Checklist: rolling out Microsoft 365 Copilot safely
For: IT management and Microsoft 365 owners
Updated: 2026-11
Copilot is rolled out safely in seven steps: clean up sharing and permissions, classify confidential data, set data loss rules, issue a usage policy, start with a pilot group and clear use cases, train users to check outputs and measure the benefit before expanding.
Microsoft 365 Copilot accesses all content a user is permitted to see. Every overly broad share thus becomes a risk that was previously invisible.
This checklist covers preparation and the first rollout phase. Rules for the environment as a whole are in the Microsoft 365 governance checklist.
The checklist
- 01
Clean up sharing
Analyse and correct shares with all employees, anonymous links and sites with confidential content.
Done when: A report shows no sites with confidential content shared with everyone.
- 02
Classify confidential data
Define confidentiality levels and apply them to the main repositories and document types.
Done when: Levels are defined and applied to HR, finance and client mandate repositories.
- 03
Set data loss rules
Define rules preventing strictly confidential content from being shared uncontrolled.
Done when: Rules run at least in audit mode and hits are analysed.
- 04
Issue a usage policy
Define what Copilot is used for, which data is off-limits and where outputs must be checked.
Done when: The policy is approved and known to users.
- 05
Start with a pilot group
Select a small group with clear use cases and non-critical data.
Done when: Pilot group, use cases and metrics are defined.
- 06
Train
Train users on good prompts, checking outputs and the usage policy.
Done when: All pilot users completed training; evidence is documented for AI literacy.
- 07
Measure benefit and decide
Compare time and quality before and after rollout and decide on expansion.
Done when: An evaluation with a recommendation on expansion is with management.
Common mistakes
- —Rolling out Copilot broadly before sharing is cleaned up.
- —Defining no use cases and never measuring the benefit.
- —Copying outputs unchecked into documents and decisions.
- —Treating training as optional although AI literacy should be documented.
What this checklist does not cover
- —The checklist does not replace a data protection review of specific use cases.
- —Licences determine which classification and data loss prevention tools are available.
- —Copilot features and names change constantly.
Parent service: IT Consulting
Matching offers
Rolling out Microsoft 365 Copilot
We support the rollout of Microsoft 365 Copilot from preparation to the decision on broad use: cleanup of critical sharing, data classification and data loss rules with your IT, a usage policy, a pilot group with clear use cases, training and an evaluation of the benefit.
Microsoft 365 governance
We develop a governance concept for Microsoft 365: who may create teams and sites, how they are named, classified and archived, how guest access works, which retention and sensitivity rules apply and how Power Automate and Power Apps grow under control. With roles, policies and an implementation plan for your IT.
FAQ
How long does preparation take?
It depends on the environment. Tidy environments need a few weeks; grown sharing takes considerably longer.
Must every site be classified?
No. Repositories with confidential data matter most; the rest can follow gradually.
Who should be in the pilot group?
People with recurring tasks where Copilot measurably saves time and who are willing to give feedback.
More checklists
Checklist: does NIS2 apply to a Swiss company?
Whether NIS2 affects a Swiss company is clarified in seven steps: list EU entities, check their sectors and size, identify digital services in the EU, collect supply chain requirements from EU customers, map reporting duties, assign responsibility and document the result.
Checklist: carrying out a data protection impact assessment
A data protection impact assessment is produced in seven steps: check whether a high risk exists, describe the planned processing, assess risks to data subjects, define measures, judge the residual risk, consult the FDPIC or the data protection adviser if a high residual risk remains, and retain and update the assessment.
Checklist: reviewing a privacy notice under the FADP and GDPR
A privacy notice is reviewed in seven steps: controller and contact, purposes of processing, data categories, recipients and processors, transfers abroad with safeguards, data subject rights and currency against the services actually used. Anyone also targeting people in the EU adds the additional GDPR information.