Data access review before Copilot
Know what Copilot will find first.
Copilot answers from everything a user can already open. In ten business days I read who can open what in SharePoint, OneDrive and Teams, limit discovery of the sites that should not feed answers, and hand you a go or no-go recommendation for the pilot group.
- 0How many Copilot licences are assigned
- 1.1Web search in Copilot
- 1.2Flex routing
- 1.3AI providers operating as Microsoft subprocessors
- 1.4Agent access and agent sharing
- 2.1Tenant sharing posture
- 2.2The default sharing link
- 3Sensitivity labels
- 4.1Audit retention for the Copilot workload
- 4.3Teams meeting transcription
- For
- An owner or IT lead of a firm whose tenant has up to 300 users, where leadership wants Copilot this quarter.
- Length
- Ten business days from the day access is granted.
- Who does it
- Michal Jatczak, directly. Nobody else touches your tenant.
- After the call
- A written scope and a fixed price before any work starts.
You leave with
Sharing and permission findings, by site
Sites, libraries and Teams open to everyone in the company, shared by anonymous link or shared with guests, each with its owner and the fix it needs.
The sites to hold back from Copilot
High-risk sites are put under Restricted Content Discovery, where your licences include it. This limits their discovery in organisation-wide search and Copilot answers while they are cleaned up. Permissions do not change, and users no longer see the Copilot button on those sites. It works on SharePoint sites, not on OneDrive. You get the list of what was set and how to undo it.
A starting set of labels and DLP rules
Sensitivity labels and data loss prevention rules within the licences you already hold, set up on a pilot scope first.
A go or no-go recommendation for the pilot group
Who can start with Copilot now, who waits, and the reason for each, on one page you can show your board or an auditor. It is my recommendation; the go or no-go call is yours. It is not a certification.
A 30-day cleanup list
Every finding left open, with its owner and its order, so the cleanup can run without me. This list and the list of what was set, with how to undo it, go into the Exit Kit that closes the review.
How it runs
Days 1 to 2: access and inventory
You grant the roles listed in the scope. On day one I start the site permissions report across SharePoint and OneDrive (the first one in a tenant takes up to five days). I also read the sharing reports, which cover the last 28 days and the sites most active in that time, or what the scope names in their place where your licences do not include them.
Days 3 to 5: findings
Open sites, anonymous links, guest access and grants to "Everyone except external users", sorted by what Copilot would surface first.
Days 6 to 8: hold back and label
After your sign-off, the riskiest sites go under Restricted Content Discovery and a starting set of labels and DLP rules goes onto the pilot scope. On a site with more than 500,000 items Microsoft can take more than a week to apply the setting, so the effect may land after this stage.
Days 9 to 10: decision
The go or no-go recommendation for the pilot group and the 30-day cleanup list, walked through with you in one call.
What is not included
The cleanup itself
The review finds and orders the work. Fixing up to 25 sites after it is a separate sprint, quoted on the review findings.
Copilot licences
The review does not include a licence. If you buy Copilot through me, it comes through Pax8 on its own line.
Agents, prompts and training
Building Copilot agents, prompt libraries or staff training is not part of the review.
Legal advice
The review says what was found and set, and it is not legal advice. Whether your data handling meets the GDPR or your regulator's rules is for your organisation to assess, with your lawyer or data protection officer.
Check it before you book
The free AI readiness scan asks the questions this review answers in the tenant, and returns a score you can bring to the call.
Microsoft documents the SharePoint Advanced Management controls available once a Copilot licence is assigned on a listed base plan, among them the data access governance reports and Restricted Content Discovery this review uses.
Pricing
Fixed in writing before any work starts, from a 30-minute call. The price depends on the rows below.
- Scope
- One tenant, up to 300 users, 10 business days.
- What changes the price
- Inside the scope the review price is fixed. More than 300 users or a second tenant is quoted separately. The cleanup sprint is priced from the findings.
- Copilot licences
Copilot Business is bought for a year, for tenants up to 300 users. Since 1 July 2026 Microsoft also sells Microsoft 365 Business Standard with Copilot and Business Premium with Copilot as permanent editions; before the renewal date, compare them with the two licences bought apart.
- Currency
- EUR, excluding VAT.
- VAT
- Reverse charge for EU businesses outside Malta whose VAT number validates in VIES. Malta VAT otherwise.
- Invoiced by
- Michal Jatczak, sole trader registered in Malta.
- Service level
- No SLA and no on-call duty. Dates are written into the Statement of Work.
Questions
Do we have to buy Copilot from you?
No. The review stands on its own. If you buy the licences through me, they come through Pax8 on the same invoice as any other Microsoft licence.
What access do you need?
The roles listed in the scope you sign, granted for the review only. When the work ends I stop using them and end the GDAP relationship, or ask you to disable the account, within the time the scope sets. Reading the reports changes nothing. Restricted Content Discovery, labels and DLP rules are set only after you sign them off.
Which licences does the review need?
The reports and Restricted Content Discovery are SharePoint Advanced Management features. Microsoft makes them available when at least one user has a Copilot licence assigned and the base plan is one Microsoft lists, such as Microsoft 365 E3 or E5; Business Premium is not on that list, and I confirm your licences on the scoping call. On such a plan one assigned licence is enough, and you can buy the licences for the whole pilot group after the review. If no Copilot licence is assigned yet, the scope names what the review uses instead, such as SharePoint Advanced Management bought separately or a pilot licence, and Restricted Content Discovery waits for an assigned licence. Labels and DLP rules are set up within what your Microsoft 365 plan already includes; the scope names any gap before work starts.
What if the recommendation is no-go?
Then you know before you buy licences for the pilot group. You keep the cleanup list, and the pilot can start once the items marked as blocking are closed, by your team or in the cleanup sprint.
How is this different from the free scan?
The scan asks you questions. The review reads your tenant, site by site, and sets the first controls.
Find the open doors before Copilot walks through them.
A 30-minute call sets the scope. The review starts when you grant access.
Every consulting engagement ends with an Exit Kit.