What the assessment is for
A Microsoft 365 Copilot readiness assessment exists to answer one question before the purchase order is signed: can this tenant safely let a licensed user ask a model anything about the organization's data? Microsoft's own requirements list is short, an eligible base license, a Copilot license, a Microsoft Entra ID account, an Exchange Online mailbox for mailbox-grounded experiences, supported apps and browsers, and the network configuration, and it closes with a recommendation rather than a requirement: a secure and governed foundation (Microsoft Learn, Microsoft Copilot requirements, accessed 2026-10-20). That last line is the assessment. EPC Group, a Houston-based Microsoft consulting firm, applies TAR-8, its 24-point tenant AI readiness rubric, to measure that foundation across eight areas and to tell an IT leader which group may be licensed now and what has to change before everyone else is. Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot with no change to security or privacy commitments (same source); this page uses both names.
The eight areas, and why eight
Most readiness checklists score three things: licenses, SharePoint oversharing and Purview labels. They are necessary and they are not the tenant. When a licensed user asks Copilot a question, the answer is assembled from eight places, so EPC Group scores eight areas in dependency order:
- Identity. Which Entra account is asking, under which Conditional Access policy, and whether agents have their own identities with owners and expiry.
- Sensitive data. Whether Purview sensitivity labels and DLP actually apply inside the Copilot location, not only on files at rest.
- Content estate. Which SharePoint sites, OneDrive libraries and mailboxes the identity can open, and whether every exposure can be explained before a model finds it.
- Conversations. Whether Teams chats, transcripts and recordings carry retention and classification like other data.
- Reports and dashboards. Whether the Power BI and Fabric semantic models a user can query are certified to be answered from.
- Business applications and CRM. What an agent acting for a user may read or change in Dynamics 365, Dataverse, Power Platform and Copilot Studio.
- Infrastructure and external models. Where any Azure or Microsoft Foundry model runs, what it logs, and how non-Microsoft models reach the tenant.
- Ownership and evidence. Who decided each of the above and who answers when the AI is wrong.
The first three are the prerequisites for enabling Copilot broadly. Areas four through six are the prerequisites for agents that take actions. Area seven is the prerequisite for any external model, and area eight is what keeps the other seven true next quarter. The full rubric, with the Microsoft control that enforces each area and the artifact that proves it, is published at the TAR-8 standard.
How scoring works and where the thresholds sit
Each area is scored 0 unknown, 1 inventoried, 2 controlled, 3 evidenced, for a maximum of 24 points. The bands are 0 to 8 exposed, 9 to 15 inventoried, 16 to 20 controlled and 21 to 24 evidenced. The bands are less important than the gating rules: any area at zero means not ready whatever the total; identity, sensitive data and content estate must each reach two before Copilot is enabled tenant-wide; conversations, reports and business applications must reach two before agents may take actions; infrastructure must reach two before any external model is connected; and ownership is scored again every quarter. It is a rubric, not a benchmark. EPC Group does not publish average-tenant scores, because the areas that matter differ by industry and because a rubric that flatters the reader is not a rubric.
How to know whether your tenant is ready: the content estate check
The area most tenants fail first is the content estate, and it is measured from Microsoft's reports rather than from opinion. The SharePoint Advanced Management data access governance reports, starting with the site permissions baseline report, the sharing links report and the Everyone except external users insights, show which sites carry broad access; Microsoft's risk signals are Anyone and organization-wide links, large audiences with excessive permissions, broken inheritance, sensitive content with weak protection, unlabeled sites and ownerless or inactive sites (Microsoft Learn, Get ready for Microsoft Copilot and agents with SharePoint Advanced Management, accessed 2026-10-20). Purview Data Security Posture Management adds data risk assessments that pair sensitive content with risky sharing (Microsoft Learn, Configure a secure and governed foundation for Microsoft Copilot, accessed 2026-10-20). A score of one means those reports have been run and read; two means every high-risk site has an owner and either a permission fix or an interim Restricted Content Discovery setting; three means the evidence is retained for an auditor. EPC Group's Copilot readiness assessment delivers this area as a site-by-site register, not a single number.
A Copilot pilot checklist for IT leaders
Once identity, sensitive data and content estate score two, a scoped pilot can begin without waiting for the other five areas. EPC Group recommends the following gate for the pilot group:
- Confirm each pilot user holds an eligible base license and a Copilot license, or is on the Copilot Chat path that Microsoft makes available to eligible users without a Copilot license (Microsoft Learn, License options for Microsoft Copilot, accessed 2026-10-20).
- Confirm Conditional Access covers the Copilot app surfaces the pilot will use, and that the pilot mailboxes are in Exchange Online.
- Confirm the Purview DLP policy for the Copilot location is in enforce mode for the labels that matter, and that Restricted Content Discovery is set on every high-risk site in the register.
- Turn on the Microsoft Copilot Dashboard in Viva Insights before day one. It reports readiness, adoption, impact and sentiment, it is available to Microsoft 365 customers without a paid Viva Insights license, and it counts an active user as anyone who performed at least one Copilot activity in the previous 28 days (Microsoft Learn, Connect to the Microsoft Copilot Dashboard for Microsoft 365 customers, accessed 2026-10-20).
- Name the owner who reviews the audit log and the dashboard weekly during the pilot, which is the first evidence item for area eight.
The Copilot consulting practice runs the pilot against this gate and hands back the remediation backlog for the remaining areas.
What the report contains
The deliverable has three parts. The scored tenant: eight areas, each with its score, the Microsoft control that enforces it and the artifact reviewed. The remediation sequence: the fixes in dependency order, with the interim control for each exposure and the gating rule it unblocks. The evidence pack: the exported reports, configuration screenshots and policy definitions an auditor, insurer or board will accept. When a tenant is not ready, the report says so by rule rather than by impression, names the scoped group that can still proceed, and lists what must change for the next group.
Documented work
ANON-CASES: EPC Group engagement data from TAR-8 assessments covers mid-size and large organizations in healthcare, financial services and manufacturing, delivered by the firm's Copilot consulting practice. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- Get ready for Microsoft Copilot and agents with SharePoint Advanced Management — Microsoft Learn, accessed 2026-10-20
- Microsoft Copilot requirements — Microsoft Learn, accessed 2026-10-20
- License options for Microsoft Copilot — Microsoft Learn, accessed 2026-10-20
- Configure a secure and governed foundation for Microsoft Copilot — Microsoft Learn, accessed 2026-10-20
- Restricted SharePoint Search — Microsoft Learn, accessed 2026-10-20
- Connect to the Microsoft Copilot Dashboard for Microsoft 365 customers — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
What are the eight readiness areas and why eight?
The eight areas, in dependency order, are identity (Entra), sensitive data (Purview), content estate (SharePoint, OneDrive, Exchange), conversations (Teams), reports and dashboards (Power BI and Fabric), business applications and CRM (Dynamics 365, Dataverse, Power Platform, Copilot Studio), infrastructure and external models (Azure and Microsoft Foundry), and ownership and evidence. There are eight because a Copilot answer is assembled from all of them: who is asking, which labels apply, what the identity can read, what an agent may change, where the model runs, and who answers when it is wrong.
How is oversharing measured and what score is acceptable?
Oversharing is the content estate area, scored zero to three. Zero means exposure is unknown; one means it is inventoried through the SharePoint data access governance reports, sharing link reports and Everyone except external users insights (Microsoft Learn, Get ready for Microsoft Copilot and agents with SharePoint Advanced Management, accessed 2026-10-20); two means every high-risk site has an owner and a remediation or an interim Restricted Content Discovery setting; three means the evidence is retained. Enabling Copilot beyond a pilot requires a two. EPC Group does not publish average-tenant percentages.
Which licenses and prerequisites does Copilot require (Microsoft, attributed)?
Microsoft lists an eligible Microsoft 365 base license, a Copilot license, a Microsoft Entra ID account, an Exchange Online mailbox for mailbox-grounded experiences, supported apps and browsers, and network requirements (Microsoft Learn, Microsoft Copilot requirements, accessed 2026-10-20). Eligible base plans include Microsoft 365 E3, E5, F1 and F3, Office 365 E1, E3 and E5 and Microsoft 365 Business plans; Copilot Business is an add-on for organizations with up to 300 users (Microsoft Learn, License options for Microsoft Copilot, accessed 2026-10-20). Pricing comes from Microsoft or the licensing partner.
How long does the assessment take and what access does it need?
The schedule is fixed at the scoping call and depends on tenant size, the workloads in scope and stakeholder availability for the ownership interviews; EPC Group does not publish a single duration because the content estate review scales with site count. Access is read-only: reporting roles in the SharePoint admin center, Microsoft Purview, Microsoft Entra and the Microsoft 365 admin center, plus exports of the data access governance reports. The assessment reads configuration and reports; it changes no tenant settings.
What does the report recommend when a tenant is not ready?
The report states which gating rule failed, lists the remediation sequence by area in dependency order, and names interim controls such as Restricted Content Discovery for high-risk sites and a Purview DLP policy for the Copilot location (Microsoft Learn, Configure a secure and governed foundation for Microsoft Copilot, accessed 2026-10-20). It does not recommend Restricted SharePoint Search, which Microsoft is retiring with new enablement blocked starting July 31, 2026 (Microsoft Learn, Restricted SharePoint Search, accessed 2026-10-20). It also identifies a scoped pilot group that can proceed safely.
Talk to a senior architect
If your organization is deciding how many Copilot licenses to buy and when, a 30-minute discovery call with a senior EPC Group architect will walk through the eight areas against your tenant and identify the first safe pilot group. See the Copilot readiness assessment service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.