Find out what Copilot will publish.
Two to three weeks, fixed price. You get a straight answer on whether you are running a rollout or a remediation project — and the plan for whichever one it turns out to be.
2–3 weeks · fixed scope · quoted before it starts
The questions a pilot never asks.
Nothing becomes more exposed the day Copilot is enabled. What changes is that anything technically shared becomes findable by anyone, in a sentence.
- 01How much of the estate is shared with Everyone except external users, and what sits inside it.
- 02Which sites have no owner, or an owner who left the company.
- 03Sharing links that outlived the project that needed them, including anonymous ones.
- 04Whether sensitivity labels exist, and whether they are applied by rule or by people remembering.
- 05How much content is stale enough to give a confidently wrong answer.
- 06Whether search returns the current version of a policy — we ask three people to find one and watch.
- 07Guest and external access, and what it can currently reach.
- 08Where your most sensitive content actually lives, as opposed to where policy says it should.
What lands on your desk
A readiness position
Rated, with the evidence behind each rating. Not a maturity score out of five — a statement of what would happen if you switched it on next month.
The oversharing list
The specific sites, libraries and links that would surface content they should not, in the order they would cause you a problem.
A remediation plan
Sequenced, with effort against each item, and marked clearly for what your own team should do rather than pay us for.
A labelling position
What exists, what it covers, and the smallest scheme that would actually hold across the estate.
Content currency
Where the stale content is concentrated, and what to archive before an assistant can quote it back to someone.
A rollout path
Who goes first, what has to be true before they do, and how you would know it worked.
Three weeks, and you know where you stand.
- Week one
Access, tenant reporting, and the automated read across sites, permissions, sharing and labels. We work from your own admin data rather than asking your team to compile it.
- Week two
The manual work the reports cannot do: sampling high-risk sites, the search test with real people, and interviews with whoever owns content today.
- Week three
Findings, remediation plan and the rollout path, walked through with your team — then handed over written, in a form you can take to whoever holds the budget.
SharePoint audit for AI readiness — energy services and construction. The concerns were security and information risk, and there was no information architecture to implement against. We reviewed the estate, found a significant number of high-risk issues, and designed the information architecture along with the other remediation the estate needed. Our recommendation was to clean up and close the high-risk gaps before going near a rollout.
Before you ask
We have already bought the licences.
Then this is more urgent rather than less. Most of what we find can be fixed in weeks, and knowing the order to fix it in is what stops the rollout stalling after the first team.
Can our own team not run the reports?
Partly, and we say so. The tenant reports are the easy half. What they do not tell you is which of those findings actually matter, which is the judgment you are buying.
What if the answer is that we are ready?
Then you get that in writing, with the evidence, and we help you sequence the rollout instead. It happens, though not often on an estate that has been running for more than a few years.
Find out what it would surface.
Forty-five minutes on your tenant, what you are planning, and whether an assessment is even the right next step.