Entrazure
What we build
A readiness picture of your tenant. A SharePoint and OneDrive permission report showing what is shared with Everyone, Everyone Except External Users, and anonymous links. A scan for sensitive content in places it should not be. A licensing and prerequisite check. The output is a list of specific sites and libraries with named owners, not a maturity score.
Oversharing remediation. Broad-scope links removed or scoped, site access reviews run with the actual business owner, orphaned sites dispositioned, and default sharing settings changed so the problem stops regenerating. This is the phase that takes the longest and is the reason the deployment works.
Classification and protection. Microsoft Purview sensitivity labels with a label taxonomy short enough that people use it, auto-labelling policies for the categories that can be detected reliably, and DLP where the risk justifies it. Copilot respects labels, so labels are how you keep a document out of a generated answer.
Search scoping. Restricted SharePoint Search where remediation will take months, so a pilot can run against a curated allow-list of sites while the wider cleanup continues.
A measured pilot. A cohort of 25 to 50 users chosen across three or four roles, with a baseline captured before access is granted, weekly check-ins, and a defined set of tasks we are actually testing rather than a general impression of usefulness.
Agents where they earn their place. Copilot Studio declarative agents for the workflows that stay inside Microsoft 365 and Graph. Where the use case needs custom retrieval, model choice or evaluation, it belongs on Azure AI Foundry instead, and we say so before you build it in the wrong place.
Device and tenant hygiene. Intune compliance policies, conditional access covering the Copilot surface, and the Exchange and SharePoint governance that a readiness audit usually exposes as overdue.
What the audit usually finds
The pattern repeats across tenants. Sites shared with Everyone Except External Users because it was the fastest way to close an access complaint four years ago. Anonymous links with no expiry, created for a supplier who has since been replaced. Teams from a finished project, still holding the files and still open to the original membership. A OneDrive belonging to somebody who left, inherited by their manager and never reviewed. And in most tenants, at least one folder holding salary or contract data in a location nobody would think to look.
None of this is negligence. It is the residue of a decade of people helping each other quickly, and it was survivable while finding a document required knowing it already existed. Copilot removes that requirement. The exposure does not change, the discoverability does, and that is enough to change the risk profile overnight without anyone touching a permission.
How the engagement runs
Weeks 1 and 2, readiness assessment. Permission reporting, sensitive-data scan, licensing review, and a workshop to pick the three to five tasks the pilot will be measured on. You get a prioritized remediation backlog with an effort estimate against each item.
Weeks 3 and 4, remediation. Broad links removed, access reviews executed, sharing defaults tightened, sensitivity labels published and auto-labelling policies switched on in simulation first. Nothing is enforced before we have seen what it would have caught.
Week 5, pilot launch. Licenses assigned to the cohort, Restricted SharePoint Search scoped if needed, a one-hour practical session per role rather than a generic training deck, and a channel where people report what did not work.
Weeks 6 to 9, measurement. Usage telemetry, structured interviews at the midpoint and the end, and a running list of prompts that worked well enough to be shared as internal patterns.
Week 10, decision and scale. A written recommendation: expand, hold, or stop, with the evidence attached. If the answer is stop, we say stop. Then the governance model, the remediation backlog for the next wave, and handover to whoever runs the tenant.
What you keep
- The tenant permission report and the remediation backlog, with owners and status.
- A published sensitivity label taxonomy and the auto-labelling policies behind it.
- The pilot baseline and the measured result, in numbers, per task.
- A prompt library of the patterns that worked in your organization, by role.
- A written Copilot governance model: who gets a license, on what grounds, and what happens when someone leaves the pilot.
- The decision record for every Copilot Studio versus AI Foundry call we made.
Who this is for
Organizations between roughly 100 and 5,000 seats that have bought or are about to buy Microsoft 365 Copilot licenses and want the rollout to survive its first security review. It is particularly relevant where the tenant has been running for a decade, has absorbed a merger, or holds regulated data. Where residency and audit requirements apply, this work sits directly alongside compliance architecture, and in regulated sectors like healthcare the permission audit is the gate, not a formality.
Who this is not for
If you have fewer than about 50 users, a single SharePoint site and no sensitive content, you do not need an engagement to enable Copilot. Buy five licenses, try it for a month, and spend the consulting budget somewhere with a return.
If leadership has already decided Copilot will be deployed to everyone next month and does not want to hear about permissions, we are the wrong firm. We will not enable Copilot on a tenant we have not audited, because the first thing an employee searches for is payroll, and the answer arrives before anyone has time to react.
Related
- AI engineering on Azure AI Foundry: where the custom agents belong.
- Cybersecurity, Entra ID and zero trust: conditional access covering the Copilot surface.
- Compliance architecture: labels, retention and the evidence an auditor wants.
- All Azure services: where Copilot work sits in the wider estate.
Questions we get
Why can we not just turn Copilot on?
You can, and the license works immediately. The problem is that Copilot inherits each user's existing permissions and searches across everything they can reach. In most tenants that includes an HR folder shared with Everyone in 2019 and a finance workbook on someone's OneDrive. Copilot does not create the exposure, it makes it findable in one sentence of natural language.
How long does a readiness assessment take?
Two weeks for a tenant under roughly 1,000 users, including the SharePoint permission report, the sensitive-data scan and a prioritized remediation list with an effort estimate per item. Larger or heavily federated tenants take longer, and we say so before starting rather than midway.
What if remediation turns out to be huge?
Then we stage it. Restricted SharePoint Search lets you launch a pilot against a small allow-list of curated sites while the wider cleanup continues, so the program is not held hostage by a decade of accumulated permissions. We would rather run a narrow pilot that works than a broad one that has to be switched off.
Copilot Studio or Azure AI Foundry?
Copilot Studio when the use case lives inside Microsoft 365, the data is reachable through Graph, and the users are already in Teams. Azure AI Foundry when you need custom retrieval, models chosen per workload, evaluation harnesses, or grounding in systems Graph cannot see. We choose on the merits of the case and write down the reason, because the two have very different maintenance profiles.
How do we prove Copilot was worth the license cost?
We define the measurement before the pilot, not after. A baseline on three to five specific tasks, usage telemetry from the Microsoft 365 admin center and Viva Insights, and a short structured interview with the pilot cohort. If the number does not justify the renewal, that is a useful answer and we report it as one.
Do you handle the Microsoft 365 tenant work as well?
Yes. Exchange and SharePoint governance, Intune device compliance, and migration from Google Workspace or on-premise Exchange. Copilot readiness usually surfaces tenant hygiene issues that were always there, so the two pieces of work tend to arrive together.
Have a question about this work?
Three fields. An architect reads it and answers within one business day.