Microsoft Copilot implementation checklist

Most Copilot rollouts that go sideways were doomed at the licensing stage - not because the licences were wrong, but because nobody did the boring work of tidying permissions and planning adoption first. This checklist is the sequence we run through with every UK business we help implement Microsoft 365 Copilot. Use it as-is, or as a prompt for the questions to ask whoever's doing the work for you.

Before you buy licences

• Confirm eligibility. Copilot for Microsoft 365 requires a qualifying M365 plan (Business Standard/Premium or E3/E5). Check yours.
• Identify a pilot group. 20 to 50 users across two or three teams beats one licence for everyone. Pick teams with clear, repetitive work.
• Agree success measures. Time saved per week, satisfaction scores, weekly active users. Write them down before you start.
• Nominate an executive sponsor. Copilot is a change programme. Without a sponsor it drifts.

Data and permissions readiness

This is the section people skip and later regret. Copilot can see everything a signed-in user can see. If your SharePoint and Teams estate has grown organically for years, so has the risk of oversharing.

• Run a permissions audit. Which SharePoint sites are open to "Everyone except external"? Which Teams have guest access nobody remembers granting?
• Fix broken inheritance. Sites where permissions have been overridden site-by-site are Copilot's favourite way to surface things it shouldn't.
• Deploy sensitivity labels. Confidential, internal, public - with auto-labelling where you can.
• Turn on Restricted SharePoint Search or Restricted Content Discovery if you need a stop-gap while you clean up.
• Archive stale content. Old, out-of-date documents are worse than useless - Copilot will happily quote them back at you.

Security and governance

• Review conditional access and MFA for the users getting Copilot. Copilot inherits their security posture.
• Confirm data residency and tenant settings meet your compliance needs.
• Enable Purview data classification and DLP policies for Copilot interactions.
• Decide your prompt and response retention policy. Copilot interactions are logged - agree who can see them.
• Write a one-page Copilot acceptable use policy. Short, practical, in plain English. Everyone signs it.

Licensing and rollout

• Buy for the pilot only. Don't licence the whole business up front.
• Assign licences via groups not individually - it's easier to reshape as you learn.
• Enable Copilot in the apps that matter to the pilot (Outlook, Teams, Word, Excel, PowerPoint) and turn off the ones you don't need yet.
• Deploy the Copilot app in Teams so users have one obvious front door.

Adoption and enablement

Copilot doesn't sell itself. People need to be shown how to use it in the work they already do.

• Run a kickoff session per pilot team - 45 minutes, live demos in their own tools, not generic slides.
• Build a prompt library for the top 10 tasks each team does - meeting summaries, email drafting, Excel analysis, document review.
• Identify champions - one or two per team who'll answer the small questions in the moment.
• Set up a weekly office hour for the first two months. Cancel it once nobody turns up.
• Share wins publicly. Screenshots in Teams, "I saved two hours today" stories. Momentum matters.

Measurement and ROI

• Track usage in the Microsoft 365 admin centre and the Copilot Dashboard. Weekly active users is the single most useful number.
• Run a satisfaction survey at week 4 and week 12. Same questions both times.
• Log time saved by task type - even rough estimates. It's the only way to answer the ROI question honestly.
• Reclaim licences from non-users at month three. Reassign to people on the waiting list. Don't be sentimental.

Ongoing care

• Read the release notes monthly. Copilot ships new features every month; some change behaviour.
• Refresh the prompt library quarterly. What worked in month one is often outdated by month six.
• Re-audit permissions annually - or after any major SharePoint or Teams sprawl event.
• Plan the next wave. Agents, Copilot Studio, Copilot in Fabric - decide what's next and why.

The short version

Fix permissions before you turn Copilot on. Pilot small. Measure honestly. Reclaim licences that aren't being used. Treat it as a change programme, not a software install.

Where to go next

For how we run this end-to-end, see our Microsoft Copilot implementation page. For a shorter, focused piece of work up front, see the Copilot readiness assessment. Or get in touch and we'll walk through your specific situation.