Pioneer
Microsoft 365 ready for AI
An AI assistant in Microsoft 365 shows each person everything they’re allowed to open. In many tenants that’s far too much. So the permissions come first, and the assistant second.
The assistant sees what your people can see. That’s the problem.
Microsoft 365 Copilot and similar assistants answer from the mail, files and chats a person already has access to. They don’t open new doors; they walk through every door that’s open. In a tenant that grew over years, that includes the shared folder from the old office, the site everyone was added to for one project, the file a colleague shared with the whole firm by mistake. Switch an assistant on there and it will happily surface the payroll. So the doors are closed first: who can open what, what may be shared with whom, which data an AI tool may see at all, decided with you and written down. Then a small pilot, and only then the switch.
Before the switch
First the permissions. Then the assistant.
The order is the whole method. Each step is checked and on record before the next one starts, and nothing goes live before data protection and security are checked.
-
Who can open what, today
An access review of your tenant: every site, team and shared folder with who can reach it, and the files shared with the whole firm or with everyone who has the link. The result is the map of what an assistant would see.
-
Permissions by role
Files organised by matter, client or project, and access following the people working on it. Each person sees what their role needs, and the assistant sees no more than they do.
-
Sharing rules, written down
Who may share what with whom, inside the firm and outside it, decided with you and set in Microsoft 365. Links to everyone, by default, stop being the default.
-
Rules for AI
Which AI tools may see which data, and which may not see client data at all, decided with you and written down, so your firm can use AI without handing confidential work to a public AI tool. The legal assessment stays with you.
-
The data-protection check
Where the assistant processes your data and what it keeps, written down as facts for your data protection officer or adviser to assess. Nothing is switched on before that check is done.
-
A small pilot, then the decision
A few people, a fixed time, one question: does the assistant help with the work they actually do? At the end a decision with two outcomes: it becomes standard, documented and supported, or it’s switched off without leftovers.
On record
In the pilot protocol and the data-protection check.
- Who can open what, from the access review before the switch
- The sharing rules and the rules for AI, as decided and as set
- Where the assistant processes your data, for the data-protection assessment
- The pilot’s question, group, time box and decision
- What was switched on for whom, and what was switched off again
The same records answer a client’s security questionnaire and your insurer, because they ask the same question: who can see what.
What usually goes wrong with AI in Microsoft 365.
-
Licences first, permissions never
The assistant is bought and switched on in an afternoon, and the first surprising answer comes from a folder nobody remembered was open.
-
Rules nobody wrote down
Each person decides alone which AI tool gets which document. A client file ends up in a public AI tool, and the firm finds out when the client asks.
-
The pilot that never ends
A few enthusiasts keep their licences, nobody decides, and a year later nobody knows what the assistant may see or who has it.
Questions we get
Can you switch on Microsoft 365 Copilot for us?
Yes, once permissions and sharing are tidied, so it only shows people what they’re allowed to see. We start with a small pilot: a few people, a fixed time and one clear question. Then you decide.
How long does the tidying take?
It depends on how your tenant grew. The access review shows that in the first days; the clean-up that follows is what takes the time, and it’s work your firm needs whether an assistant comes or not. In a first call we look at your tenant as it is.
What about AI tools other than Microsoft’s?
The rules for AI cover them too: which tools may see which data, and which may not see client data at all. Where a tool processes your data and what it keeps is written down as facts for your data-protection assessment; the legal assessment stays with you.
What if the pilot shows it doesn’t help?
Then it’s switched off without leftovers: no forgotten licences, no stray access. The tidied permissions stay, and your firm is better protected than before the pilot.
Start
What would an assistant see in your tenant today?
In a first call we go through who can open what in your Microsoft 365, what an assistant would surface, and what has to be true before one is switched on.
- No first level
- No surprises
- Pilot before you buy