Inhalt.
Microsoft 365 Copilot has been broadly available for a year, and yet many rollouts still fail. Not because the technology does not work, but because the prerequisites are not in place. Copilot indexes your entire SharePoint, OneDrive and Exchange estate. Every access mistake, every open permission, every misfiled copy of a contract becomes visible. Anyone who introduces Copilot without reviewing permissions first will learn very quickly what is not locked down in their own organisation.
This article describes how we run Copilot rollouts for our clients. The through-line is always the same: hygiene first, licence second.
Why the “just switch it on” approach does not work
Copilot has made visible how untidy many Microsoft 365 tenants are. The typical problems we see in the first week after activation:
- Salary data in the HR department is readable across the whole tenant. A SharePoint site was shared with “everyone in the organisation” for internal communication. Copilot finds it and shows the figures to any employee who asks.
- Old job applications sit in the personal OneDrive folder of an HR employee who has left. Copilot has access because the folder was shared with “everyone”.
- Confidential documents about live M&A transactions have landed in a Teams channel that was made public in the enthusiasm of a kick-off. Copilot serves summaries to the entire workforce.
- Client contracts under NDA are in a shared project folder still reachable by any external party through an old share link. Copilot chats produce accurate summaries, but the underlying data leak was already there.
None of this is caused by Copilot. It is made visible by Copilot. The good news: doing the hygiene work clears up old problems along the way. The bad news: it takes longer than the sales pitch for the licence suggests.
Our six-phase rollout
Phase 1: Access audit
Duration: one to two weeks, four to twelve person-days. We pull the permission data from the whole tenant: which SharePoint sites exist, who has access, which OneDrive shares are in place, which Teams channels are public or private, which guest users exist. For every site with sensitive content we check whether the access matches today’s actual need.
The findings go into a report with prioritised issues. In 90 percent of cases we find at least one site that has to be closed before Copilot is switched on.
Phase 2: Sensitivity labels and classification
Duration: two to four weeks, six to twenty person-days. We roll out Microsoft Purview sensitivity labels. Minimum set: public, internal, confidential, strictly confidential. Alongside that, policies for applying labels automatically based on content (credit card numbers, IBANs, specific key terms).
Purview labels govern more than Copilot behaviour - they also control encryption, external sharing and data export. That is the foundation for years to come, not just for Copilot.
Phase 3: Teams and SharePoint governance
Duration: in parallel with phase 2. We set governance rules: who may create new teams? How are channels named? How long does a team exist before it is archived? Without governance a tenant grows without limit, and the longer you wait the more Copilot has to search through.
Phase 4: Pilot group
Duration: four to six weeks, 15 to 25 workstations. We activate Copilot licences for a pilot group drawn from different departments. Importantly: not just early adopters and IT enthusiasts, but a cross-section from sales, marketing, finance, HR and project management.
The pilot serves two purposes. First, we check whether Copilot genuinely delivers the promised benefit (not always the case). Second, we identify use cases to show later in training.
Phase 5: Training concept
Duration: two to three weeks of preparation, then ongoing. From the pilot experience we build a training concept with role-specific sessions:
- General introduction (60 minutes): what Copilot can do, what it cannot, and what that means for prompt quality
- Role-specific sessions (45 minutes per role): sales, project management, HR, finance, management
- Prompt best practice workshop (90 minutes): concrete use cases with real documents from your own tenant
Training is not a one-off. We recommend follow-up sessions every three months covering new Copilot features and internal use cases.
Phase 6: Wider rollout
Duration: two to three weeks for licence assignment, then ongoing. Once the pilot and the training concept are in place, we roll licences out broadly. We recommend not doing a big-bang go-live but spreading it over two to three weeks in departmental blocks, so the support load is distributed.
Alongside the rollout we establish usage monitoring: who uses Copilot regularly, who received a licence and never activates it? Unused licences are expensive idleness, and we build active routines to reclaim them.
What the effort realistically costs
For a mid-market tenant with 50 to 150 workstations we budget:
- External consulting and implementation: 25 to 60 person-days over three to four months (from roughly 15,000 to 45,000 EUR net)
- Internal time: two to three days a week over the project period for the IT, data protection and communications contacts
- Ongoing support after rollout: one to two days a month for follow-up training, usage reviews and label maintenance
- Copilot licence cost: 28.10 EUR net per user per month for Microsoft 365 Copilot (as of Q1 2026)
The most common mistake we see: a company buys 100 Copilot licences, activates them immediately, and finds after three months that usage sits at 20 percent. That is 2,250 EUR net per month for unused licences. A structured rollout costs more once but saves the recurring cost.
When Copilot is not the right fit
Not every company needs Copilot. We have clients we advised against it:
- Very small teams (under 15 workstations) with little document volume: the investment in label governance is out of proportion.
- Organisations with a sprawling, untidy SharePoint landscape and no resource for the clean-up: introducing Copilot would amplify the mess rather than solve it.
- Sectors with strict compliance requirements (legal, health, financial supervision) that need their own governance layer: here a Mistral-based RAG approach is often a better fit than Copilot.
If you are unsure whether Copilot is the right tool for your organisation, we will help you decide. The first 30 minutes of an intro call are always free.