The five stages between a Copilot licence and a result, and what an assessment turns up on the way.

Around half the AI tools in pilot or deployment across Australian organisations sit outside any formal governance framework. That’s ADAPT’s April 2026 reading of more than 200 ANZ data and technology leaders, who also reported that just 8% of Chief Data Officers consider their organisation optimised for AI data readiness.

Brennan ran a Copilot readiness assessment this year for a professional services firm that looked, by every obvious measure, ready. The platform side came back clean. Microsoft 365 adoption. Content centralisation. SharePoint architecture. User readiness. All strong.

Two domains came back weak: information classification and data governance.

Nothing was broken. The firm ran SharePoint as its primary content repository. By most measures, a well-run Microsoft estate.

The pattern was clear: strong platform, weak governance.

Under permissions and access, the assessment spells out the consequence:

Current sharing practices may allow users to discover information they can technically access but would not normally search for manually.

What the friction was hiding

Copilot honours every permission already set in Microsoft 365. It returns what a person is entitled to see and nothing more. Okay. So, where’s the fire, you ask?

A permission that’s technically wrong but normally harmless, because finding the file meant knowing a) it existed, and b) knowing roughly where it sat, stops being harmless the moment someone can ask AI a question in plain English.

As the assessment put it, Copilot amplifies existing permission issues rather than creating new ones. People will find things they didn't know they had access to.

That’s fixable. What follows runs in order. Get the foundations ready (Enable), put proportionate controls around them (Protect), decide where Copilot should go first (Direct), move it into real workflows (Apply), then let it run on its own (Automate).

We start with what’s already there. A permission review across SharePoint, OneDrive and Teams, looking for organisation-wide permissions, anonymous sharing links, and collaboration spaces open wider than intended. Then audit visibility: confirming the Unified Audit Log is capturing file access, sharing events and permission changes. That’s Enable.

Governance follows, sized to the rollout in front of you. Restricted Access Control on the sites that warrant it. A handful of sensitivity labels, five rather than fifty. And two or three Data Loss Prevention policies covering the content most likely to cause trouble. Purview does this natively, so the licensing is usually already paid for. That’s Protect.

Remediate, then widen the licence pool.

Knowing where to point it

Readiness work tells you what you can safely turn on. It says nothing about where Copilot should go first.

That’s the stage organisations skip. Microsoft’s 2026 Work Trend Index, drawing on 2,000 Australian full-time workers, found 28% say their organisation is clearly aligned on AI strategy and policies. More than half said it feels safer to focus on current goals than to rethink how the work gets done.

The same research analysed over 100,000 Copilot conversations and found 49% supported cognitive work: analysing information, solving problems, weighing options.

Roles built around judgment and analysis have more to gain here than roles built around turning out documents. That narrows the field before you’ve run a single workshop.

We run this as a one-week engagement. Workshops and structured analysis to identify, qualify, prioritise and justify candidate use cases against three tests: the business outcome, whether the data behind it is ready, and what governance it would need. Out of it comes a shortlist in priority order, each item with a recommended next step: a proof of concept, a pilot, or further investment. That’s Direct.

Then it narrows again. Broad experimentation gives way to specific roles and specific processes, where the result is measurable and the people doing the work can tell you whether it helped. The same research puts culture, manager support and talent practices at 67% of AI impact, against 32% for individual effort. Enablement does more work than most rollout plans allow for.

Start with one agent

Agent work starts as a proof of concept on a single use case, built in Copilot Studio against approved Microsoft 365 data sources. The brief stays deliberately narrow: validate the effort, the scope and the business value for that one case. The decision it feeds is three-way. Scale it, refine it, or stop. That’s Apply.

That third option is the one most programmes leave out. An agent programme that can’t end gets very expensive, very quietly.

Automate comes after, when those agents run on events rather than waiting for someone to ask.

Two things in your favour

Two things make this easier than it sounds.

The controls are mostly already paid for. Microsoft Purview handles sensitivity labels and Data Loss Prevention natively, so on the right licence tier the work is configuration rather than procurement.

And the order matters more than the pace. Permission review before labels, audit visibility before anything widens, labels before a bigger licence pool, use cases before any agent work. Organisations that jump straight to agents tend to arrive back at the permission review later, with more to unpick.

A Brennan Copilot Consult covers where you stand, which governance work comes first, and the use cases most likely to pay.

A shorter version of this article was originally published on iTnews, 17 October 2026.