Guide · ai-adoption
Don't turn on Copilot yet
Long-form guide · PDF · 9 pages
A guide for the IT or compliance lead at an SMB who has Microsoft 365 Copilot licenses available — or is about to — and needs a defensible answer to what to do about content discovery, labeling, and oversharing before broad rollout.
Most SMBs treat the Copilot rollout question as a productivity decision. It isn't — it's an access-control decision. This guide walks through the seven sequenced steps of pre-Copilot work that determine whether a Microsoft 365 tenant produces useful Copilot answers or a board-level oversharing incident in month two.
Why sequencing matters more than the individual tasks
Most Microsoft partner guidance on Copilot readiness treats labeling, oversharing remediation, DLP, and retention as parallel tracks that can be worked simultaneously. They can't. The dependencies are real: labels applied before permissions are remediated end up enforcing DLP against a user population that shouldn't have had access in the first place; retention policies defined after Copilot is generating new content create a back-classification problem that's significantly harder than the forward-policy version. The order of operations is the difference between a deployment that holds up and one that creates exposure quietly for two years. Copilot inherits every permission gap, every overshared site, and every unlabeled HR spreadsheet in the tenant. Permission models that were quietly tolerable for a decade — because nobody actually went looking for things — stop being tolerable when an AI assistant goes looking on every prompt. The exposure isn't theoretical: in every Copilot readiness engagement NOVO has run on a tenant with more than 100 users, the discovery phase has surfaced at least one site containing content nobody intended to be readable by everyone with access to it.
What the guide covers
The full guide walks through the seven steps NOVO sequences in a Copilot readiness engagement: tenant access posture audit, oversharing remediation, sensitivity label taxonomy design, automated and manual labeling, Copilot-specific DLP configuration, retention policy definition, and staged departmental rollout. Each step covers the rationale, the typical findings in SMB tenants, the operational checks that verify completion, and where NOVO's recommendation differs from Microsoft's default guidance — including why we recommend four sensitivity labels instead of the standard five-to-seven and why we typically don't recommend Syntex for SMBs under 500 seats despite the common partner pitch. This is the work that makes Microsoft 365 Copilot deployable rather than dangerous. It happens before any user gets a Copilot license, in sequence rather than in parallel, and it doesn't end at go-live — content discipline is a continuous operational practice, not a project that closes.