Copilot Readiness · Case Study · 2026

Preparing the Organisation Before Copilot Deployment

How permissions, information hygiene and workforce readiness can be addressed before enterprise AI access is expanded across teams.

Read Case Study

Client Context

A successful Copilot pilot created pressure to roll out fast. Readiness hadn't kept pace with enthusiasm.

The client is a mid-sized UK engineering and manufacturing group operating from several sites, formed in part through the merger of two smaller engineering firms over the past decade. A three-month pilot of Microsoft 365 Copilot, run with a small group across project management and finance, had gone well: faster report drafting, quicker meeting summaries, less time spent hunting for information buried in old project folders. Leadership wanted to extend licences across the wider organisation, including engineering and design teams, within the quarter.

Before approving that expansion, the IT director asked a question the pilot hadn't needed to answer: did the organisation actually know who could see what across its Microsoft 365 environment, built up over two mergers and more than a decade of ad hoc SharePoint sites, shared drives and Teams channels? Nobody could give a confident answer.

That instinct was well founded. Independent research analysing over 550 million enterprise data records found that, on average, 16% of an organisation's business-critical data is overshared, equivalent to roughly 802,000 files at risk per organisation, and a separate industry survey of 1,000 real-world IT environments found that 99% of organisations have sensitive data exposed in a way AI tools can surface. Microsoft's own documentation is explicit on this point: Copilot works within a user's existing Microsoft 365 permissions, which means it does not create new access risks so much as it makes existing ones visible, all at once, to far more people.

This case study sets out how INTAI helped the client get its permissions, information hygiene and workforce readiness in order before expanding Copilot access, rather than after. Client details have been anonymised and adapted to protect confidentiality; the substance reflects the engagement approach INTAI applies when organisations prepare for enterprise AI copilot deployment.

01 · The Productivity Case Nobody Disputed

A good pilot creates its own momentum, and its own blind spot.

The pilot group's experience was genuinely positive, and nobody involved was wrong to want it extended. Report drafting was faster, meeting actions were captured more reliably, and staff spent less time reconstructing information that already existed somewhere in the organisation's files. That is precisely the kind of outcome Copilot is designed to deliver, and precisely why organisations move quickly from pilot to wider rollout.

The pilot group, by design, was small and worked mostly with well-organised, recently created project data. It had not tested what would happen once Copilot could see everything a much larger, more varied set of users already had access to, including files, sites and channels going back years, inherited from systems that predated the group's two mergers and had never been fully rationalised.

Scaling a pilot's success without examining what changes at scale is one of the most common ways Copilot rollouts create problems nobody intended.

02 · What "Ready" Actually Means for Copilot

Copilot doesn't create a new access problem. It surfaces the one you already have.

Microsoft's own guidance for organisations preparing to deploy Copilot is direct about this: the tool works entirely within a user's existing permissions in services such as SharePoint, OneDrive and Teams, and it is up to the organisation to ensure the right people have the right access to the right content before Copilot is switched on. A user who could technically browse to an overshared file before Copilot existed could always find it, Copilot simply makes it far easier, faster and more likely that they will, often by summarising or surfacing it directly in response to an unrelated question.

Independent research reinforces how widespread this gap tends to be. Analysis of 550 million enterprise data records found that 83% of at-risk overshared files were shared with users or groups inside the company rather than externally, and that over 90% of business-critical documents are shared more broadly than the organisation's own leadership team. Separately, a survey of 1,000 IT environments found that only 1 in 10 companies had properly labelled their files, the classification metadata that tools like Microsoft Purview rely on to enforce sensitivity controls. Where labelling is missing, enforcement has nothing to act on, and Copilot serves the content up regardless.

None of this is a criticism of Copilot as a product. It is a description of what "readiness" has to mean in practice: knowing what your organisation's data estate actually looks like before you point a powerful search-and-summarise tool at all of it, all at once.

03 · A Decade of Sprawl, Surfaced All at Once

The permissions audit found exactly the pattern the research predicted.

INTAI's audit of the client's Microsoft 365 environment found SharePoint sites still carrying "everyone in the organisation" access years after the project or team they were created for had disbanded. It found broken permission inheritance, where a subfolder containing commercially sensitive tender pricing was more widely accessible than the restricted library it sat inside. And it found, echoing the two mergers in the group's history, entire legacy site collections from an acquired business where nobody currently at the organisation was confident who should still have access, because the people who had originally set the permissions had long since left.

Design and engineering data carried a particular version of this risk. Unreleased product specifications, tender-stage cost models and early-stage patent-adjacent design notes were sitting in project folders with organisation-wide read access, precisely the kind of intellectual property exposure that independent research has flagged as a recurring pattern once an AI assistant is layered on top of unreviewed R&D file shares. None of this data had been deliberately leaked or mishandled. It had simply accumulated, folder by folder, project by project, without anyone owning the job of periodically checking whether access still matched need.

None of it had caused a problem before, because finding it required knowing where to look. Copilot was about to remove that barrier for every licensed user in the organisation.

The Wider Pattern

Permissions, information hygiene and workforce readiness are lagging behind Copilot adoption almost everywhere.

Independent research on enterprise data exposure and UK workforce AI training points to the same three gaps this case study addresses.

Organisations With Sensitive Data Exposed to AI

Of 1,000 real-world IT environments studied had sensitive data exposed in a way AI tools like Copilot can surface.

Varonis, 2025 State of Data Security Report

Business-Critical Data Overshared on Average

Of an organisation's business-critical data is overshared, equivalent to roughly 802,000 files at risk on average.

Concentric AI, Data Risk Report

UK Workers With No AI Training in the Past Year

Of people at work in the UK have had no AI training in the past 12 months, according to government-cited research.

DSIT / Ipsos, cited in UK Parliament, April 2026

Together, these figures describe the three readiness gaps organisations most often discover only after Copilot has already gone live.

04 · Fixing the Foundation Before Expanding Access

INTAI treated the permissions audit as the deployment's real starting point.

Rather than pausing the rollout indefinitely, INTAI worked with the client's IT team to sequence the work: prioritising the highest-risk exposures first, using Microsoft's own published guidance for configuring a secure and governed data foundation for Copilot as the structural checklist, rather than building a bespoke framework from scratch. Legacy site collections with unclear ownership were locked down pending review. "Everyone" access on active sites was replaced with named groups reflecting who actually needed the content for their role. The two merged legacy environments were reconciled against a single, current access model rather than left to run in parallel indefinitely.

A labelling programme addressed the deeper issue behind the access problem: with only 1 in 10 organisations in the wider research having properly labelled files, sensitivity classification was treated as a prerequisite for rollout, not a nice-to-have to fix later. Design and engineering data, in particular, was reviewed and reclassified so that unreleased specifications and tender pricing carried labels Copilot and Microsoft Purview could actually act on.

With Microsoft's own agentic Copilot capabilities expanding, INTAI also mapped the client's rollout plan against the UK National Cyber Security Centre's May 2026 guidance on securing agentic AI, which calls for least-privilege access, named accountable owners, and monitoring built in from the outset, treating any future move from Copilot as an assistant to Copilot agents acting autonomously as a governed decision, not a default upgrade.

05 · Building Workforce Readiness Alongside Access

Fixing permissions solves half the problem. People still have to know how to use what they're given.

Against a national backdrop where 84% of UK workers have had no AI training in the past 12 months, the client's own pre-rollout survey found a similar gap: most staff outside the original pilot group had never used Copilot or an equivalent tool, and had no practical sense of what it should and shouldn't be trusted with. Separate workforce research has found a wide perception gap on this exact point, most managers believe their teams are set up for success with AI, while a much smaller share of employees feel they actually have the skills to use it effectively.

INTAI built role-based readiness training rather than a single generic session: engineering and design staff were trained specifically on what Copilot could see across project files and what "don't assume it's private just because it's hard to find" means in practice; finance and project management staff, who had already used the tool in pilot, received a lighter refresher focused on verifying AI-drafted outputs before they went to clients or into tender submissions. A small network of departmental AI champions gave staff a first point of contact for questions, rather than leaving readiness entirely to a one-off training session before go-live.

Crucially, the client measured actual staff confidence and usage patterns after rollout rather than assuming training had closed the gap, directly addressing the perception gap the wider research identified between what leadership assumes about readiness and what employees actually report.

06 · What This Means for Other Organisations Preparing for Copilot

The lessons here apply to any organisation moving from a Copilot pilot to a wider rollout.

A successful pilot tells you less than it feels like it does. Small pilot groups working with recent, well-organised data rarely encounter the legacy permissions sprawl that a full-scale rollout will expose within days.

Audit access before you expand it. With 99% of organisations in independent research carrying some form of AI-exposed sensitive data, and 16% of business-critical data overshared on average, assume the gap exists and look for it rather than waiting for it to surface itself.

Labelling is the foundation, not an add-on. Tools like Microsoft Purview can only enforce policy against data that has been classified, and with only 1 in 10 organisations in the wider research having properly labelled files, that foundation is usually missing.

Mergers and legacy systems carry disproportionate risk. Old site collections, unreconciled access models and departed staff's abandoned permissions are exactly where sprawl accumulates fastest and gets checked least.

Training has to match the readiness gap, not the rollout timeline. With 84% of UK workers untrained on AI in the past year, and a documented perception gap between what managers assume and what staff report, generic one-off sessions before go-live rarely close the distance on their own.

Conclusion

Readiness is what turns a promising pilot into a rollout the organisation doesn't come to regret.

The client's Copilot rollout proceeded roughly on the timeline leadership originally wanted, but sequenced so that permissions, labelling and workforce training were addressed as the deployment's foundation, not as a parallel project that could be finished later. The pilot's productivity gains were real and the wider rollout has broadly delivered them, without the wave of oversharing incidents that unaudited deployments of this kind commonly produce.

None of the underlying problems were unusual. Legacy permissions sprawl, unlabelled sensitive data and undertrained staff are close to the industry norm, not a sign of a poorly run organisation, which is exactly why they are worth checking for deliberately rather than assuming they don't apply.

For any organisation moving from a Copilot pilot to a full rollout, the question isn't whether the tool will find something it shouldn't. With research suggesting the underlying exposure exists almost everywhere, it's whether the organisation looked first.

References & Sources

Research, official guidance and workforce data informing this case study.

This case study draws on independent industry research, official Microsoft and UK government/NCSC publications, and workforce survey data. Statistics are attributed to their originating source wherever directly cited.

Varonis. 2025 State of Data Security Report: Quantifying AI's Impact on Data Risk.

Referenced for the finding that 99% of organisations analysed have sensitive data exposed in a way AI tools can surface, and related findings on unlabelled and stale-permissioned data.

View source

Concentric AI. 2026 Microsoft Copilot Security Concerns Explained, Data Risk Report Findings.

Referenced for the finding that 16% of business-critical data is overshared on average, equivalent to roughly 802,000 files at risk per organisation, and related oversharing statistics.

View source

Microsoft. Configure a Secure and Governed Foundation for Microsoft 365 Copilot. Microsoft Learn.

Referenced for official Microsoft guidance on permissions, governance and data readiness steps organisations should complete before and during Copilot deployment.

View source

National Cyber Security Centre. Guidance on Securing Agentic AI Use. May 2026.

Referenced for UK and Five Eyes joint guidance on least-privilege access, named accountable owners and monitoring for AI agents, applied here to the client's future Copilot agent roadmap.

View source

UK Parliament / DSIT. Artificial Intelligence: Impact on Employment, Hansard, House of Lords. April 2026.

Referenced for the government-cited finding that 84% of people at work in the UK have had no AI training in the past 12 months.

View source

Skillsoft. Workforce Readiness Report: AI Edition. 2026.

Referenced for survey findings that only 24% of employees feel fully equipped to use AI effectively, against a 53-point perception gap between managers and employees on workforce AI readiness.

View source

This case study reflects INTAI's engagement approach with organisations preparing their permissions, information hygiene and workforce readiness before expanding Microsoft 365 Copilot access. Client details, including the specific organisation and circumstances, have been anonymised and adapted to protect confidentiality, and any figures describing this specific engagement are illustrative rather than reported client metrics. External statistics, research findings and official guidance referenced in this case study are drawn from publicly available industry and government sources and are not connected to the anonymised client described elsewhere, and reflect the reporting periods of those source publications. This case study is provided for general informational purposes and does not constitute legal or technical advice.

Scroll