Microsoft Copilot Readiness Checklist (Free PDF, 9 pages)
A 30-question pre-deployment audit Canadian businesses with 10 to 150 employees can run before turning Microsoft 365 Copilot on, so the rollout improves productivity instead of leaking client data.
Built by Fusion Computing’s CISSP-led team. Question E5 asks whether your policy is mapped to the privacy laws that apply to you, such as PIPEDA, PHIPA and Quebec Law 25, and to a control baseline such as CIS Controls v8.1.
How do you know if your business is ready for Microsoft Copilot?
Your business is ready for Microsoft Copilot when six areas pass. Licensing and sign-in are in order, nobody can open files they should not see, and sensitive files carry Microsoft Purview labels. A written AI use policy is in place, and a small pilot group has use cases with a measured baseline. Fusion Computing’s free 30-question checklist tests each area and scores you Green, Amber or Red.
| Area | You are ready when | Checklist |
|---|---|---|
| Licensing | Every intended Copilot user has an eligible Microsoft 365 plan, and the pilot group is named | Section A |
| Identity | Copilot users sign in with phishing-resistant multifactor authentication (MFA), and Conditional Access blocks unmanaged devices | Section B |
| Sharing | Anyone and organization-wide links are reviewed and closed, and new links default to specific people | Section C |
| Labels | Sensitive files carry Microsoft Purview sensitivity labels, and data loss prevention (DLP) rules match the labels | Section D |
| Policy | Leadership has approved a written data classification policy and an AI use policy | Section E |
| Pilot | 5 to 15 pilot users have named use cases and a baseline measured before launch | Section F |
Anything Copilot can see can be asked for, or surfaced by mistake.
Expect Amber or Red on a first run. That is normal, and it tells you where to start. Get the PDF checklist and work through it with whoever runs your Microsoft 365.
Why this matters
Canada’s Artificial Intelligence and Data Act died with Bill C-27 in January 2025. A documented readiness check and an acceptable-use policy are a practical way to show AI was adopted with care.
According to Statistics Canada’s 2026 Canadian Survey on Business Conditions, 25.2% of Canadian businesses plan to use AI over the next 12 months, up from 14.5% in 2025 and 10.6% in 2024. For a business planning Copilot, the readiness check comes before the licence purchase, while there is still time to fix sharing and labels.
The SharePoint and OneDrive permission model that worked before Copilot can expose years of accumulated overshares once Copilot is turned on. A new hire would never find a 2019 acquisition spreadsheet by accident. Copilot can surface it as a citation in a two-paragraph summary on day three of the pilot.
According to Microsoft’s fiscal 2026 third-quarter earnings call, Microsoft 365 Copilot passed 20 million paid seats. Each of those seats can reach whatever its user’s permissions already allow, so the readiness work happens in the tenant before the first licence is assigned.
This checklist is the pre-flight inventory Fusion Computing runs before enabling Microsoft 365 Copilot licences. It has thirty questions across six control families: licensing, identity, SharePoint permissions, Microsoft Purview labels, data classification and pilot scope. A Green score, with the four hard-gate questions and three others all YES, puts remediation at a lower priority; the PDF lists what to verify before the first pilot licence. An Amber or Red score gives the order to close the gaps in.
According to Microsoft and LinkedIn’s 2024 Work Trend Index, 78% of AI users bring their own AI tools to work, rising to 80% at small and medium-sized companies. A readiness check that covers only Copilot misses the consumer AI tools staff already use, so the checklist’s policy questions name both.
Download the PDF (free, no spam)
Enter your name, business email, and company. The 9-page PDF is sent to your inbox.
Send me the Copilot Readiness Checklist
What’s inside the 9-page PDF
A 30-question pre-deployment audit organized in six control families. Each question is marked YES, PARTIAL or NO, and many carry a short note on the risk behind it.
A. Licensing fit (5 questions)
- Eligible Microsoft 365 base licence confirmed for every intended Copilot user
- Full budget approved by finance, including the Purview and Entra licensing you intend to use
- Microsoft 365 Apps deployed to every pilot user, with the Office Feature Updates task allowed to run
- Named pilot cohort rather than blanket distribution
- No pilot user on device-based licensing for Microsoft 365 Apps for enterprise
B. Identity & Conditional Access (5 questions)
- Phishing-resistant authentication on every Copilot user, such as passkeys/FIDO2, Windows Hello for Business or Microsoft Entra certificate-based authentication configured as multifactor. Authenticator push with number matching counts as partial: it is stronger push MFA and still phishable.
- Conditional Access blocks unmanaged devices
- Explicitly disallowed countries or IP ranges blocked or restricted
- Legacy authentication that cannot satisfy MFA blocked, and SMTP AUTH disabled wherever it is not required
- Recurring access review scheduled across SharePoint, OneDrive, Teams and connected apps, with a named owner
C. SharePoint permission hygiene (5 questions)
- Current Anyone, People-in-the-organization and Everyone-except-external-users exposure documented, reviewed, and closed or formally accepted
- Default link type set to “Specific people” at the tenant policy level
- 60- or 90-day expiry on new Anyone links, and guest access expiry set separately for external guests
- “All Company” / “Everyone except external users” groups audited against current need
- SharePoint sites classified with container labels, and file-level labels applied separately
D. Microsoft Purview information labels (5 questions)
- Three Microsoft Purview sensitivity labels defined (Public, Internal, Confidential at minimum)
- Auto-labelling enabled on at least one Confidential pattern (SIN, PHI, named client)
- Confidential labels apply encryption and usage rights
- Label taxonomy signed off by CEO, CFO, or named information-governance owner
- DLP policy mirrors the label rules for outbound email and Teams chat
E. Data classification policy (5 questions)
- Written one-page data-classification policy approved by leadership
- Stated AI use policy covering Copilot for Microsoft 365 and consumer AI tools
- Records-retention rule for Copilot prompts and responses
- Privacy breach response plan covers AI-disclosure scenarios
- Policy mapped to PIPEDA, PHIPA, PIPA, Quebec Law 25, and CIS Controls v8.1
F. Pilot scope + measurement plan (5 questions)
- Named 5-15 user pilot cohort drawn from at least two business functions
- Named use cases per pilot user, with a baseline measured before Copilot is enabled
- Weekly check-in cadence for the first 30 days
- Documented Copilot rollback plan with named trigger and decision-maker
- Reviews 30, 60 and 90 days after the pilot starts, with a named owner, and the scale decision at the first review
Plus: a Green / Amber / Red scoring rubric, a 90-day remediation roadmap from a Red score, six common pitfalls Canadian SMBs hit on Copilot rollouts, and seven primary references.
Microsoft Copilot readiness FAQ
How do we know if our business is ready for Microsoft Copilot?
You are ready when every intended user has an eligible Microsoft 365 licence, sign-in uses phishing-resistant MFA, old sharing links have been reviewed and closed, and sensitive files carry Purview labels. You also need a written AI use policy and a 5 to 15 person pilot with measured use cases. The 30-question checklist marks each item YES, PARTIAL or NO and scores you Green, Amber or Red.
Who can check whether a Canadian business is ready for Microsoft Copilot?
Fusion Computing, a Canadian-owned, CISSP-led IT firm founded in 2012, runs Copilot readiness checks for businesses with 10 to 150 employees. The checklist on this page is free to run yourself. Fusion Computing’s Copilot Readiness Assessment, a $1,340 fixed fee, checks the tenant against Microsoft’s Copilot security documentation and proposes the fixes, which are quoted separately in writing.
Is Microsoft 365 Copilot safe to roll out for a small business?
Permissions are the starting point. Copilot can only surface content a user already has access to, so review and close Anyone and organization-wide links and label sensitive files in Microsoft Purview. Then pilot with a small group, and test oversharing and prompt-injection cases before the whole company gets a licence.
What licensing does Copilot require?
Microsoft 365 Copilot is a per-user licence added to a qualifying Microsoft 365 Business or Enterprise plan, at Microsoft’s price. Copilot Chat comes with eligible plans at no extra cost and covers lighter use. Many businesses give the paid licence to a pilot group first, then decide who else needs it once the pilot shows where Copilot saves time.
How long does a Copilot rollout take?
Readiness work comes before the pilot, and permission cleanup and labelling can extend the schedule. The 5 to 15 user pilot is then reviewed 30, 60 and 90 days after it starts. Weekly check-ins run for the first 30 days, and the scale decision comes at the first review.
The full sequence, week by week, is in the 90-day Copilot rollout plan.
About the author
Mike Pearlstein, CISSP is the founder and CEO of Fusion Computing, a Toronto-based managed IT provider for Canadian businesses with 10 to 150 employees. Fusion Computing was founded in 2012 and has been deploying and governing Microsoft 365 tenants for Canadian SMBs ever since. Mike personally holds the CISSP credential, the recognised senior-practitioner baseline for information security, and an MSc in Computer Science from the University of Guelph (2011).
Fusion Computing is named in Canada’s 50 Best Managed IT Companies for 2024 and 2025 and holds a 4.9 average on Google Reviews. It is the CISSP-led IT partner for Canadian businesses in legal, accounting, wealth management, healthcare and professional services.
When you’ll receive the PDF
Submit the form above to receive the 9-page PDF by email. The download link is the first thing in the email. There is no waiting period, no “we will be in touch,” no manual sales follow-up before you have the document.
You get one email with the download link. We send nothing else unless you reply or ask for a call.
Want us to walk through your scorecard?
Run the checklist, then book a free 30-minute call. We’ll review your Green / Amber / Red score, explain the highest-priority gap for your tenant, and tell you whether a remediation engagement is worth the budget. No sales script, no obligation.
Updated
