot-control-system-governance-validator): Run after, to validate Copilot Control System settings once the tenant is ready.
- [Australian Compliance for Microsoft 365 Copilot and AI](/purview/australian-copilot-compliance): Read after, for Australian compliance context for Microsoft 365 Copilot.

## Sources

Reviewed 2026-09-30: removed the unsourced "AT.10xxx control family", the "Essential Eight Control 6" and E8 ML2 claims, the "GA" alignment statements and the Microsoft Graph permission list; restated thresholds as EDUC4TE's own rubric; corrected licensing, role and audit retention statements to match Microsoft Learn; added FAQs.

- [Microsoft Copilot overview](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-overview): Copilot licence tiers, Microsoft Graph grounding and permission scoping, SharePoint Advanced Management and Microsoft Purview for Copilot.
- [Prepare for Microsoft Copilot by comparing E3, E5, and E7 license features](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-license-feature-overview): Copilot add-on on E3 and E5, E7 inclusions, labelling, Entra ID plan and Audit differences by licence.
- [License options for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-licensing): qualifying subscription plans.
- [Overview of Microsoft Agent 365](https://learn.microsoft.com/en-us/microsoft-agent-365/overview): availability from 1 May 2026 (Commercial, per user) and prerequisites.
- [Microsoft Agent 365 service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-agent-365/microsoft-agent-365): stand-alone subscription, and inclusion in Microsoft 365 E7.
- [Get ready for Microsoft Copilot and agents with SharePoint Advanced Management](https://learn.microsoft.com/en-us/sharepoint/get-ready-copilot-sharepoint-advanced-management): oversharing, "Anyone" links, data access governance reports.
- [Require multifactor authentication for all users](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-mfa-strength) and [Conditional Access policy templates](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policy-common): baseline MFA policy and compliant-device templates.
- [Features and licenses for Microsoft Entra multifactor authentication](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-licensing): Conditional Access needs Microsoft Entra ID P1 or P2; Microsoft 365 E3 includes P1.
- [Manage audit log retention policies](https://learn.microsoft.com/en-us/purview/audit-log-retention-policies) and [Turn auditing on or off](https://learn.microsoft.com/en-us/purview/audit-log-enable-disable): default retention periods and auditing status.
- [Microsoft Entra built-in roles](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference): Global Reader and Reports Reader.
- [Learn about Data Security Posture Management for AI (classic)](https://learn.microsoft.com/en-us/purview/dspm-for-ai): oversharing data risk assessments. Microsoft states this classic version has been replaced by a newer Data Security Posture Management experience; pair a remediation plan with whichever is available in your tenant when the oversharing baseline fails.

Output in Australian English.