Microsoft 365 Copilot Readiness Checklist for Omaha Businesses

Last reviewed: September 26, 2026

Microsoft 365 Copilot can summarize a long email thread, draft a proposal from your notes, and pull together what happened in last week’s meetings. But it works by reading the same files, email and chats your people can already reach. If your file permissions are messy, Copilot will find the mess faster than anyone.

Here is what to check before you turn it on. One naming note: Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot, so you will see both names. It is the same product.

How Copilot decides what it can see

Microsoft is direct about this. Copilot “only surfaces organizational data to which individual users have at least view permissions.” It gets no special access. But it also never forgets where things are. A salary spreadsheet shared with the whole company years ago and then forgotten is now one question away.

Microsoft also says prompts, responses and data accessed through Microsoft Graph (the service that connects your email, files and calendar) are not used to train the foundation AI models behind Copilot. The bigger risk for most small businesses is not Microsoft. It is your own sharing settings.

1. Clean up file permissions and oversharing

This is the big one. Oversharing means files or sites are open to more people than need them. It usually hides in a few places:

• SharePoint sites shared with “Everyone except external users,” which means your entire company.
• “Anyone” links, which work for whoever has the link, inside or outside the company.
• Old OneDrive folders shared with a whole department and never cleaned up.
• Teams and SharePoint sites whose owner left the company.

Microsoft notes that by default, SharePoint sets sharing to the most permissive option. If nobody has changed those settings, assume they are wide open.

What to do about it

• Review sharing settings for SharePoint and OneDrive in the SharePoint admin center, and tighten the defaults.
• Use Microsoft’s data access governance reports, part of SharePoint Advanced Management (licensing varies by plan; we check yours), to find overshared sites and heavy use of “Anyone” links.
• Move HR, payroll, legal and owner-only files into sites where only the right group is a member.
• For sensitive sites that must stay open to certain people, Microsoft offers Restricted Content Discovery, which keeps a site out of Copilot and company-wide search without changing who can open it.
• Archive or remove old sites nobody owns.

2. Check licensing basics

Copilot is an add-on license. You buy it on top of an eligible Microsoft 365 plan. Microsoft’s current list for small businesses includes Microsoft 365 Business Basic, Business Standard and Business Premium, among others.

• Copilot Chat on the web, which answers from the internet, is included with an eligible Microsoft 365 subscription at no extra cost.
• Copilot that works with your company’s own email, files and chats needs the paid Copilot license.
• You assign licenses person by person, so you can start with a few people.

Plan names and prices change often, so check Microsoft’s current licensing page before you buy.

3. Turn on MFA for everyone

MFA (multifactor authentication) means signing in with a password plus a second proof, like a prompt on your phone. Copilot raises the stakes on every account: one stolen login now comes with an assistant that can search everything that person can see.

CISA says using MFA makes you 99% less likely to be hacked. Microsoft’s Copilot setup guide lists turning on MFA for all users as a step, and Microsoft’s free security defaults require every user to register for MFA.

4. Decide who gets Copilot first

Microsoft’s own rollout guidance starts with a pilot: give licenses to a small group, gather feedback, then expand. For a small business, good pilot users usually:

• Spend much of the day in email, meetings and documents.
• Like trying new things and will tell you honestly what works.
• Work in areas where the files are already in decent shape.

Be careful with the people who can see everything, like the owner or the office manager. They often get the most out of Copilot, but their broad access is also where oversharing shows up first. Clean up before you license them.

5. Train your team before and after

Copilot is not magic, and it is not always right. Microsoft says AI responses “aren’t guaranteed to be 100% factual.” Short, practical training should cover:

• How to ask good questions (prompts) with enough context.
• Checking facts, names and numbers before anything goes out.
• What your written AI use policy allows.
• How to report a file that showed up where it should not have. Every surprise is a permission to fix.

Your Copilot readiness checklist

☐ SharePoint and OneDrive sharing settings reviewed and tightened

☐ Overshared sites and “Anyone” links found and fixed

☐ Sensitive files moved into sites with the right members only

☐ Eligible Microsoft 365 plan confirmed, and Copilot licenses bought for the pilot group

☐ MFA turned on for every user

☐ Pilot group picked

☐ AI use policy written and shared

☐ Training scheduled, with a date to review pilot feedback

Frequently asked questions

Will Copilot let employees see files they should not?

Copilot only shows people what they already have permission to open. The catch is that many businesses have given more access than they realize, and Copilot makes it easy to find. That is why the cleanup comes first.

Does Microsoft use our data to train Copilot?

Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models Copilot uses.

Do we need to license everyone at once?

No. Licenses are assigned per person, and Microsoft recommends starting with a small pilot group.

Can Cambium help with the cleanup?

Yes. Microsoft 365 cleanup is everyday work in our managed IT services, and MFA is part of our cybersecurity work.

Want a hand getting ready? Our Microsoft Copilot Readiness project is built for offices of up to 25 people, and we quote larger offices to fit. We review who can open what across SharePoint, OneDrive and Teams, clean up the riskiest oversharing, check MFA and your licensing, then set up and train a small pilot group before Copilot starts searching your files. It’s a fixed price, quoted after a short call, and usually takes three to four weeks.

The project is part of our Microsoft Copilot consulting in Omaha, along with AI use policy writing.

Not sure where to start? Talk to us at (402) 514-3200 or through our contact page, and we’ll tell you honestly whether you need either one.

See it working before you decide

We will show you our own AI employees at work, with private details hidden, and answer your questions about Copilot.

or call (402) 514-3200.

Cambium Data is a Navy veteran-owned managed IT company at 6542 S 118th St, Omaha, NE 68137, serving the Omaha metro since 2009. Owner Tony Underwood has over three decades of experience in IT.