Tenant Readiness and Rollout

The readiness report is green, so the whole pilot group gets Copilot. By Friday, two people are asking why it can't reach files their colleagues can use. The report wasn't wrong. It answered a narrower question than "is this rollout ready?"

A rollout depends on several records agreeing about the same people: qualifying subscriptions, the approved pilot list, supported update channels, assigned licenses, reviewed settings, and reports that match your own records. If one record disagrees, readiness is still unresolved. Reports, counts, and saved settings are evidence. An authorized rollout decision is a separate record.

Readiness is a chain of evidence

Microsoft's setup guidance sequences readiness as a chain, and each link answers its own question:

Buying licenses does not complete the chain. A subscription can be purchased but unassigned. A user can hold the right license and still fail the channel check. Two admin records can disagree. Readiness work means surfacing those disagreements before a person hits a wall, or before they reach content they were never meant to see. A blank cell in the worksheet is not a pass. It's an unanswered question.

Choose the pilot's access model

Copilot opening for a user doesn't tell you which license is behind it. There are two different access models, and confusing them produces the Friday-afternoon confusion from the opening example.

Web-based Copilot Chat comes with an eligible Microsoft 365 subscription at no extra cost, but it only answers from the open web, without drawing on your organization's content. Work-based chat requires a Microsoft 365 Copilot license and can ground answers in your Microsoft Graph data: email, calendars, SharePoint, OneDrive. If someone opens Copilot but can't use company context, they most likely have only the web-based experience. Nothing is broken. Record which model the pilot requires as a licensing fact.

Licenses reach users through three documented methods: individual assignment, group-based assignment, and PowerShell. The method only changes how you start the operation. What you verify afterward stays the same. The verification unit is always the user. When you assign to a group, the group is the target, but you still confirm every intended member's resulting license state, and that nobody outside the approved population was swept in. Submitting a change is not proof of its result.

Another record often gets folded into licensing: the update channel. Copilot's supported deployment path here is Current Channel or Monthly Enterprise Channel. Assigning a license does not move a device onto either one. Licensing and channel readiness have separate owners and separate evidence. If the configured channel, observed device channel, and readiness report disagree, record Mismatch — investigate. That mismatch needs an owner, not a rounding adjustment.

Suggested candidates still need approval

Microsoft's readiness report uses a 28-day window. It shows total prerequisite licenses, users on an eligible update channel, assigned and available licenses, and suggested candidates. Suggested candidates are the top 25% of non-licensed users by Microsoft 365 app usage. That makes the field useful for prioritization. It grants no approval.

High app usage says nothing by itself about purchasing authority, security readiness, or business need. If the ranking is treated as an approved list, the pilot can expand beyond the population anyone authorized. Keep the evidence in three separate columns because each has a different owner:

• Observed fact: "40 licenses are assigned."
• Recommendation: "Consider adding 20 users once dependencies clear."
• Approved decision: "The named approver authorized the expansion."

Pricing needs the same separation. The enterprise Microsoft 365 Copilot add-on is recorded at $30 per user per month, paid yearly, as of mid-2026. Business plans have different bundled and add-on options. Check the price and terms in your own agreement before reusing a figure from a slide. Record the option, price, seat count, and annual commitment. Keep Copilot cost separate from its qualifying base plan.

The Copilot Control System: three pillars, one go/no-go

Readiness gets the rollout started. The Copilot Control System (CCS) is how you keep operating it afterward. CCS organizes Copilot administration into three pillars that have to be read together: a strong signal in one never rescues a gap in another.

• Security & Governance: data access, oversharing, labels, DLP, audit, Zero Trust. (Two whole lessons, data protection and audit and Zero Trust, live here.)
• Management Controls: who can use Copilot, how it's licensed or metered, and the agents that exist and who owns them.
• Measurement & Reporting: readiness, adoption, impact, and value evidence.

Measurement is a hierarchy. The numbers in it aren't interchangeable. Microsoft documents five distinct reporting tools:

Treat each CCS control as a record with an owner, an observed state, evidence, the decision still required, and a review date. When "not visible" shows up, write it as an observation about your access. Whether the control itself is disabled remains a separate, unconfirmed question. The exercise is meant to produce a defensible recommendation: Go, Go with narrower scope, No-go pending remediation, or Pause for evidence, each paired with the evidence that would change it. A 120-user proposal backed by an 80-user group, an unfinished site review, and no adoption baseline is a no-go for 120. The 80-user version is a candidate. It still needs its own yes.

Making the call

Put the pieces together in order: review Security & Governance for unresolved dependencies, Management Controls for any mismatch between approved scope and observed access, and Measurement & Reporting for a real baseline. Prioritize a data-exposure risk over a scope mismatch, and a scope mismatch over missing measurement. Then write the recommendation and, separately, the approved decision. The recommendation is yours to make. The authorization belongs to the named approver. Copilot's generated summary is a formatting aid. The site review, the license record, and the approval are the evidence.