The Answer Is Only as Good as the Estate: A Five-Day Microsoft 365 Readiness Sprint for Workplace AI

Workplace AI assistants are often presented as a licensing decision: buy seats, switch on the feature, train a pilot group and measure the productivity gain. For UK small and medium-sized enterprises, that sequence is incomplete. The more important question is what the assistant will be allowed to read once it is switched on. Microsoft 365 Copilot and comparable tools draw on the content a user can already access across SharePoint, OneDrive, Teams, Outlook and other connected sources. They do not usually create new access rights, but they can make existing rights far more visible. A document that was quietly available to too many people becomes a sentence in an answer.

That is why a sensible rollout begins with information governance. Licensing, prompts and user training matter, but they sit downstream of permissions and content quality. The five-day sprint below is designed for a UK SME that is preparing a controlled pilot in 2026. It is not a full data cleanse and it is not legal advice. It is a practical pre-deployment routine to reduce obvious exposure and improve the usefulness of answers.

Why the governance work comes first

An AI assistant is only as good as the estate it can search. If a SharePoint site is shared with 'Everyone except external users', the assistant may be able to draw on it for any permitted user. If a Teams channel contains an old redundancy plan or a draft pricing model, that content may become part of the answer set. The risk is not that the AI is malicious; it is that it is obedient. It retrieves what the permissions allow and presents it in a helpful-looking summary.

Before discussing seat counts, therefore, the business should identify the pilot group, the business scenarios and the content sources those scenarios will touch. A finance pilot may need access to contracts and management accounts. An HR pilot may involve policies and case notes. A sales pilot may involve proposals and customer records. Each scenario carries a different information risk. The sprint should be scoped to those sources, not to the whole tenant at once.

Day one: define the pilot and assemble evidence

The first day is about narrowing the problem. Select one department or a small cross-functional group. Agree two or three realistic use cases, such as summarising meeting notes, finding policy answers or drafting a first-pass proposal. Record the data sources involved and the owner of each source. Without named owners, remediation stalls.

Use the Microsoft 365 admin centres and Purview to build a simple register. For each relevant SharePoint site and Teams workspace, record its purpose, owner, sensitivity, guest status, last activity date and sharing scope. This does not need to be elaborate. A spreadsheet is sufficient. The aim is to create an evidence base that the pilot group can act on, rather than a theoretical inventory that nobody maintains.

Day two: address oversharing in SharePoint and OneDrive

Oversharing is the most common pre-Copilot issue in small firms. It often arises from convenience: a site is shared broadly because a project team needed quick access, or a folder link is set to 'Anyone with the link' because an external supplier needed a document. Over time, the broad permission remains after the need has passed.

Review high-risk locations first: HR, finance, board papers, contracts and customer data. Check site permissions, unique permissions and sharing links. Pay attention to Microsoft 365 groups and security groups whose membership may have drifted. On OneDrive, review links that are open to the organisation or to anyone. Remediation should be proportionate. Replace broad groups with narrower ones, set sensible default sharing settings, apply link expiry where appropriate and remove links that are no longer needed. Communicate changes to affected teams so that collaboration does not suffer a sudden, unexplained interruption.

Day three: review Teams, channels and guest access

Teams is where much day-to-day knowledge now sits. It is also where stale content and guest access accumulate. Copilot can use Teams chats, channel conversations and shared files, so a dormant team is not necessarily harmless. It may still contain old decisions, customer details or draft communications.

List teams with guest accounts, identify guests who have not signed in for an extended period and confirm whether each external relationship is still active. Review shared channels and meeting recordings, particularly where transcripts may contain sensitive discussion. Archive or rename dormant teams so that users can see what is current. Check who can create teams and channels, and whether the organisation has a clear route for retiring workspaces. The objective is not to remove every guest or archive every old team; it is to ensure that the pilot group is not drawing answers from abandoned material.

Day four: reduce duplication and establish sources of truth

Answer quality depends heavily on content quality. If three versions of a policy exist in two sites and a Teams folder, the assistant may produce a confident summary that blends them. Users then lose trust in the tool, and the pilot appears to fail for reasons that are really information management failures.

Identify duplicated files, orphaned sites and libraries with no clear owner. Establish a source of truth for the documents that matter to the pilot: the current policy, the approved template, the active contract register. Move superseded material to an archive with clear labelling, and use version history rather than filename conventions such as 'final final v3'. Do not delete indiscriminately, especially where retention obligations apply. The goal is to make the current answer easier to find than the old one.

Day five: apply labels, set controls and start a limited pilot

On the final day, apply sensitivity labels to the highest-risk locations and retention labels to records that must be kept for a defined period. Where the organisation already has a classification scheme, use it rather than inventing a parallel one. Confirm that audit logging is enabled for the pilot, and decide how prompt and response feedback will be reviewed. Restrict the initial rollout to the pilot group, with a clear review date and a route for users to report questionable answers.

Give pilot users simple guidance: verify important answers, check the cited source, avoid pasting confidential material into prompts and report any answer that seems to reveal information they should not see. The pilot should be treated as a controlled change, not a free trial. After the sprint, record what was remediated, what remains outstanding and who owns each action. A short monthly review will do more for long-term safety than a one-off clean-up.

The licensing conversation can wait a little longer

None of this removes the need for a proper data protection assessment or a sensible licensing plan. It simply puts them in the right order. For a UK SME, the strongest foundation for workplace AI is an estate where access is intentional, content is current and retention is understood. Once those basics are in place, the assistant has a better chance of giving useful answers and a smaller chance of revealing something that should have been fixed before go-live.