Australian Microsoft 365 Copilot deployments accumulate metrics quickly. Within the first 90 days, the Microsoft 365 admin centre, Viva Insights, Microsoft Purview, and Copilot Chat itself all produce signal. The risk is not absence of data — it is selecting a KPI set that survives the first board review without becoming either a productivity slogan or a compliance ledger. This how-to walks through the five KPIs that survive the first 90 days in an Australian tenant.
Why a five-KPI set is the right size
Microsoft's Copilot adoption guide, refreshed in March 2026, structures measurement around three lenses — usage signals, sentiment signals, and outcome signals — drawn from the Microsoft 365 admin centre, Viva Insights, and pilot survey instruments. Australian organisations add a fourth lens, governance signals from Microsoft Purview, because Australian Privacy Principle 11 obligations now sit alongside productivity outcomes for any tenant processing personal information through Copilot.
Five KPIs is the right size for a 90-day measurement set because it forces a single-page board report and prevents the dashboard sprawl that kills pilot governance after week six. The five KPIs below appear in every defensible Australian pilot review.
KPI one: weekly active Copilot users by cohort
The single most important signal in the first 90 days is whether the assigned cohort is actually using Copilot. Microsoft Learn defines a weekly active Copilot user as a user who issued at least one Copilot prompt in Word, Excel, PowerPoint, Outlook, Teams, or Copilot Chat in the last seven days, and surfaces this metric in the Microsoft 365 admin centre Copilot usage report.
A healthy pilot cohort sees 60 to 80 percent weekly active Copilot use by day 30, rising to 80 to 90 percent by day 60. The denominator is the assigned licence count, not the whole organisation. Tracking against the whole tenant produces a misleading low number and obscures the actual pilot performance. Rates below 40 percent at day 30 indicate change management or training gaps rather than technology gaps; the practitioner response is to re-enable champions, not to escalate licensing.
KPI two: sensitivity label coverage of Copilot-touched documents
The second KPI is governance, not productivity. Microsoft Purview content explorer reports the proportion of documents in scope of Copilot that carry a sensitivity label. Microsoft Learn is explicit that sensitivity labels are how Microsoft 365 Copilot enforces information rights at response time; unlabelled content is treated as fully accessible to the prompting user.
A 90-day target for Australian tenants is 80 percent sensitivity-label coverage across the SharePoint, OneDrive, and Teams locations in scope for the Copilot pilot. The number is harder to move than weekly active users, but it is the single number that defends an Office of the Australian Information Commissioner enquiry about how Copilot avoids surfacing sensitive content. Auto-labelling policies for HR, finance, and legal libraries are the practitioner mechanism for moving this number.
KPI three: audit log review status and findings
The third KPI is the audit log review cadence itself, reported as status rather than volume. Microsoft Purview surfaces Copilot prompt and response events in the unified audit log under the AICopilot workload, with events including AICopilotInteraction and AICopilotPromptViewed. Australian Privacy Principle 11 requires reasonable steps to protect personal information; a documented weekly review with a named owner and minuted findings is the practitioner answer to what reasonable steps means in a Copilot tenant.
The board report should show two values: whether the weekly review took place (yes or no for the last four weeks) and whether any findings warranted escalation. An audit log that is never reviewed does not satisfy reasonable-steps tests under the Privacy Act 1988 (OAIC — Privacy Act overview, accessed 16 June 2026) or sector regulators such as APRA.
KPI four: DLP rule matches in the Microsoft 365 Copilot location
The fourth KPI is the count of Data Loss Prevention rule matches in the Microsoft 365 Copilot location, available since Microsoft Purview introduced Copilot as a DLP target in late 2024. According to Microsoft Learn, the Copilot location lets organisations apply DLP policies to prompts and responses, blocking or warning when sensitive information types appear.
For Australian tenants, the count itself is less important than the trend. A rising DLP match count in weeks two and three of the pilot indicates that users are exploring the boundary of acceptable use; a falling count in weeks five and six indicates that the boundary is learned. A flat zero count for the entire 90 days usually indicates that DLP policies are not deployed against the Copilot location, not that prompts are uniformly compliant.
KPI five: pilot satisfaction score
The fifth KPI is sentiment. Microsoft's adoption guide recommends a short pulse survey at days 14, 30, 60, and 90, with three to five questions covering perceived value, ease of use, and likelihood to recommend Copilot to a colleague. The headline metric is a net promoter score for the pilot cohort, reported with the underlying sample size.
Pilot satisfaction is the KPI that anchors the executive narrative. A net promoter score above 30 with sample size above 100 is a defensible pilot outcome for an Australian board. Below zero at day 60, with multiple cohorts, indicates the pilot needs to be paused for change-management remediation before broader rollout.
What does not belong in the 90-day KPI set
Three metrics commonly appear in early-stage Copilot dashboards but should not survive the first board review. First, prompt count without normalisation: a tenant that issues a million prompts has not necessarily achieved better outcomes than one that issues a hundred thousand. Second, feature-level adoption broken down by Word, Excel, PowerPoint, Outlook, and Teams: useful for the practitioner team, too granular for executive reporting. Third, hours saved per user: Microsoft's own published numbers exist but should not be reported as an organisational outcome without an internal time-and-motion study to validate the multiplier in the local context.
Wave 3 features — Researcher, Analyst, and Work IQ — also do not belong in the 90-day KPI set until a written governance posture is in place. Researcher and Analyst are independently controllable in the Microsoft 365 admin centre per user and per group. Work IQ requires an employee disclosure under Australian Privacy Principles 1, 3, and 5. Adding Wave 3 to the KPI set before the governance work is signed off creates reporting exposure rather than insight.
The single-page Australian board report
The five KPIs above fit on a single page. The format that survives Australian board scrutiny is two rows of metrics, one row of narrative. Top row: weekly active users by cohort, sensitivity label coverage percentage, DLP match trend. Middle row: audit log review status (yes or no, last four weeks), pilot satisfaction net promoter score, sample size. Bottom row: a 60-word narrative summary of the week, including any items that warrant board attention.
Australian board reporting standards under APRA CPS 230 and CPS 234 in the financial services sector, and the Protective Security Policy Framework for Commonwealth agencies, both expect this kind of governance narrative alongside the productivity numbers. The single-page report serves both audiences without selecting between them.
Australian context and compliance
The combination of the amended Privacy Act 1988, the Office of the Australian Information Commissioner's published Australian Privacy Principles guidelines (OAIC — Australian Privacy Principles guidelines, accessed 16 June 2026), and the ACSC Information Security Manual (ACSC — Information Security Manual, accessed 16 June 2026) creates a measurement obligation that goes beyond Microsoft's adoption guide. Australian organisations cannot rely solely on the Microsoft 365 admin centre Copilot usage report for board reporting; the governance KPIs from Microsoft Purview are non-negotiable.
The Privacy Act 2026 amendments also removed the small business exemption that previously excluded organisations under AUD $3 million turnover. The KPI set in this how-to applies regardless of organisation size, although the cadence may relax from weekly to fortnightly for smaller pilots.
Call to action
These KPIs are the adoption pillar of a larger programme. The Microsoft 365 Copilot Wave 3 deployment playbook shows where measurement fits alongside licensing and tenant pre-flight, so the dashboard rests on prerequisites that are already in place.
The five KPIs that survive the first 90 days in an Australian Copilot tenant are not the ones most teams start with. Score your tenant on the free Copilot Deployment Readiness audit to identify whether the prerequisites for governance KPIs are in place, then bring a practitioner into the room for a fixed-scope readiness assessment that includes the dashboard build itself. Measurement is the discipline that keeps Copilot productive without compromising the Privacy Act position.
Sources referenced in this article: OAIC Australian Privacy Principles guidelines; Privacy Act 1988 (OAIC); ACSC Information Security Manual; Microsoft Learn Copilot adoption guide; Microsoft Learn Copilot usage reports; Microsoft Learn DLP for Microsoft 365 Copilot and Audit logs for Copilot; Microsoft "Powering Frontier Transformation with Copilot and agents" (9 March 2026); APRA CPS 230 / CPS 234; PSPF.
