The oversharing problem Copilot will find for you
Why permission debt is the most common reason pilots get paused, and how to assess it before you deploy.
Read moreAssigning licences takes an afternoon. Getting measurable value takes a readiness assessment, a permission model that does not overshare, a small number of high-value scenarios and an honest measurement plan. We do the parts that determine whether the investment shows up in your numbers or just in your invoice.
Copilot puts generative AI into Word, Excel, Outlook, Teams and PowerPoint, grounded in your organization's own content. That grounding is the whole value proposition and also the whole risk: Copilot can reach anything the user can reach, which means a decade of casual oversharing becomes visible on day one.
A pilot group receives Copilot, uses it for summarising meetings, and nobody can say whether the investment is justified when renewal comes round. Enthusiasm is not evidence.
Documents that were technically accessible but practically buried are now surfaced by a query. The information governance debt was always there; Copilot simply audits it in public.
Without scenario guidance most users try it twice, get a mediocre result from a vague prompt, and go back to working as before. Adoption stalls quietly rather than failing loudly.
Finance asks what the return was. The answer is anecdotal, the renewal becomes a debate about vibes, and the programme loses the sponsorship it needs to grow.
Where Copilot actually shows up in the numbers: The reliable returns are in roles with high volumes of routine written work and information retrieval: proposal and document drafting, meeting recap and follow-up, email triage, first-draft analysis in Excel, and finding the thing somebody wrote eighteen months ago. Revenue impact, where it appears, is second-order — sellers spending recovered hours in front of customers, service teams closing cases faster, proposals going out in volume. We help you pick scenarios where the causal chain to a business number is short enough to be credible, and we will tell you when a proposed use case is unlikely to pay back.
The capabilities that matter for a deployment decision.
First drafts in Word, summarisation of long documents and email threads, and presentation generation in PowerPoint. The most immediately useful capability and the easiest to demonstrate.
Summaries, decisions and action items from meetings, including for people who could not attend. Consistently the capability users miss most when it is taken away.
Formula generation, data exploration and first-pass analysis. Valuable, and the capability that most requires people to check the output rather than trust it.
Retrieval across your tenant's documents, emails and chats, subject to the permissions of the person asking. Powerful, and the reason the permission model has to be right first.
Where the standard product stops, agents extend it: a scoped assistant over a specific knowledge base or process, published into Teams or the apps people already use.
Copilot connectors bring content from other repositories into the same grounding, which is often what turns a useful tool into an indispensable one.
The direction is agentic: Microsoft's 2026 release waves put role-based agents across Dynamics 365 and Microsoft 365, moving from AI that assists a person to AI that carries out a defined task. That raises the stakes on governance rather than lowering them, which is why we treat identity, permission and data classification as prerequisites rather than as follow-up work.
We use Microsoft's three-tier maturity framing: usage first, then time and quality, then business KPIs. Anyone promising you tier-three numbers before you have tier-one data is guessing.
Licensed users genuinely using it, not merely assigned
Self-reported time recovered in high-fit roles
Faster first drafts in proposal and reporting-heavy roles
Linked to revenue, cycle time or satisfaction once tiers 1 and 2 hold
Where remediation is completed before deployment
Evidence sufficient for a scale-or-stop decision
How to read these: How to read these: the figures above are typical ranges we plan and measure against, not guarantees. In your first engagement we agree the baseline, the target and the measurement method in writing, then report against them.
Microsoft's adoption guidance is unusually explicit that value has to be measured rather than assumed, and it frames the outcomes as follows.
Where this comes from: Where this comes from: these themes follow Microsoft's Copilot adoption and business-impact guidance published on learn.microsoft.com and adoption.microsoft.com, including the three-tier measurement model (usage, productivity, strategic KPIs) and the Copilot business impact report in Viva Insights. The numeric ranges in the panel above are ours and are planning figures, not Microsoft benchmarks.
The scenarios that consistently repay the investment, and the reason they differ by industry.
Administrative documentation, referral correspondence and policy drafting — deliberately kept away from anything that touches a clinical decision.
First-draft correspondence, document summarisation and matter research support, with confidentiality boundaries enforced through permissions.
Meeting recap for relationship managers, credit and committee paper drafting, with retention and supervision controls applied.
Standard operating procedure drafting, supplier correspondence and shift handover summarisation.
Proposal drafting, engagement documentation and meeting follow-up — the highest-fit sector we work with, because the work is largely written.
Correspondence drafting, briefing summarisation and report preparation, with records retention applied to prompts and responses.
In this order. Deployment before readiness is the most expensive sequence available.
The work that determines whether deployment is safe. Almost always the first engagement.
Choosing a small number of high-value scenarios with the business, then deploying against them.
The part that produces the evidence for a renewal decision.
Implementation, customization, support and integration — with readiness treated as part of implementation rather than an optional extra.
Environment design, tenant and licensing setup, configuration, data migration, testing and go-live — scoped to a fixed price and a fixed date, against outcomes agreed in writing before we start. For Copilot, implementation includes the readiness and permission remediation work. We will not deploy into a tenant with unresolved oversharing, because the first serious incident ends the programme.
Where the product stops short of your process, we extend it inside the platform rather than beside it, and we build it as configuration you can maintain wherever that is possible. Agents built in Copilot Studio, scoped to a specific knowledge base or process, plus prompt libraries written around your actual documents and terminology.
Managed support after go-live: a named team, agreed response times, release management for Microsoft's update cadence, and a backlog we work through with you. Ongoing enablement, prompt coaching, licence management and the measurement reporting your sponsor needs to defend the spend.
Connecting this platform to the systems you are keeping, with monitored, re-runnable interfaces and a documented contract for every field that moves. Copilot connectors to the repositories outside Microsoft 365 that hold the content people actually need, with permissions honoured end to end.
We will tell you if we think Copilot is not yet right for you. Organizations with significant unresolved permission debt, or without a function whose work is genuinely document-heavy, are usually better served by fixing the foundations first — and we would rather say that now than after you have committed to an annual licence count.
Copilot is the platform where sequence matters most, because the failure modes are reputational rather than technical.
We assess the tenant, the permission model, the data estate and which roles have genuine fit.
We remediate oversharing, apply labels where needed, and select the scenarios worth measuring.
We roll out to a defined pilot with success criteria agreed in advance, not decided afterwards.
We validate that retention, supervision and DLP behave correctly with prompts and responses in scope.
We report at ninety days against the baseline and make a scale, adjust or stop recommendation.
Stop is a real recommendation and we have made it. A Copilot programme that cannot show tier-one and tier-two evidence after ninety days is unlikely to produce tier-three business results by being extended, and continuing it to protect a decision is an expensive way to be polite.
The market is full of enthusiasm. What is scarce is honest assessment of whether it will pay back in your organization.
The oversharing assessment comes first because it determines whether deployment is responsible. This occasionally delays a project we were going to be paid for, which is exactly the point.
Usage, then productivity, then business KPIs. It is slower than claiming a headline number and it is the only version your finance director will accept twice.
The functions that will use it know where their week goes. Scenario selection done in IT produces pilots that impress nobody in the business.
A recommendation to fix permissions first, or to license fewer people than proposed, is a normal output of our assessment and a considerably cheaper mistake to avoid than to make.
Two illustrative engagements showing the shape of the work.
The firm had assigned licences to a pilot group with no baseline and no scenario guidance. Usage was sporadic and the renewal conversation was heading towards cancellation.
A readiness assessment ahead of deployment identified a large volume of sensitive content accessible far more widely than anyone had realised, including material that would have surfaced in ordinary queries.
Practical pieces on deploying AI that shows up in the numbers.
Why permission debt is the most common reason pilots get paused, and how to assess it before you deploy.
Read moreThe three-tier model, what evidence each tier needs, and why skipping to business KPIs undermines the case.
Read moreA candid look at high-fit and low-fit roles, and how to choose a pilot group that proves something.
Read morePick a function and a document type — proposals, case notes, board papers, correspondence. We will run a scoped readiness check and show you Copilot working against that scenario with your own material, plus an honest view of what it would return at scale.
Describe the situation in your own words.