Teams and SharePoint
Review ownership, permissions and abandoned or unnecessary workspaces.
AI and Copilot
Get the foundations right before AI becomes part of everyday work.
CompTech helps organisations introduce Microsoft Copilot and other approved AI tools with clearer rules around permissions, sensitive information, shadow AI, acceptable use and ongoing ownership.
Start with the foundations
AI adoption should start with the data and permissions you already have.
Before wider AI use, organisations should understand who can access what, where sensitive information sits and whether collaboration areas such as Teams and SharePoint are already well governed.
CompTech helps review those foundations before AI becomes part of more everyday work.
Existing access matters
Copilot does not create access. It can make existing access easier to use.
In Microsoft 365, Microsoft Copilot works within the permissions a user already has.
That makes existing access and oversharing more important, because information that was previously difficult to find may become much easier to surface through AI.
CompTech helps organisations review permissions and collaboration before wider Copilot adoption.
Approved and unapproved use
Manage shadow AI with clear rules and approved tools.
Staff may already be using public AI services to rewrite documents, summarise information, create content or solve everyday problems.
The issue is not simply that AI exists. It is organisational information being entered into services without clear approval or controls.
The aim is not a blanket ban. Staff need an approved route for useful AI work and clear boundaries for information that should not be entered into public or unapproved services.
- which AI tools are approved for work
- what information must not be entered into public or unapproved AI services
- when human review is required
- where AI-generated output must not be relied upon without checking
- how staff report concerns, mistakes or inappropriate use
- which approved tool staff should use instead of unmanaged alternatives
Govern the platform first
Microsoft 365 governance matters before Copilot is used more widely.
OneDrive and file sharing
Check external sharing and whether sensitive files are accessible more widely than expected.
Groups and guests
Review Microsoft 365 groups, guest accounts and old external access.
Administrative access
Make sure higher-risk access remains properly restricted and protected.
Where the organisation needs additional information-protection controls, Microsoft capabilities can include Purview, Data Loss Prevention, sensitivity labels, retention, access reviews and information classification.
Available capabilities depend on Microsoft licensing and the organisation’s actual requirements. Not every organisation needs or is licensed for every Microsoft security or compliance feature.
Explore Microsoft 365 managementLearn before expanding
Start small before rolling AI out everywhere.
A controlled pilot helps an organisation understand where AI is genuinely useful before committing to a wider deployment.
1. Choose the right users
Start with people who have clear use cases and can provide useful feedback.
2. Review the foundations
Check permissions, data exposure, licensing and security before access is enabled.
3. Test real work
Use real business scenarios such as summarising meetings or documents, drafting content, finding approved information and reducing repetitive administrative work rather than demonstrations designed to make AI look impressive.
4. Review before expanding
Look at usefulness, risk, adoption and lessons learned before adding more users.
Keep people involved
Human review still matters.
AI-generated output can be incomplete, inaccurate or confidently wrong.
Staff should understand when AI output needs checking, especially where it affects:
customers and external communications
finance, contracts and other important business decisions
safeguarding and personal or sensitive information
security
any high-impact decision where an incorrect answer could cause harm or loss
Before wider adoption
Ten questions worth asking before wider AI adoption.
If several of these answers are unclear, the organisation may need readiness work before wider rollout.
- Which AI tools are staff already using for work?
- Which AI tools are approved, and what organisational data can they be used with?
- What information must never be entered into public or unapproved AI services?
- Are Microsoft 365 permissions, guests and external sharing already under control?
- Do you know where sensitive information is stored and who can access it?
- Are licensing, identity, MFA and device management ready for the intended Copilot users?
- Do staff have clear acceptable-use guidance and know when human review is required?
- Which real business use cases will a controlled pilot test?
- Who owns AI governance, incidents and future decisions?
- How will permissions, policy and AI use be reviewed after rollout?
After rollout
AI governance continues after the pilot.
Approved tools, permissions, licensing, policies, incidents and useful business scenarios will change over time. Governance needs to be reviewed as the organisation and Microsoft services change.
CompTech can help with readiness reviews, agreed Microsoft 365 configuration, pilot planning, staff guidance and ongoing governance reviews.
Business leadership and the relevant internal IT, security, data protection, HR or legal owners should retain the decisions that sit within their own responsibilities. CompTech supports the technical and governance work rather than replacing those roles.
Help people make safer choices
Clear guidance works best when staff understand the risks.
Plan the next step
Not sure whether your organisation is ready for Copilot or wider AI use?
Tell us what your team is already using, what you are considering and where sensitive information sits.
We’ll help you understand the practical risks, review the foundations and decide whether the next step is policy, technical controls, a small pilot or further governance work.