Download PDF (772 KB)
PDF version, ready to print or share with your team.
Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Trusted for Microsoft 365 governance by accounting firms in Markham, law offices in Toronto, manufacturers in Vaughan, and non-profits across the GTA and Metro Vancouver.
Microsoft Solutions Partner (Modern Work, Security, Infrastructure) • CISSP-led since 2012 • 4.9★ Google reviews • Canada’s 50 Best Managed IT · 2024
A Microsoft 365 Copilot rollout runs in five stages: a readiness check, tenant remediation, a scoped pilot, a go/no-go decision, and measured scale-out. For a 10 to 150 seat Canadian firm the working rhythm is roughly 90 days: two weeks auditing licensing fit, identity, and SharePoint sharing, four to six weeks closing what the audit finds, then a 5 to 15 user pilot and a scale decision at rollout day 90.
The order matters more than the calendar. Copilot searches everything each user can already open across SharePoint, OneDrive, Exchange, and Teams, and it synthesizes answers from all of it. License a tenant that’s carrying ten years of accumulated over-sharing and the pilot’s first week becomes a data-exposure review. Microsoft’s own deployment guidance is built around doing the cleanup first.
Key takeaways
- The five stages are gated, not strictly serial: no pilot until the cohort’s reachable data is cleaned or restricted. Skip the sharing cleanup and the permission debt moves into the pilot.
- Microsoft’s technical baseline (Entra ID accounts, Exchange Online mailboxes, Microsoft 365 Apps) takes an afternoon to verify. SharePoint sharing hygiene takes the weeks.
- A pilot that supports a real decision has 5 to 15 users from two functions, three named use cases per user, and three scheduled reviews across the 90 days, ending in the scale decision.
- 19.2% of Canadian businesses used AI to produce goods or deliver services in Q2 2026; in finance and insurance the rate is 40.4% (Statistics Canada).
What does a Microsoft 365 Copilot rollout involve?
According to Microsoft’s Microsoft 365 Copilot adoption guide (2026), a Copilot deployment moves through planning, implementation, adoption, and ongoing management, with a pilot group ahead of any organization-wide license assignment. Fusion Computing structures that sequence for 10 to 150 seat Canadian firms as five stages across roughly 90 days, with a decision gate before licenses go wide.
| Stage | Weeks | What happens | Who owns it |
|---|---|---|---|
| 1. Readiness check | 1 to 2 | Audit licensing fit, identity controls, SharePoint sharing, Purview labels, data policy, pilot scope | IT lead + executive sponsor |
| 2. Remediation | 3 to 8 | Close the gaps the audit found, in priority order | IT lead or your managed service provider |
| 3. Pilot | 9 to 12 | 5 to 15 users, two functions, three named use cases each, weekly check-ins | Pilot owner |
| 4. Rollout reviews | Day 30 / 60 / 90 | Day 30 checks remediation, day 60 gates pilot entry, day 90 is the scale decision | Executive sponsor |
| 5. Scale + measure | 13 onward | License waves by team, usage reporting, quarterly readiness re-check | IT lead + finance |
The 90 days is a working rhythm, not a promise. A tenant with clean sharing and Purview labels can compress the middle stage to 2 weeks; a tenant with 10 years of drift shouldn’t.
Stage 1: The readiness checklist (weeks 1 and 2)
Microsoft’s current app and network requirements for Microsoft 365 Copilot set the technical floor: Microsoft Entra ID accounts, primary mailboxes on Exchange Online, Microsoft 365 Apps deployed, and WebSocket connectivity to the cloud.microsoft domain. The Copilot readiness report in the admin center flags license eligibility per user.
That floor takes an afternoon to verify. The readiness question that actually decides the rollout is different, and it doesn’t appear on Microsoft’s list: what can each of those users already open? Fusion Computing audits six control families before licenses go wide; the live-tenant assessment itself runs on a single Copilot license, which activates the SharePoint Advanced Management tooling the audit uses. The same six areas structure the remediation stage that follows.
Want the six-family readiness audit run against your live tenant? Book a 30-minute scoping call →
| Control family | What it checks | Fastest signal to check |
|---|---|---|
| SharePoint sharing hygiene | Org-wide links, stale external shares, default link type, open groups | The org-wide sharing report |
| Purview sensitivity labels | A minimum three-label taxonomy with a named executive owner | Label coverage on the most sensitive sites |
| Data-classification policy | A one-page written policy covering sanctioned AI use | Whether a written policy exists at all |
| Identity and Conditional Access | Multi-factor authentication strength, legacy sign-in protocols disabled, unmanaged device rules | Legacy sign-in protocols still enabled |
| Licensing fit | Base plans, app builds, budget sign-off | The admin center readiness report |
| Pilot scope | Named cohort, use cases, baseline measurements | Whether the reviews have calendar dates |
You don’t need a consultant to start. The free Copilot readiness scan runs the first-pass automated check on your tenant’s public surface, and the AI assessment is the done-with-you version against live tenant data. Want a CISSP-led read on your six families before you budget the rollout? Book a consultation →
Stage 2: Fix what the audit found, before you license (weeks 3 to 8)
The Office of the Privacy Commissioner’s principles for generative AI (2023) expect organizations to limit access to personal information to what is necessary, and PIPEDA’s safeguard principle applies that same reasonable-measures floor to everything Copilot can reach. A stale org-wide link can put personal information in front of people with no need to see it, which is exactly the exposure the safeguard principle asks you to manage before Copilot is switched on.
The remediation order Fusion Computing runs, highest exposure first:
- Pull the report of every org-wide and anyone-with-the-link share older than 12 months, then revoke or re-scope. Change the tenant default link type to specific people, with expiry on new external shares.
- Disable legacy authentication and move the future pilot cohort to phishing-resistant MFA.
- Define three sensitivity labels in Microsoft Purview, the Microsoft 365 data-governance layer, and get the taxonomy signed off by a named executive owner. In Fusion engagements this labelling work is scoped separately from the access cleanup.
- Write the one-page data-classification policy, including what staff may do with AI tools.
- Baseline the pilot’s named use cases: how long the work takes today, before Copilot touches it.
The deep how of step one, including Restricted Content Discovery, the SharePoint control Microsoft now points to while permissions are reviewed (its predecessor, Restricted SharePoint Search, stopped accepting new enablements on July 31, 2026), is covered in our guide to Microsoft 365 Copilot oversharing. If you suspect staff are already pasting client data into consumer AI accounts, run the shadow AI review in parallel; that exposure predates any Copilot license.
Sector data sizes the adoption wave. Statistics Canada reported that 19.2% of Canadian businesses used AI to produce goods or deliver services in the second quarter of 2026.
Information and cultural industries (42.3%), finance and insurance (40.4%), and professional, scientific and technical services (32.4%) led reported AI use. Those figures measure adoption, not confidentiality risk; assess your own confidentiality obligations separately for your sector. That floor applies to every firm we serve and to Fusion Computing itself; Canadian operators share the same regulators, whatever a vendor’s pitch says.
Stage 3: What the pilot requires to produce a decision (weeks 9 to 12)
Microsoft’s Copilot Success Kit (2026) recommends a phased rollout that starts with a pilot group and structured feedback before wider assignment. Fusion’s operating heuristic for a pilot that can support a scale decision: 5 to 15 users drawn from at least two business functions, three named use cases per user, a baseline measured before enablement, and a weekly check-in for the first month.
Pick pilot seats by workload, and resist picking them by seniority. The users who produce the clearest signal are the heavy Outlook, Teams, and document producers: the operations coordinator drafting 30 client emails a day, the analyst assembling the monthly report. An executive-only pilot flatters the tool and won’t tell you anything transferable about the other 80 seats.
Adoption is a deployment problem, and the pilot is where you solve it. Give the cohort a 30-minute kickoff, a one-page usage explainer, and a named go-to person on Teams for the first two weeks; in Fusion engagements the kickoff is part of the pilot setup and wider support is scoped to fit.
The first three days are loud, week two goes quiet, and by week three the cohort’s asking what else the tool can do.
How do you decide whether to scale Copilot?
Three reviews run on the rollout calendar, against acceptance criteria written before launch: day 30 confirms the remediation is closing exposure findings, day 60 gates pilot entry, and day 90 is the scale decision, judged on measured time savings and active-use rates in the Microsoft 365 Copilot usage reports. Each review has a named owner, and switching Copilot off stays on the table.
A pilot is an experiment with an end date. If nobody can name the date, the criteria, and the person who decides, what you’ve got is a deployment with extra steps.
The forced dates exist because of how pilots actually fail: quietly. Without a review on the calendar, a 15-user trial drifts into a permanent line item, the license cost compounds, the over-share risk compounds, and three months later nobody owns the outcome. Day 90 arrives with a month of real pilot usage behind it, which is what makes the scale call a decision instead of a hope.
Stage 5: Scale in waves and measure what changed (week 13 onward)
Scale-out proceeds in license waves, with adoption tracked through the Copilot reports in the Microsoft 365 admin center and, where licensed, the Viva Insights Copilot dashboard.
- Waves go by team, in the order the readiness audit cleared them.
- Teams whose workloads match the pilot’s winning use cases go first.
- Each wave inherits the kickoff session plus the named go-to contact the pilot validated.
- Adoption is read weekly from the admin center Copilot reports for the first month per wave.
Readiness also decays. Sharing defaults drift, new sites accumulate open links, and the tenant that passed in spring won’t pass by winter on its own. Repeat the audit each quarter; fold it into the quarterly business review rather than treating it as a project.
“Their CISSP-led monthly reviews caught a misconfigured firewall before our auditor did.”
Whether the numbers justify the spend is its own question, with its own math on hours saved against the license and remediation cost. We’ve worked that through separately in the Copilot ROI guide for Canadian businesses.
What does a Microsoft 365 Copilot rollout cost?
License pricing changed materially in 2026: Microsoft’s durable Business with Copilot bundles reached general availability on July 1, 2026, Copilot Pro stopped being sold to new customers after Microsoft 365 Premium launched, and free Copilot Chat lost Word, Excel, and PowerPoint access in tenants of 2,000 seats or more on April 15, 2026. Microsoft’s current license options carry the up-to-date plan detail; our Canadian Copilot pricing guide covers the bundle history and the hidden costs.
Budget for the work around the licenses too. The remediation rows below are scoped from the readiness assessment, and most of the spend lands before pilot licenses roll out broadly.
| Cost item | How it is scoped | When it lands |
|---|---|---|
| SharePoint over-sharing remediation | Fixed fee derived from the readiness assessment’s sharing and access findings | Stage 2, weeks 3 to 8 |
| Microsoft Purview label configuration | Scoped separately when the pilot’s data requires it | Parallel to stage 2 |
For a number scoped to your own tenant’s condition, talk to our team.
What this plan does not cover: policy, shadow AI, and Copilot vs custom AI
Four adjacent decisions sit outside a rollout plan. Writing the workplace policy itself is covered in what should be in an AI acceptable use policy. Whether Copilot is even the right tool, against a custom retrieval platform, is the subject of custom AI vs Microsoft 365 Copilot. Vertical nuance runs deep enough that we’ve written it separately, starting with Copilot for Canadian CPA firms.
And the plan assumes somebody runs it. If your firm doesn’t have the internal bandwidth, Fusion Computing’s Microsoft 365 Copilot service runs the same five stages as a managed engagement, from the readiness audit through the day-90 decision, alongside our broader AI services practice.
Where to start this week
Run the free Copilot readiness scan, pull the org-wide sharing report, and put the five stages on a 90-day calendar. Or walk them with us in 30 minutes.
Mike Pearlstein, CISSP, MSc Computer Science (AI); Microsoft 365 governance since 2012.
Frequently asked questions
What should we fix before deploying Microsoft 365 Copilot?
Fix SharePoint sharing first: revoke org-wide and anyone-with-the-link shares older than 12 months, and set the tenant default link type to specific people. Then disable legacy authentication, move pilot users to phishing-resistant MFA, define three Purview sensitivity labels, and write a one-page data-classification policy. Copilot searches everything a user can already open, so permission cleanup comes before licenses go wide.
How long does a Microsoft 365 Copilot rollout take for a small business?
Plan on roughly 90 days for a 10 to 150 seat firm: two weeks for the readiness audit, four to six weeks of remediation, then a four-week pilot, with the scale decision at rollout day 90. A tenant with clean sharing and labels can compress the middle stage; a tenant with a decade of permission drift should expect the full window.
Do we need Microsoft 365 E5 to run Copilot?
No. Small-business plans qualify; Microsoft’s license options page carries current plan detail, and the Fusion Computing Copilot pricing guide covers the Canadian bundle context. Microsoft 365 E5 adds deeper Microsoft Purview automation and security tooling, which helps the labelling stage, but it is not a Copilot prerequisite.
How many people should be in a Copilot pilot, and who should they be?
Fusion’s operating heuristic is 5 to 15 users drawn from at least two business functions. Smaller cohorts can still be useful but give thinner evidence; larger cohorts add support load before the controls are proven. Select seats by workload rather than seniority: heavy Outlook, Teams, and document producers generate the clearest evidence. Give each user three named use cases and measure a baseline first.
What does a Copilot readiness assessment actually check?
Six control families: licensing fit, identity and Conditional Access, SharePoint sharing hygiene, Microsoft Purview sensitivity labels, the written data-classification policy, and pilot scope. Microsoft’s technical floor (Microsoft Entra ID accounts, Exchange Online mailboxes, Microsoft 365 Apps) is verified in an afternoon; the substance of the assessment is what each user can already open across SharePoint, OneDrive, Exchange, and Teams.
Can we roll Copilot back if the pilot goes badly?
Yes. An administrator can unassign Copilot licenses in minutes, though service changes can take time to propagate. What needs preparation is the decision framework: a written trigger, a named decision-maker, and a communication path to the pilot cohort, all documented before week one. The day-90 review is the formal decision point; the rollback path exists from the first day of the pilot.
Does Copilot let employees see files they should not have access to?
Copilot only surfaces content a user could already open under existing Microsoft 365 permissions. The risk is that years of stale org-wide links and forgotten shares mean users can open far more than anyone remembers, and Copilot makes that reachable through a single question. A pre-rollout sharing audit, plus interim controls like Restricted Content Discovery, closes the gap before it becomes an incident.
How do we measure whether Copilot is working?
Baseline the pilot’s named use cases before enablement: how long the work takes today. Then compare at the rollout’s scheduled reviews using the Copilot usage reports in the Microsoft 365 admin center and, where licensed, the Viva Insights Copilot dashboard. Acceptance criteria are written before launch: measured time savings, zero unresolved exposure findings, and active use above an agreed floor.
What does a Copilot rollout cost beyond the licenses?
The remediation stage carries the real budget: SharePoint sharing cleanup, Microsoft Purview labelling where the pilot’s data requires it, and training time. Fusion scopes the fixed fee from the readiness assessment’s sharing and access findings rather than a flat benchmark, and most of that work lands before pilot licenses roll out broadly. For a figure scoped to your tenant, ask for the assessment first.
Do Canadian privacy laws apply to a Copilot rollout?
Yes, though which law applies depends on province, sector, and activity. PIPEDA’s safeguard principle covers many commercial contexts; Alberta, British Columbia, and Quebec have substantially similar private-sector laws that may apply instead for some intraprovincial matters, and PHIPA covers Ontario health information. The federal Privacy Commissioner’s generative AI principles expect organizations to limit access to what is necessary, which is what the permission cleanup delivers.
What is Restricted Content Discovery, and do we need it for a Copilot rollout?
Restricted Content Discovery is the SharePoint control Microsoft currently points to for limiting what Copilot and organization-wide search can surface from named sites while permissions are reviewed. It changes discoverability, not permissions, and recently accessed content can still appear, so treat it as an interim measure rather than a security boundary. Its predecessor, Restricted SharePoint Search, stopped accepting new enablements on July 31, 2026.
Can we run the Copilot pilot while the SharePoint cleanup is still in progress?
Yes, with a narrowed scope. Clean the sites and OneDrive libraries the 5 to 15 pilot users actually touch, turn on the tightened sharing defaults tenant-wide, and run the historical org-wide cleanup as a parallel work stream. A pilot on an untouched tenant is the version to avoid: the first cross-team question surfaces whatever the old defaults left open.
