Updated 8 October 2026: Microsoft is retiring Restricted SharePoint Search, so this post now points to Restricted Content Discovery and SharePoint Advanced Management instead.
Why a maturity model, not another readiness checklist
Microsoft 365 Copilot is now deployed across many Australian tenants. The question has shifted from "is the tenant safe to deploy" to "how mature is governance now that Copilot is live". Maturity is the right lens because Copilot governance is not a project that ships and ends.
The control surface keeps expanding. Microsoft 365 Copilot Wave 3 introduced Work IQ and the Researcher and Analyst agents through 2026. The Copilot Control System then received a March 2026 update that added the agent inventory dashboard and post-publish telemetry. This is documented in the Microsoft Learn Copilot Control System reference. (Microsoft Learn — Microsoft 365 Copilot Control System, accessed 16 June 2026).
A maturity model expresses governance posture as a graded scale rather than a binary pass or fail. That matters for two audiences. Directors want to see progression over quarters in board reporting. Remediation teams need to know which lift moves them up a level. EDUC4TE's model is a five-level scale, scored across three pillars chosen specifically for Copilot in Australia rather than borrowed from a generic IT control framework.
How the L1 to L5 scale maps to organisational posture
The scale is deliberately short because finer granularity creates false precision. Five levels match the practical postures observed across Australian tenants running Copilot in 2025 and 2026.
L1 ad hoc. No Copilot-specific DLP policy. No agent inventory. APP 8 position undocumented. Copilot operates with default tenant permissions and sensitivity labels are applied inconsistently. Sites with Everyone except external users membership are exposed to Copilot grounding because they have not been audited in SharePoint Advanced Management Data Access Governance reports.
L2 repeatable. Some Purview labels exist and some DLP rules block sensitive data, but neither is tuned for the Microsoft 365 Copilot DLP location that reached general availability in April 2026. Agent build is uncontrolled — anyone with Copilot Studio access can publish. Cowork is enabled tenant-wide without APP 8 review.
L3 defined. Purview DLP for Copilot is configured. A documented agent build-and-publish approval workflow exists. High-risk SharePoint sites are protected with Restricted Content Discovery or Restricted Access Control, per the Microsoft Learn Restricted Content Discovery reference (Microsoft Learn — Restricted Content Discovery, accessed 8 October 2026). APP 8 disclosure is documented for Cowork, but enforcement and telemetry are inconsistent across business units.
L4 managed. Monthly review of Data Security Posture Management for AI signals, as described in the Microsoft Learn DSPM for AI documentation. (Microsoft Learn — DSPM for AI, accessed 16 June 2026). The Copilot Control System agent inventory is reviewed at the same cadence. APP 8 disclosure templates are signed off by Privacy Officer and reviewed when subprocessor lists change.
L5 optimised. Continuously measured through automated dashboards. Agent lifecycle is enforced through approval gates, not policy memos. Cross-border disclosure analyses are pre-computed for any feature change. Most organisations will not reach L5 in 2026; the Microsoft platform capability to fully automate at L5 is still maturing.
Pillar A — Microsoft Purview DLP for Copilot
Purview DLP for Copilot is the first pillar for one reason. It is the only control surface that can stop sensitive content from being included in a Copilot prompt at the moment of generation. According to the Microsoft Learn Data Loss Prevention for Microsoft 365 Copilot overview, the Microsoft 365 Copilot location for DLP reached general availability in April 2026. (Microsoft Learn — Learn about DLP for Microsoft 365 Copilot, accessed 16 June 2026). The policy evaluates the prompt and grounding data against configured sensitive information types and labels, then blocks inclusion when a rule matches.
Maturity along this pillar progresses through five steps. At L1 there is no Copilot DLP policy. At L2 there are tenant-wide DLP policies for other workloads but the Copilot location is unconfigured. At L3 there is a Copilot DLP policy aligned to the sensitive information types already used elsewhere, with a clear ownership statement. At L4 the policy is tuned through monthly DSPM for AI signal review, with false positive and false negative trends tracked. At L5 the policy is automatically updated when new sensitive information types are added to the tenant.
Auto-labelling is the practical lever that moves organisations from L2 to L3 on this pillar. Without auto-labelling on HR, Finance, and Legal repositories, manual labelling coverage rarely exceeds 60 per cent. Purview DSPM for AI exposes the coverage gap directly: the report lists repositories with high Copilot grounding activity and low sensitivity label coverage, making prioritisation evidence-based rather than instinctive.
Audit log review for Copilot prompt activity completes the pillar. Microsoft Purview audit captures Copilot interactions, and at L4 these are reviewed weekly or integrated into a security information and event management platform. At L5 they are correlated against DLP events to detect attempted bypass patterns.
Pillar B — Copilot Studio agent governance
The second pillar covers everything Microsoft now bundles under the term Copilot Control System. According to the Microsoft Learn Copilot Control System reference, the March 2026 update introduced a tenant-level agent inventory dashboard, build-and-publish controls, post-publish telemetry, and connector allow-lists. Together, these surfaces are how Microsoft expects administrators to govern custom agents at scale.
L1 organisations have no agent inventory and no controls on who can build or publish. Anyone with Copilot Studio access can create and publish a custom agent connected to enterprise data sources. The risk is not malicious. It is sprawl. The agent sprawl audit playbook in the companion how-to covers a structured first-pass inventory.
L2 introduces a manual list of known agents, maintained outside the platform. L3 uses the Copilot Control System agent inventory dashboard as the system of record, with documented build and publish approval. L4 adds connector allow-lists per environment, so agents in a Finance environment cannot connect to external services that are not on the approved list. L5 adds automated retirement: agents with no activity for a defined period are quarantined and reviewed.
Environment-level Data Loss Prevention is the additional Copilot Studio governance control. According to the Microsoft Learn Copilot Studio admin governance documentation, environment-level DLP allows administrators to restrict which connectors agents in a given environment can use. (Microsoft Learn — Copilot Studio administration and governance, accessed 16 June 2026). Mature tenants treat the environment as the unit of policy and the agent as the unit of audit.
Pillar C — Australian Privacy Principle 8 residency
The third pillar is where Australian governance diverges from global Copilot guidance. Australian Privacy Principle 8, under the Privacy Act 1988, governs cross-border disclosure of personal information. According to the OAIC's APP 8 quick reference, an entity must take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles before disclosing personal information. (Office of the Australian Information Commissioner — Australian Privacy Principles, accessed 16 June 2026). The alternative is to rely on a narrow exception, such as informed consent.
Standard Microsoft 365 Copilot prompts and responses are now in-country processed for Australian tenants, per Microsoft's data residency documentation. (Microsoft Learn — Microsoft 365 data residency overview, accessed 16 June 2026). Local data inferencing is expected by the end of 2026. So for standard Copilot, APP 8 is generally not triggered on covered surfaces.
Copilot Cowork is different. Cowork uses Anthropic Claude as a subprocessor for task execution, and this subprocessor is explicitly excluded from Microsoft's Australian in-country data processing commitments. Any content submitted to Cowork may route to Anthropic infrastructure outside Australia. When personal information is involved, this is a cross-border disclosure, and it triggers APP 8 obligations.
Maturity along this pillar starts at L1 with Cowork enabled and no APP 8 analysis. L2 has a draft analysis but no operational policy. L3 documents the Cowork exclusion and either disables Cowork tenant-wide or restricts it through Conditional Access. L4 maintains signed disclosure templates and updates them when the Microsoft subprocessor list changes. L5 pre-computes the cross-border analysis for any new Copilot feature before tenant rollout.
Work IQ — where it fits and why it deserves attention
Work IQ is the persistent behavioural intelligence layer introduced with Microsoft 365 Copilot Wave 3, per the Microsoft Learn Wave 3 reference at learn.microsoft.com/copilot/microsoft-365/wave-3. It captures patterns of how a user works and uses them to ground future Copilot responses. From a governance standpoint, Work IQ touches two pillars. It touches Pillar A because the captured signals are tenant data subject to DLP. It touches Pillar C because the signals about a user's working patterns are personal information under the Privacy Act 1988.
Mature tenants update their APP 5 collection notices before enabling Work IQ tenant-wide, document the opt-in scope, and ensure that Work IQ signals are not exposed to agents through Copilot Studio without explicit grounding configuration. This is the most common 2026 governance gap observed in Australian Wave 3 deployments.
Scoring and using the model
The scorecard is fifteen questions, five per pillar, each scored 0, 1, or 2. A lower score means higher maturity. The bands are: 0 to 4 is L5, 5 to 10 is L4, 11 to 17 is L3, 18 to 23 is L2, and 24 to 30 is L1. Bands are wider at the lower-maturity end because most movement happens between L2 and L3.
The model is designed to complement the EDUC4TE Copilot Readiness tool at /copilot-readiness, which is a binary go or no-go assessment for pre-deployment. The maturity model is for tenants already running Copilot, scoring continuously over time. Most organisations will run both at different points in the Copilot lifecycle.
To self-score, take the free fifteen-question audit at /copilot-governance. The same audit is available at the Copilot Governance Maturity tool. For a practitioner-led deep dive, book the Copilot Governance Maturity Assessment at /assessments/copilot-governance-maturity-assessment.
Related guides
Each pillar has a companion how-to. Use them to move up a level on the surface that scored lowest in your audit.
- Pillar A, Purview DLP: Purview DLP for Copilot — Australian rollout pattern sequences label coverage, pilot scope, and DSPM for AI tuning.
- Pillar A, measurement: DSPM for AI walkthrough for an Australian Copilot rollout covers the alerts and weekly cadence that move a tenant from L2 to L3.
- Pillar B, agent governance: Agent sprawl audit playbook works the Copilot Control System inventory, environment DLP, and connector allow-lists.
- Foundations: Microsoft Purview and Copilot — protecting Australian data explains the sensitivity label taxonomy every pillar depends on.
Where the model is heading next
Microsoft is releasing more Copilot governance surfaces through 2026. Per the Microsoft Learn manage agents reference at learn.microsoft.com/copilot/microsoft-365/manage-agents, more tenant-level lifecycle controls are expected. The DSPM for AI surface continues to expand. Australian local data inferencing is expected by the end of 2026. The maturity model will be updated as these surfaces land. The three pillars are stable: data protection, agent governance, and cross-border residency are not going away.
If you take one thing from this guide, take this: enable DSPM for AI this quarter and review the report monthly. That single action moves most Australian tenants from L2 to L3 on Pillar A. It also exposes the gaps on Pillars B and C with evidence rather than instinct.
Sources referenced in this article: Microsoft Learn — Microsoft 365 Copilot Control System, Restricted Content Discovery, DSPM for AI, Learn about DLP for Microsoft 365 Copilot, Copilot Studio administration and governance, Microsoft 365 data residency overview, Microsoft 365 Copilot Wave 3, and manage agents (accessed 16 June 2026). Office of the Australian Information Commissioner — Australian Privacy Principles (APP 8), and the Privacy Act 1988.
