Sound familiar?
- We don’t know who can open the payroll folder, and we can’t find out today.
- Half our SharePoint is shared with “everyone in the organisation”.
- Links were sent to clients years ago and nobody knows if they still work.
- We bought Copilot licences and stopped, because nobody was sure it was safe.
- Staff are using ChatGPT on their own accounts and we’ve asked them not to.
- Our last provider gave us a verbal assurance and nothing in writing.
When two or more of these are true, it isn’t a Copilot problem. It’s a permissions problem that Copilot is about to make visible.
What actually goes wrong
Nothing exotic. Here’s the usual shape of it.
Someone shares a folder with everyone in 2019 because two people needed it and that was quickest. The two people move on. The folder stays. For six years that’s fine, because finding it would mean knowing it was there and guessing the name.
Then you turn on an assistant that answers questions in plain English, and the guessing stops being necessary.
The work
Four pieces. Most firms need the first two, and we’ll tell you if you don’t.
Mitigate Risk
A permissions audit, in writing
We go through SharePoint, OneDrive and Teams and produce a report: what’s shared with everyone, what’s shared outside the firm, what’s shared by a link that never expires, and which of it matters. You get the findings whether or not you ask us to fix them.
Mitigate Risk
The cleanup
Fixing what the audit found. Tightening sharing that shouldn’t exist, sorting out the sprawl, and labelling the material that needs labels so it stays sorted after we leave. Unglamorous, and it’s the part that protects you.
Mitigate Risk
Control over which AI tools get used
Deciding which AI tools your firm approves, then enforcing it on company devices rather than putting it in a policy and hoping. Detection without enforcement is half a job. This one depends on your Microsoft licensing: we check before we quote, and if it needs a licence change we say so up front, with the number.
Productive Workforce
Rollout and training
A pilot group first, then staged rollout. Not 40 seats on a Monday and a link to Microsoft’s help page. Then training one or two people per team as the person everyone else asks, with a follow-up at 30 days and role-based sessions using your own workflows.
Start with a 30-minute AI risk conversation
We’ll ask what your staff are using, what your policy says, and what’s worrying the partners. You’ll leave with a clear view of where your biggest AI risks sit, even if we don’t end up working together.
Book a timeWhy the training matters
Staff who can’t get help with a tool do one of two things. They stop using it, which shows up in your adoption numbers and reads as a failed rollout. Or they go back to the tool they weren’t supposed to use, because help felt easier there.
What works is training one or two people per team as the person everyone else asks. An hour with the leadership team on where AI is and isn’t appropriate is usually the most useful hour in the programme.
How it’s priced
Fixed price, quoted per project, sized by seat count and how complicated your tenant turns out to be. We quote from a discovery workshop rather than a sales call. Quoting remediation without having looked is how fixed-price projects lose money, and the client pays for that one way or another.
Who does the work
Permissions, labelling and tenant configuration are things this team does every week for clients who have never said the word AI. No new capability, no subcontractor, and you can ask them anything at any point.
Questions partners ask us
- Is Microsoft Copilot safe to use with client data?
- Inside your Microsoft 365 tenant your data isn’t used to train Microsoft’s models and it stays in your tenancy. The risk isn’t the model, it’s the permissions. Copilot surfaces anything the person asking can already reach, so the safety of it depends on whether your access controls match what you intended.
- How long does a Microsoft 365 permissions audit take?
- For a firm of 10 to 100 staff, usually a few days, and you get a written report. Remediation depends on what we find and is quoted separately, so you can decide what’s worth fixing.
- Can we just block ChatGPT?
- On company devices, yes, and plenty of firms do. It doesn’t touch the phone in someone’s pocket, which is why blocking works best alongside approving something staff are allowed to use. A ban with no alternative sends the work somewhere you can’t see it.
- We’re not doing Copilot. Is this still relevant?
- More so, often. The permissions and data work stands on its own, and if the assessment found data problems then nothing else is safe to build on top of them. Plenty of firms do this step and nothing else for a year.
- Do you need admin access to our tenant?
- For the audit, yes. We tell you exactly what level of access and why, and it’s revoked when the work finishes.
- Will this stop our staff using AI?
- No. It decides which tools they use and what those tools can reach. The aim is to make the approved path the easy one, because that’s the only version of this that holds.
Have the report run by someone else
If you’d rather we ran the permissions report than your current provider, that’s a few days of work and you get the findings in writing, whatever you decide to do about them.
