Copilot readiness checklist for Australian organisations

Before you switch on Microsoft 365 Copilot, check five things: who can access what, where your sensitive data sits, who owns each site and Team, which licences you need, and how you’ll roll it out. Copilot shows each person anything they already have permission to open, so the checklist is mostly about access. Work through it in this order and you’ll fix the biggest risks first.

1. Access and sharing

Why this comes first: is it safe to turn on Copilot?

• List sites and libraries shared with “Everyone” or “Everyone except external users”
• Find organisation-wide sharing links on files and folders
• Check OneDrive folders shared broadly by individual staff
• Review guest and external users, and remove those who no longer need access
• Agree how new access is granted from now on (who approves, and how)

2. Sensitive content

• Identify where HR, payroll, board, finance and client contract files actually live
• Confirm only the right people can open them
• Decide whether to apply sensitivity labels to the most sensitive content
• Move sensitive files out of general team sites where needed

3. Structure, naming and ownership

• Every active SharePoint site and Team has a named owner
• A naming convention so people can tell sites apart (department, project, external)
• Inactive sites and Teams are archived, so Copilot doesn’t draw on outdated content
• Duplicate and outdated versions of key documents are cleaned up

4. Licences

• Check which Microsoft 365 plans you’re on and what they already include
• Identify the roles that will get the most from Copilot (heavy email, meetings, documents)
• Plan a pilot group rather than licensing everyone at once
• Remove licences you’re paying for but not using

5. Rollout

Once access is under control, plan the Copilot rollout itself.

• A short usage policy: what Copilot is for, what not to paste in, who to ask
• Practical training for the pilot group, based on their real tasks
• A way to collect feedback and issues in the first month
• A review date to decide whether to expand

How long does this take?

For an organisation of 50 to 150 staff, the checks usually take a few weeks. Most of the time goes into sections 1 and 3, because access and ownership have drifted over years.

Can we do this ourselves?

Some of it, yes. The Microsoft 365 admin centres show sharing and site activity, and your IT team can help with access reports. Where most organisations get stuck is turning thousands of permissions into a short, prioritised list of what to fix.

That’s what Applecart’s readiness check does (see how we did it for Lincoln Institute). It’s fixed-price and covers sharing, permissions, storage, site sprawl and licences, with a plain-English report: what’s fine, what’s a risk and what to fix first. We work alongside your IT team, from Brisbane, with organisations across Australia.

See how the readiness check works