Copilot Readiness Checklist: 10 Questions Executives Should Ask IT Before Approving a Rollout
Ten plain questions, grouped in four blocks, each with what a good answer sounds like.
Bottom line: a Copilot readiness checklist for executives is ten questions to put to IT: what Copilot can see, who gets in, who gets a license, and how you'll count use. Ask for a report or a named owner on each, not a guess. Leadership decides who gets licenses, and someone owns training.
This list covers Microsoft 365 Copilot (now called Microsoft Copilot, so just Copilot from here), though your people may be using Claude or Gemini too.
I've worked with Gen AI and trained teams on it since early 2022, and so far I've run 264 AI sessions in 112 organisations (updated October 2026).
Copilot readiness checklist: how to use these 10 questions
This list is for the person who asks IT, not the person who configures the tenant. Microsoft's own readiness checklist is written for admins. Questions 1 to 6 below are its documented steps, translated. The opinions in 7 and 10 are mine.
Copilot works on what each person can already open, so question 1 is about data. Gartner's June 2026 survey of 186 organisations found that 51% of respondents identified oversharing and data loss as the top barrier to successful Copilot deployment. I couldn't open the paywalled report, so that figure is second-hand, as quoted by Opsin Security (18 June 2026). More on oversharing in Copilot.
This isn't a full Copilot readiness assessment, and no score comes out of it. If you want someone to work through it with you, that's an enterprise AI readiness assessment.
- Data: 1. What can Copilot see today?
- 2. Is sensitive content labelled and protected?
- 3. Can we see what Copilot is doing?
- Access and devices: 4. Who signs in, and from where?
- 5. Are our apps and update channel right?
- 6. Will our network let Copilot through?
- Licenses and agents: 7. How will we decide who gets a paid license?
- 8. Who may build agents, and who approves them?
- Measurement and people: 9. How will we measure, and what counts as use?
- 10. Who trains people, and what is the usage policy?
Data: what Copilot can see, and who watches
1. What can Copilot see today?
Copilot grounds its responses in "the data users already have permission to access" (Microsoft Learn, May 2026). So wherever access is too wide, Copilot makes that content easy to find. Checking oversharing before rollout starts here.
A good answer sounds like a report, not a feeling. Microsoft's first steps are to export the top 100 most used SharePoint sites, run the SharePoint Advanced Management permission state report, and turn off "everyone except external users" at the tenant level (Microsoft Learn, May 2026, updated September 2026). Microsoft gives no time or cost for the cleanup, so ask IT for an estimate.
2. Is sensitive content labelled and protected?
Sensitivity labels classify and protect sensitive files, and restricted content discovery can keep high-risk sites out of Copilot (Microsoft Learn, May and June 2026). SharePoint Advanced Management comes with a Copilot license when at least one user holds one (check your base plan).
A good answer sounds like a list: which content carries labels, and which risky sites are kept out.
3. Can we see what Copilot is doing?
Microsoft's setup guide tells IT to turn on unified audit logging in the Microsoft Purview portal, set retention and review the logs (Microsoft Learn, May 2026).
A good answer sounds like: logging is on and someone reads it. IT should also know that counts built from the audit log may not match Microsoft's official usage reports (Microsoft Learn, July 2026). The audit log is for security. The usage reports are for adoption.
Access and devices: who gets in, and what they get in with
4. Who signs in, and from where?
Microsoft asks for MFA for all users and conditional access policies based on user risk, location and device compliance (Microsoft Learn, May 2026). A good answer: MFA is on for everyone, and IT can show you the policies.
5. Are our apps and update channel right?
Copilot runs on Current Channel or Monthly Enterprise Channel, not Semi-Annual Enterprise Channel. A new license can also take up to 24 hours to appear in the apps (Microsoft Learn, May 2026). A good answer: IT knows which channel each group is on.
6. Will our network let Copilot through?
IT should allow *.cloud.microsoft and the Copilot endpoints, and check that proxies and firewalls don't block the app. The primary URL is changing to copilot.cloud.microsoft (Microsoft Learn, September 2026). A good answer: IT has checked your proxy and firewall.
Licenses and agents: who gets what
7. How will we decide who gets a paid license?
Don't buy 1,000 licenses and then chase people to use them. Leadership and your AI champions get paid licenses first, because they set the example and only someone using the paid version can judge a request. That's why Copilot training for executives comes first. Everyone else starts on free Copilot Chat and asks for a license when they hit a real limit. Their direct manager confirms it with a quick check, and IT assigns it, all within a few days (not weeks or months). Who should get a Copilot license first has the full method.
IT should block self-service purchase of Copilot, so every paid license goes through a request from someone who hit a real limit.
Ask this: who decided whether people can buy Copilot on their own? Microsoft's setting offers "Allow", "Allow trials only" and "Do not allow" (Microsoft Learn, October 2026). A good answer names the path from request to license, who approves, and that it takes days.
8. Who may build agents, and who approves them?
Who should be allowed to build them is your call (I won't pick for you). Ask for a named owner and a list of who can build today. Admins can see recently created agents in SharePoint Advanced Management (Microsoft Learn, June 2026) and cap spending per user group and per agent (Microsoft Learn, August 2026). A good answer has a name and a list. More in agent admin approval.
Measurement and people: how you will know, and who trains
9. How will we measure, and what counts as use?
Microsoft's Copilot Dashboard covers readiness, adoption, impact and sentiment, and switches on with one Copilot license (Microsoft Learn, September 2026). A user counts as active after one intentional action, such as submitting a prompt, in the window you pick (Microsoft Learn, July 2026).
According to Recon Analytics (February 2026), only 35.8% of US workers who have Copilot available at work use it as their main AI tool. See why Copilot rollouts stall. A good answer: IT shows the dashboard and says which window and which definition.
10. Who trains people, and what is the usage policy?
AI adoption is a people problem, not a technology problem. Training is what makes a license worth it. Microsoft's pilot phase lists a communication plan and a champions group (Microsoft Learn, May 2026), and the question also covers a usage policy people can find. Start from a GenAI usage policy template, then see Copilot champions training and Copilot training for large organisations. A good answer: a named owner, a date for the first sessions, and a policy.
When IT says "we don't know"
That's fine. A gap with an owner and a date is fine too. Ask for both.
Keep this as your Copilot go-live checklist and ask the same ten again after launch. For the money side, see Copilot total cost of ownership.
Who is behind this checklist
I'm an AI consultant and trainer, focused on AI transformation and using AI at work. Clients include Intel, Roche, EY and Deloitte. Longer story: about Eyal Marcus.
I have no commercial interest in Microsoft (and yes, I sell Copilot training, so weigh Q7 and Q10 accordingly). Copilot changes constantly, and so do my lectures and workshops. Check the dates.
Common questions
What should executives ask IT before a Copilot rollout?
Ten questions in four groups: data, access and devices, licenses and agents, and measurement and people. Ask for a report or a named owner on each, not a guess.
What can Microsoft 365 Copilot access in our company?
Whatever each person can already open. Microsoft says Copilot grounds responses in "the data users already have permission to access" (Microsoft Learn, May 2026), so wide access means easy discovery.
Is my organisation ready for Copilot?
You're ready to decide when IT can answer the ten questions with a report or a named owner. Gaps are normal, and a gap with an owner and a date is fine.
Do we need to fix permissions before rolling out Copilot?
Microsoft puts permission checks before license assignment: review the most-used SharePoint sites, run the permission state report and turn off "everyone except external users" (Microsoft Learn, May 2026, updated September 2026).
Who should get Copilot licenses first?
Leadership and AI champions first. Everyone else starts on free Copilot Chat and gets a paid license when they hit a real limit, confirmed quickly by their manager and approved within days. Full method in who should get a Copilot license first.
How do we measure whether Copilot is being used?
Use Microsoft's Copilot Dashboard and the usage report in the Microsoft 365 admin center (Microsoft Learn, September 2026). "Active" means one intentional action, so it's a low bar.
Train your leadership team first.
Take the ten questions to IT, then leave your details and we'll talk about the people side.