Copilot Deployment Readiness Checklist for Australian IT Teams 2026

Updated 19 October 2026: Microsoft has blocked new enablement of Restricted SharePoint Search since 31 July 2026 (full retirement 31 January 2027), so this post now points to Restricted Content Discovery and SharePoint Advanced Management instead.

Your organisation is ready to deploy Microsoft 365 Copilot when your identity controls, data governance, and security monitoring are validated against each item in this checklist — not when the licences arrive.

This checklist is designed for Australian IT practitioners who are preparing for Copilot deployment in 2026. It covers the controls that matter most for reducing data exposure risk, meeting Privacy Act 1988 obligations, and aligning with the ACSC Essential Eight. Use it as a working document — work through each section, document your findings, and track remediation before you assign the first Copilot licence.

For a structured assessment of your organisation's specific readiness posture, start with a Copilot deployment readiness assessment to get a prioritised view of your gaps.

Section 1: Identity and Access Management

Identity is the first line of defence for Copilot. Every Copilot response is scoped to what the signed-in user can access — which means a compromised account or an over-privileged user directly becomes a Copilot data governance risk.

1.1 Multi-Factor Authentication

• All licensed Microsoft 365 users have MFA enforced via Conditional Access (not just enabled — enforced)
• Break-glass accounts are excluded from MFA policies with documented compensating controls and monitored alert rules
• MFA method strength meets ACSC guidance — Microsoft Authenticator app or hardware FIDO2 key preferred; SMS OTP is not recommended
• MFA registration is complete for 100 percent of users who will receive Copilot licences
• Authentication strength policies are applied to admin roles requiring phishing-resistant MFA

1.2 Conditional Access

• Compliant device requirement enforced for all cloud app access by Copilot pilot users
• Sign-in risk and user risk policies are configured in Entra ID Protection
• Legacy authentication protocols are blocked (Basic Auth, IMAP, POP, SMTP AUTH where not required)
• Named locations defined for Australian office locations and used in Conditional Access policies
• Sign-in logs reviewed in the past 30 days for anomalous patterns (impossible travel, unfamiliar device)

1.3 Privileged Access

• Global Administrator accounts are fewer than five and are cloud-only accounts separate from daily-use accounts
• Privileged Identity Management (PIM) is configured for all Entra ID privileged roles
• No service accounts or shared mailboxes have Global Administrator or equivalent roles assigned permanently
• Admin accounts are excluded from receiving Copilot licences (privileged accounts should not use Copilot due to their elevated access scope)

1.4 Guest Account Hygiene

• Entra ID Access Reviews are configured for external guest accounts — at minimum annually, ideally quarterly
• Guest account expiry policies are in place (maximum 365 days without renewal)
• Guest accounts with no sign-in activity in the past 90 days have been reviewed and removed
• External sharing settings in SharePoint are scoped to "New and existing guests" or more restrictive — not "Anyone"

Section 2: Data Governance and Classification

This is the section where most Australian organisations find the most gaps. Copilot is only as safe as your data governance maturity — and most Microsoft 365 environments have years of ungoverned content accumulation.

2.1 Sensitivity Labels

• Microsoft Purview sensitivity labels are deployed and published to all pilot users
• Labels cover at minimum: Public, Internal, Confidential, Highly Confidential
• Auto-labelling policies are configured for content containing Australian personal information patterns (TFN, Medicare number, ABN in certain contexts)
• SharePoint document libraries and OneDrive locations in the pilot scope have been scanned via Content Explorer for unclassified sensitive content
• Sensitivity label coverage exceeds 70 percent for SharePoint content in the pilot scope before Copilot is deployed

2.2 Restricted Content Discovery and Restricted Access Control

• SharePoint Advanced Management data access governance reports have been run and the highest-risk sites identified
• Genuinely sensitive sites (board, legal, HR, finance) are protected with Restricted Content Discovery while their permissions are reviewed
• Restricted Access Control limits access to a named security group or Microsoft 365 group on sites that only a defined group should reach
• Restricted Content Discovery is documented as a temporary measure, with a named owner and a plan to remove it once access is remediated
• Restricted SharePoint Search is retiring (new enablement has been blocked since 31 July 2026, full retirement 31 January 2027); if your tenant already enabled it, there is a plan to disable it and move to Restricted Content Discovery after permissions are validated

2.3 SharePoint and OneDrive Permission Hygiene

• SharePoint site permission reports have been run for all sites in the Copilot pilot scope in the past 90 days
• Sites with more than 500 unique permissions have been flagged for remediation (high unique permission count indicates permission sprawl)
• Overly broad sharing links (Anyone links) have been audited and restricted
• OneDrive content shared externally has been reviewed and unexpired sharing links have been cleaned up
• Site ownership is up to date — no sites have only departed staff as owners

2.4 Exchange and Teams Data

• Shared mailboxes that contain sensitive business communications have appropriate access controls and are not accessible to junior staff who do not need them
• Teams channels containing sensitive project information have appropriate membership controls
• Teams meeting recordings and transcripts retention policies are configured

Section 3: Data Loss Prevention

3.1 Microsoft Purview DLP Policies

• DLP policies are active for SharePoint, OneDrive, Teams, and Exchange — not just email
• Australian-specific sensitive information types are configured: Tax File Number, Medicare Number, Australian Business Number, Australian Passport Number
• DLP policies include Copilot interaction as a monitored activity (configurable in Microsoft Purview for Copilot extensibility scenarios)
• Policy tip notifications are enabled to educate users at the point of potential policy violation
• DLP incidents are reviewed in the Purview compliance portal at least fortnightly during the pilot

3.2 Microsoft Defender for Cloud Apps (if licensed)

• Microsoft 365 app connectors are enabled for SharePoint, OneDrive, and Exchange in Defender for Cloud Apps
• Anomalous download activity alerts are configured (large volume downloads by a single user in a short period)
• Impossible travel alerts are reviewed regularly
• Session controls are applied to unmanaged devices accessing Microsoft 365

Section 4: Security Monitoring and Incident Response

4.1 Microsoft Secure Score

• Current Microsoft Secure Score is documented as a baseline before the Copilot pilot begins
• The top 10 recommended actions relevant to identity and data governance are reviewed and assigned owners
• Secure Score improvement targets are defined for the pilot period
• Secure Score is reviewed at each pilot milestone checkpoint (day 30, day 60, day 90)

4.2 Audit Logging

• Microsoft 365 Unified Audit Log is enabled for the tenant
• Audit log retention is configured for at minimum 12 months (requires appropriate licence — Microsoft 365 E3 or above)
• Copilot interaction audit logs are reviewed at each pilot checkpoint for anomalous patterns
• Alerts are configured for high-risk events: mass download, sensitive label downgrade, external sharing from classified sites

4.3 Incident Response Preparedness

• Your incident response plan has been updated to include a Copilot data exposure scenario
• Staff who manage incidents understand the Privacy Act 1988 notification obligations under the Notifiable Data Breaches (NDB) scheme
• The Office of the Australian Information Commissioner (OAIC) notification process is documented and the responsible officer is identified
• A test of the incident response process for a simulated Copilot-related data exposure has been completed or is scheduled before full deployment

Section 5: Compliance and Regulatory Requirements

5.1 Privacy Act 1988 and Australian Privacy Principles

• A Privacy Impact Assessment (PIA) or Data Protection Impact Assessment (DPIA) has been completed for the Copilot deployment
• The PIA covers: what personal information Copilot can access, how it processes that information, and what controls limit access
• Privacy notices have been reviewed to confirm they cover AI-assisted processing of personal information
• Staff training on privacy obligations related to AI tool usage is scheduled before the pilot begins
• A process for responding to individual access requests under the APPs that may now involve Copilot-processed content is in place

5.2 ACSC Essential Eight Alignment

• Patch Operating Systems — endpoints used by Copilot pilot participants are patched to current (within one month of release for critical patches)
• Application Control — unmanaged devices cannot access Copilot (enforced via Conditional Access compliant device policy)
• Restrict Administrative Privileges — admin accounts are excluded from Copilot licences (documented above)
• Multi-Factor Authentication — verified and enforced (documented above)
• User Application Hardening — Microsoft 365 Apps on managed devices are on the Current Channel (Monthly Enterprise) and are up to date

5.3 Microsoft Data Residency

• Your Microsoft 365 tenant's data residency for core workloads (Exchange, SharePoint, Teams) is confirmed as Australia
• Microsoft Copilot commercial data protection is enabled (this prevents Copilot prompts and responses from being used to train Microsoft models)
• If you have a Microsoft 365 Multi-Geo deployment, Copilot data processing location requirements are understood and documented

Section 6: Change Management and Training

• Executive sponsorship for the Copilot deployment is confirmed and an executive sponsor is named
• A communication plan for the pilot exists that covers what Copilot can access, what it cannot access, and how staff should report concerns
• Copilot prompting skills training is scheduled for all pilot participants before week one ends
• A feedback channel exists for pilot participants to report unexpected Copilot behaviour or content surfacing concerns
• A process for escalating Copilot-related concerns to the security team during the pilot is documented and communicated

How to Use This Checklist

Work through each section and mark each item as complete, in progress, or not yet started. For any item marked "not yet started," assign an owner and a target completion date. Do not proceed to assign Copilot licences until every item in Sections 1 and 2 is complete — these are the controls that directly limit data exposure risk.

Sections 3 through 6 can be in progress when the pilot begins, but must be complete before full organisational rollout.

If this assessment surfaces significant gaps — particularly in data classification coverage or identity control enforcement — you may need a remediation sprint before the pilot begins. That is a better outcome than discovering those gaps after Copilot has been querying your ungoverned content for 90 days.

The Microsoft 365 Copilot Wave 3 Deployment Playbook for Australia covers the full enterprise deployment pattern for organisations that have completed their readiness work and are moving to organisation-wide rollout.

For a structured assessment of your current posture against this checklist, our Copilot deployment readiness assessment will give you a prioritised view of your gaps and a remediation roadmap tailored to your organisation's specific environment.