Copilot Readiness Assessment — a fixed-fee accelerator from EPC Group

What it is

Copilot answers from whatever a user can already reach. The assessment therefore starts with the tenant, not the license: how SharePoint permissions have drifted, where sites are shared with everyone, whether sensitivity labels exist and are applied, and which data stores would be exposed through a natural-language prompt. Each surface is scored and the blockers are separated from the maturity gaps.

The output is a rollout plan the organization can act on: the remediation that must precede licenses, the pilot cohort that proves value with the least exposure, the licensing position (Copilot add-on against the Microsoft 365 plan the organization holds) and the measurement baseline the business case will need. The full service description sits on the Copilot readiness service page; this accelerator is its fixed-scope form.

This accelerator is the fixed-scope delivery of the Microsoft 365 Copilot Readiness Assessment: the tenant is scored on the eight TAR-8 surfaces against the published rubric, every finding is classified as a blocker or a maturity gap, and the scope, duration and deliverables are the ones the service page describes.

Who it is for

Organizations evaluating a Microsoft 365 Copilot deployment: IT and security leaders who have been asked to approve licenses and need to know what Copilot will surface, to whom, before the first license is assigned.

Start here by size — Start with an assessment. A first external look at one estate — Copilot readiness, data governance, Power BI health, AI spend — before any build is committed. The organizations EPC Group serves, and the ones it does not, are set out on the fit page.

Deliverables

• TAR-8 scorecard

  Every surface scored 0–3 on the published rubric, with the evidence behind each score.

• Blocker register, ranked against maturity

  Each finding classified as a blocker (closed before the affected population is enabled) or a maturity gap (closed in the first quarter), with its owner.

• Identity and access design

  The Conditional Access policy set and the Microsoft Entra configuration Copilot depends on.

• Sensitivity-label and DLP plan

  The label taxonomy, the auto-labeling and DLP-for-Copilot rules, and the DSPM for AI configuration.

• Content-estate exposure report

  Oversharing across SharePoint, OneDrive and Exchange from the tenant's own signals, with the remediation order.

• Rollout and governance roadmap

  Persona use cases, pilot population, wave sequence, licensing model, the measurement framework and who owns each control.

What is not included

• The remediation itself — permission fixes, label deployment and DLP changes are scoped separately once the assessment has sized them.
• Copilot license procurement or tenant configuration beyond the pilot plan.
• Custom agents or Copilot Studio work — see the Copilot Studio agent governance service.

Anything outside the deliverables above is a change order under the Engagement Charter — written, priced and approved before the work starts.

When to start

• Copilot licenses are being requested and nobody can say what the tenant would expose.
• A pilot stalled because users saw content they should not have.
• The business case for Copilot needs a baseline before budget is approved.

How it is priced

Fixed fee, quoted after a one-hour call with a senior architect. EPC Group does not publish price ranges. The scoping call is run by the architect who would lead the work; the fixed fee, the deliverables and the acceptance criteria are written into the Statement of Work, and the change-control, escalation and acceptance rules are the ones in the Engagement Charter.

Related

• Full service: Microsoft 365 Copilot Readiness Assessment (TAR-8)
• Related accelerator: Microsoft 365 Governance Framework (4–6 weeks)
• Related accelerator: AI Governance Framework (6–10 weeks)
• Template: Copilot pilot acceptance scorecard
• Template: Purview DLP policy test matrix
• All accelerators: the fixed-fee accelerators hub
• Documented engagements: case studies and the Evidence Center