A Copilot rollout works best as a 90-day programme in three parts. Spend two weeks fixing file permissions and measuring how long key tasks take today. Run an eight-week pilot where each person completes one real work assignment per week and gets it scored. Use the last three weeks to compare usage reports and scores with the baseline and decide who gets licences next.
Key points
- Copilot answers from everything a user can already open. Run Microsoft's oversharing checks in Purview and SharePoint Advanced Management before you assign the first licence.
- Record a baseline before anyone gets access: minutes per task and a quality score for three recurring tasks per role.
- A pilot of 10 to 30 people from three or four roles is enough to decide. Include sceptics and the managers who will judge the result.
- Each pilot week has one assignment from the participant's own work, scored on the same five criteria every time.
- Usage reports show who used Copilot. Scored assignments show whether the work got better. The manager report needs both, at team level.
What does a 90-day Copilot rollout plan look like?
A 90-day Copilot rollout plan has three phases: preparation in weeks 1 and 2, a pilot with weekly assignments in weeks 3 to 10, and evaluation with a scaling decision in weeks 11 to 13.
| Phase | Weeks | Work | Owner | Output |
|---|---|---|---|---|
| Prepare | 1–2 | Check requirements, run the oversharing assessment, fix high-risk sites, set up labels, choose the pilot group, record the baseline | IT admin, data protection lead, project owner | Clean permissions, baseline sheet, pilot list |
| Pilot | 3–10 | One live session and one scored assignment per week, per role | Project owner, trainer, one champion per role | Eight scored assignments per person, prompt templates |
| Evaluate | 11–13 | Compare usage and scores with the baseline, report to managers, plan the next wave | Project owner, managers, IT admin | Team report, scaling decision, licence plan |
Microsoft's adoption site splits the admin work into similar stages (plan, implement, adopt, manage, improve) but leaves two things to you: what the training contains and how to tell whether the work improved. Most of this plan is about those two. Microsoft now calls the paid product Microsoft Copilot; this article keeps the older name Microsoft 365 Copilot, which parts of Microsoft's own documentation, such as the Purview pages, still use.
What do you need in place before you assign Copilot licences?
Each pilot user needs an eligible Microsoft 365 plan, a Copilot licence, a Microsoft Entra ID work account and, for mail, calendar and meeting features, an Exchange Online mailbox, and the content Copilot can reach needs a permissions check. The technical part is quick; the permissions work takes most of the two weeks.
Licences and technical requirements
- Licences. A Copilot licence on top of a qualifying plan. Copilot is not available with device-based licensing for Microsoft 365 Apps for enterprise. Copilot Chat works without a Copilot licence for users with an eligible subscription, so everyone outside the pilot can start there.
- Accounts. An Entra ID work account, an Exchange Online mailbox for anything that uses mail, calendar or meetings, and OneDrive for some features.
- Apps and network. Desktop Office apps on Current Channel or Monthly Enterprise Channel (Microsoft Support says Copilot features are not available on Semi-Annual Enterprise Channel), the whole *.cloud.microsoft domain allowed, and Teams transcription or recording on if Copilot should use meeting content afterwards.
- Test one account. Run Microsoft's Copilot License Details diagnostic on a pilot user so the first session is not spent on missing buttons.
How do you check for oversharing before Copilot goes live?
Find the sites and folders that too many people can open, restrict them while you fix access, and test with an ordinary account. Copilot grounds its answers in data the user already has permission to see. A salary file shared with the whole company has only stayed private because nobody went looking, and Copilot goes looking every time someone asks.
The first step of Microsoft's deployment blueprint, remediate oversharing, has three parts. Identify: the data risk assessments in Microsoft Purview Data Security Posture Management and the SharePoint Advanced Management (SAM) content management assessment find sites with oversized audiences, "Everyone except external users" access, broken inheritance or no owner. Protect in the meantime: Restricted Content Discovery keeps chosen sites out of Copilot's reach while you work on them. Fix: site access reviews let owners remove excess members and company-wide links. The blueprint's second step, guardrails, then restricts Anyone links and company-wide sharing at tenant level so the problem does not return. SAM is included with Copilot licences.
Tip
Sign in as a regular pilot user and ask Copilot for things it should not find: salaries, board minutes, a named customer's contract, a colleague's appraisal. Everything it returns goes on the fix list before week 3.
Datatilsynet, the Norwegian data protection authority, made the same point in its November 2024 exit report from a sandbox project with NTNU: get your own house in order on access rights first.
Where do sensitivity labels fit in?
Sensitivity labels add a layer on top of permissions. When a label applies encryption, the user needs the VIEW and EXTRACT usage rights before Copilot returns the content. New content that Copilot in Word, PowerPoint or Outlook creates from a labelled file inherits the label, and a Purview data loss prevention (DLP) policy can stop Copilot from processing files with specific labels. Turn on sensitivity labels for SharePoint and OneDrive first. A small company can start with four labels (Public, Internal, Confidential, Strictly confidential) and Internal as the default.
Do you need a DPIA?
Plan for one. Datatilsynet's report says that, as a general rule, a data protection impact assessment (DPIA) will be required when Copilot processes personal data. It also considered it likely that the log of user interactions could fall under the ban on monitoring employees in the Norwegian e-mail regulation (e-postforskriften), which affects how you report usage later.
How do you measure a baseline before the pilot starts?
Time and score three recurring tasks per role in the two weeks before anyone gets access. Without a baseline, the week 10 numbers have nothing to be compared with and the evaluation becomes a debate about impressions.
Pick tasks that happen at least weekly and produce text or numbers: a follow-up email after a sales meeting, the commentary on a monthly variance report, a reply to a complaint, a campaign brief. Participants log the minutes spent on five real instances of each, and the trainer scores three samples of current work with the pilot rubric. Add one survey question: confidence with AI tools on a scale of 1 to 5. Keep it all in one spreadsheet.
Who should be in the Copilot pilot group?
A good pilot group is 10 to 30 people from three or four roles with repeated writing, analysis or customer work, and at least one manager per role. Fewer than ten gives too little to compare; more than thirty is hard to give weekly feedback to.
- Choose people who do the baseline tasks every week. A licence for someone who rarely writes or analyses shows up as inactive within a month.
- Mix the keen with the sceptical. A pilot of enthusiasts tells you little about the next 200 users.
- Protect about two hours a week per person: a one-hour session and an hour for the assignment.
- Name one champion per role. Microsoft's adoption guidance recommends champions "to help peers and share best practices", and they run sessions in the next wave.
- Check the Copilot Chat usage report. Microsoft's Copilot Dashboard points to heavy Copilot Chat users as strong candidates for a full licence.
Licence count affects reporting. Group views for managers, benchmarks and weekly trends in the Copilot Dashboard need at least 50 Copilot or Viva Insights licences, so a 20-person pilot reports from the admin center and its own scores.
What happens in each week of the pilot?
Each pilot week has the same rhythm: one live session on a single skill, one assignment from the participant's own work, and written feedback with a score before the next session. Because the rhythm repeats, every participant practises on their own work eight times before the evaluation.
- Monday session (60 minutes). One skill, shown on the team's own documents, plus five minutes on last week's most common mistakes.
- Assignment (Tuesday to Thursday). A real task from that week. The participant submits the prompt, Copilot's output and what they changed before using it.
- Scoring (Friday). The trainer or champion scores it and writes two or three lines of feedback. Prompts that worked go into the role's template library.
| Week | Skill | Sales | Finance | Customer service |
|---|---|---|---|---|
| 3 | Ground rules: what Copilot sees, labels, what never goes in a prompt | Summarise a prospect thread and draft a follow-up | Pull payment terms and notice periods from a supplier contract | Summarise a complaint thread and draft a first reply |
| 4 | Prompts with role, audience, source and format | Proposal introduction from a meeting transcript | Month-end commentary from the variance table | Drafts for the five most common questions |
| 5 | Working from files, mail and meetings | Meeting prep brief from earlier emails and a Teams recap | One-page summary of three management reports | Handover note from a meeting recap |
| 6 | Copilot in Excel | Find deals with no activity for 30 days | Explain the three largest cost deviations | Group a month of tickets by cause |
| 7 | Checking facts, numbers and sources | Check a drafted proposal against contract terms | Recalculate every figure in a summary | Check a reply against the refund policy |
| 8 | Sensitive data and judgement | What may go in a prompt about a named customer | A request that touches salary data | A customer who has shared health details |
| 9 | Reusable prompts | Follow-up template for the team | Monthly report template | Prompt library for common replies |
| 10 | Rerun the baseline | The three baseline tasks, timed and scored under the same conditions as in weeks 1 and 2 | ||
Marketing and management tracks use the same skills on their own tasks. For week 4, our prompt engineering guide covers how to give context, source material and a definition of a good answer.
How do you measure Copilot adoption?
Measure Copilot adoption with the Copilot usage report in the Microsoft 365 admin center and the Copilot Dashboard in Viva Insights, and treat both as measures of activity. A prompt counts as use whether or not the answer was any good.
The usage report sits under Reports > Usage > Microsoft Copilot. It shows enabled users, active users and the active users rate over 7, 28, 90 or 180 days, usually within 48 hours. A user counts as active after an intentional action such as submitting a prompt; opening the Copilot pane does not count. User names are hidden by default. The Copilot Dashboard covers readiness, adoption, impact and sentiment; the first three show the previous 28 days with up to six days' delay (sentiment follows the survey period), and needs no paid Viva Insights licence.
| Assistant | Where to find usage data | What it shows |
|---|---|---|
| Microsoft 365 Copilot | Admin center > Reports > Usage > Microsoft Copilot | Enabled and active users, active users rate, prompts submitted, last activity per app |
| Copilot Dashboard | Viva Insights web app > Copilot Dashboard | Readiness, adoption, impact, sentiment over 28 days |
| ChatGPT Enterprise | Workspace Settings > Workspace Analytics | Seats activated, weekly active users, messages per weekly user, benchmarks |
| Claude Team and Enterprise | Initials menu > Analytics | Weekly active members, adoption level, spend for owners |
| Gemini in Google Workspace | Admin console > Generative AI > Gemini reports | Active users against eligible licences, adoption per app; 2 to 3 days' delay |
Track three numbers each week for the pilot group: users active in the last seven days, active days per user, and apps used per person. Someone who only uses chat has not found Copilot in Outlook or Excel yet, which tells you what the next session should cover.
How do you score the quality of AI-assisted work?
Score every assignment with a short rubric, applied by someone who knows what good work looks like in that role. Five criteria scored 0 to 2 give a total out of 10 that is easy to track week by week.
| Criterion | 0 | 1 | 2 |
|---|---|---|---|
| Correct | Errors reach the result | Errors caught and fixed | No errors; facts checked against the source |
| Right tool and source | Wrong app or no source | Right app, thin context | Right app and the right files referenced |
| Sensitive data | Personal or confidential data used without need | Borderline, but flagged | Only the data the task needed |
| Reusable | One-off prompt | Partly reusable | Saved as a template for the role |
| Time | Slower than baseline | About the same | Faster than baseline |
Calibrate in week 3: the trainer and champions score the same three assignments separately, compare, and agree what a 1 and a 2 look like. Score without knowing who submitted the work where you can.
What should the manager report contain?
The manager report is one page per team, at team level: usage, quality scores over time, time per task against the baseline, weak skills, and a recommendation for the next wave. Write it in week 11 and go through it in a 30-minute meeting.
- Adoption: active users rate for the last 28 days, active days per user, apps in use.
- Quality: median rubric score per role for each week from 3 to 10.
- Time: baseline minutes against week 10 minutes for each task.
- Gaps and recommendation: criteria where scores stayed low, which roles get licences next, which licences to reassign.
Keep individual results out of the report unless participants agreed to share them before the pilot started. In Norway there is also a legal reason. Given Datatilsynet's view on interaction logs and e-postforskriften, decide before week 3 which per-person usage data anyone will look at and why, and tell employees.
Example
A fictional 80-person engineering consultancy in Trondheim buys 20 Copilot licences for a pilot: six project managers, six bid writers, four finance staff and four managers. In week 1 the oversharing check finds old salary bands in a bids folder open to the whole company; IT moves the file. At baseline a bid summary takes a median of 95 minutes and scores 6 out of 10. In week 10 it takes 55 minutes and scores 8. Finance month-end commentary goes from 70 to 60 minutes, score unchanged at 7. The usage report shows 17 of 20 users active in the last 28 days; two of the three inactive users are managers. Decision: 15 more licences for project managers and bid writers, two extra Excel weeks for finance, the three unused licences reassigned. All figures are illustrative.
Why do Copilot rollouts fail?
Copilot rollouts usually fail for organisational reasons, and each one shows up in the data early.
| Failure | What you see | Fix |
|---|---|---|
| Licences bought, nobody uses them | Active users rate falls after month one | Licences only for people with baseline tasks; reassign after 30 days unused |
| Generic training | Good attendance, low scores on own-work assignments | Build every session on the team's own documents |
| No measurement | "People like it" and no baseline | Baseline in weeks 1 and 2, rerun in week 10 |
| Oversharing found after launch | Someone finds board papers through a question | Assessments and test prompts before week 3 |
| Pilot of enthusiasts only | Strong pilot, flat next wave | Mix roles and attitudes from the start |
Does the same plan work for ChatGPT, Claude or Gemini?
Yes. The phases, weekly assignments, rubric and manager report do not depend on the vendor, so the plan fits ChatGPT Enterprise or Business, Claude Team or Enterprise, and Gemini in Google Workspace. Only the admin settings and reports change.
The permissions check applies wherever the assistant reads company data. Google's privacy hub states that if a user does not have access to a document or email, Gemini will not retrieve it, so Gemini sees overshared Drive folders the way Copilot sees overshared SharePoint sites. For ChatGPT and Claude the check moves to the connectors: before connecting SharePoint, Drive or a CRM, read what the connector can access. Data terms differ by plan; we compare them in our guide to AI tools for business, and the assistants themselves in ChatGPT vs Claude vs Gemini.
When should you scale Copilot beyond the pilot?
Scale when the pilot meets the targets you wrote down in week 2. The thresholds below are starting points we suggest, not industry benchmarks; set your own before the pilot so the decision is not made after seeing the results.
- At least 70 % of pilot users active in each of the last four weeks.
- Median rubric score up by at least two points from week 3 to week 10.
- Time down on at least two of the three baseline tasks in a role.
- No high-risk sites still waiting for an access review.
Scale in waves of one or two roles, with pilot champions running the sessions and four weeks of assignments for each wave. If a role shows no gain, keep it on Copilot Chat and spend the licences elsewhere. To turn time saved into a business case, use our AI ROI guide; once the team uses Copilot daily, the AI automation guide covers what to automate next.
If you want the pilot run as a programme with a real assignment every week, scoring and a team report to the manager, that is how our AI training for teams is built, and our AI implementation service covers the permissions and setup work in weeks 1 and 2. Either way, start with the week 1 test: sign in as an ordinary user and ask Copilot to show you the salary list.
Frequently asked questions
How long does a Microsoft 365 Copilot rollout take?
Plan for about 90 days from the first permissions check to a decision on the next wave: two weeks of preparation, eight of pilot and three of evaluation. Later waves are shorter because templates and champions already exist.
How many people should be in a Copilot pilot?
Between 10 and 30 people from three or four roles works for most companies. Fewer gives too little data to compare, and more makes weekly feedback on every assignment hard to keep up.
How can I see who is using Copilot?
Use the Copilot usage report in the Microsoft 365 admin center under Reports > Usage > Microsoft Copilot, or the Copilot Dashboard in Viva Insights. User names are hidden by default; in Norway, document why you need per-person data before you show them.
Can Copilot see files a user does not have access to?
No. Copilot only uses content the signed-in user already has permission to open. The risk is files that too many people can open, which is why the oversharing check comes before the first licence.
Is Copilot Chat enough, or do we need the paid licence?
Copilot Chat is available to users with an eligible Microsoft 365 subscription and handles drafting, summarising and analysis of content the user brings in. The paid licence adds answers grounded in the user's mail, files, meetings and chats. Start everyone on Copilot Chat and give paid licences to the roles where the pilot shows a gain.
Sources
- Microsoft Learn: Microsoft Copilot requirements
- Microsoft Support: Use Current Channel or the Monthly Enterprise Channel to access Copilot features
- Microsoft Learn: Secure and governed data foundation for Microsoft Copilot, foundational deployment guidance
- Microsoft Learn: Configure a secure and governed foundation for Microsoft Copilot
- Microsoft Learn: Use Microsoft Purview to manage data security and compliance for Microsoft 365 Copilot
- Microsoft Learn: Microsoft Copilot usage report
- Microsoft Learn: Connect to the Microsoft Copilot Dashboard
- Microsoft Adoption: Microsoft Copilot
- Datatilsynet: Copilot through the lens of data protection, exit report from the sandbox project with NTNU (November 2024)
- OpenAI Academy: ChatGPT Enterprise workspace analytics guide
- Claude Help Center: View usage analytics for Team and Enterprise plans
- Google Workspace Admin Help: Review Gemini usage in your organization
- Google Workspace: Generative AI in Google Workspace Privacy Hub
