Copilot-Ready Data Governance: The Microsoft Purview Checklist

Here is the part of the Microsoft 365 Copilot rollout nobody puts in the timeline. The model is shipped. The licenses are bought. The launch email has been drafted. And somewhere in IT, an architect is staring at a tenant that has been collecting access grants for fifteen years and quietly working out the math on how many files are about to be surfaced to users who were never supposed to see them.

I have walked into that conversation enough times to write the checklist down. Here it is. Print it. Hand it to your tenant admin. Use it as the pre-deployment gate. Nothing below is theoretical — every item is something we configure on the 30-Day Copilot, Purview & M365 Tenant Hardening Accelerator ($35,000 fixed fee, productized precisely because the work has a known shape and shouldn't be sold by the hour, forever).

Stage 1 — Inventory the surface area

1. Tenant baseline. Pull the tenant's active SharePoint sites, OneDrive accounts, Teams, Microsoft 365 groups, and shared mailboxes via Microsoft Graph. Count is more useful than nice-to-have inventories — if you do not know the number, you do not know the scope.
2. Identity baseline. Enumerate every OAuth grant, app registration, service principal, and managed identity in Entra. For most enterprises this is the first time the non-human identity count gets measured. It will surprise you (see also our shadow AI / identity blind spot piece).
3. AI surface area. Inventory every Copilot Studio agent, custom GPT, Power Platform automation with AI in the loop, and existing Copilot for Microsoft 365 license assignment. This is the input to the Governed AI on Microsoft Framework — see Agentic AI Governance.
4. External sharing exposure. Run reports on Anyone links, External user access, and shared channels with cross-tenant collaboration. The reports are not the deliverable — the prioritized remediation list is.

Stage 2 — Classify, then label

1. Sensitivity label taxonomy. Three to five labels, not twenty. Public, Internal, Confidential, Highly Confidential, Regulated (HIPAA/FINRA/CUI as applicable). More labels generates more incorrect labels.
2. Label policies published. Default label per user group, encryption at the Confidential tier and above, watermarking where compliance demands it. Labels that exist but are not published do nothing.
3. Auto-labeling rules. This is where most engagements stop too soon. Auto-labeling on content matches — credit card numbers, SSNs, PHI patterns, custom dictionaries for client identifiers — must run across the SharePoint and OneDrive estate, not just on new content. Plan for backfill load on tenant.
4. Label inheritance. Site-level labels for SharePoint and Teams that apply to all child content. Cuts the per-file work dramatically.
5. Sensitivity label scan baseline. Before remediation, capture the count of unlabeled / mislabeled / correctly-labeled files. This number is your evidence in 90 days.

Stage 3 — Remediate oversharing

1. Anyone link remediation. Inventory then time-box expiration on existing Anyone links, then disable Anyone links at the tenant level for sensitive content. Yes, you will get angry tickets. You will also stop the largest single source of post-Copilot incidents we see.
2. “Everyone except external users” cleanup. The grant nobody intentionally created. SharePoint Modern Pages will quietly add this. Find every site with this grant, evaluate intent, narrow to the actual business need.
3. Restricted SharePoint Search (RSS). For tenants that cannot remediate oversharing fast enough before Copilot rollout, RSS limits Copilot's reach to a curated set of sites during the transition. This is a tactical control, not a strategic one — remediation must continue.
4. DLP for Copilot grounding. Microsoft Purview DLP policies tuned for AI prompts (egress control), data sharing with Copilot connectors, and Power Automate-based exfil paths. Policies in audit mode for two weeks before enforcement.
5. Site-level access reviews. Entra ID Access Reviews scheduled quarterly on the highest-risk site collections, with site owners as the reviewers. This is the only sustainable control after the initial remediation.

Stage 4 — Govern non-human identity

This stage is the one most Copilot readiness checklists do not even mention. It is also the one your future self will most thank you for. See the deep-dive at AI Identity Security.

1. OAuth grant lifecycle. Every user-consented OAuth grant has a named owner, a scheduled review, and an automatic expiry if not re-certified. The grant from the AI tool an analyst connected last year that you forgot exists — that is the one that becomes the breach vector.
2. Service principal / app registration baseline. Every app registration owned by a named human (not a departed employee), with permissions justified, and an annual review cadence.
3. Workload identity conditional access. Conditional access policies applied to service principals — IP restrictions, certificate-based auth where viable, sign-in risk evaluation.
4. Copilot Studio agent inventory. Microsoft Agent 365 or equivalent inventory of every Copilot Studio agent in the tenant, with owner attribution, decision boundaries, and kill-switch readiness.

Stage 5 — Audit and monitor

1. Audit log retention. Microsoft Purview audit log retention configured for the compliance period your industry requires (1 year minimum; longer for FedRAMP, FINRA, HIPAA).
2. SIEM integration. Microsoft Sentinel or your existing SIEM ingesting Copilot interaction logs, Purview policy hits, Entra sign-ins for workload identities. Logs your team does not actually review are not protection — they are evidence collected for the next incident.
3. Defender for Cloud Apps for AI. Discovery of shadow AI usage in the tenant, automated alerts on unsanctioned AI traffic, and policy enforcement for sensitive-data exfil to AI surfaces.
4. Kill-switch readiness drill. Documented, tested process for suspending Copilot or specific agents in seconds. If you cannot turn it off fast, you do not control it.
5. Compliance reporting cadence. Monthly audit-readiness reports — Purview policy effectiveness, oversharing trend, label adoption rate, non-human identity sprawl. The reports your auditor will ask for in advance, not after the finding.

Stage 6 — The change-management piece

1. Pilot cohort selection. 50–100 users across business functions, with clear success criteria and telemetry from day one. Not the executive cohort first — they will not produce the signal you need.
2. Adoption telemetry. Return visits, action taken, feedback loop captured. See the methodology at Data Literacy & Adoption.
3. Sanctioned fast lane. A request-to-access path for additional Copilot capabilities measured in hours, not committee cycles. The fast lane is the only durable shadow-AI fix — see our shadow AI governance breakdown.
4. Communication plan. Honest about what Copilot can and cannot do. The trust signal is honesty, not enthusiasm.

What this costs and who runs it

EPC Group runs Stages 1-4 of this checklist as the 30-Day Copilot, Purview & M365 Tenant Hardening Accelerator — $35,000 fixed fee, published price, defined deliverables. Stages 5-6 land on either the Managed Microsoft Services contract (the Operate stage of The EPC Group Lifecycle) or a follow-on engagement priced from the accelerator catalog at /fixed-fee-accelerators-microsoft-consulting.

The accelerator approach is not philosophical — it is the only model under which we will sell this work. Hourly billing for governance work creates the wrong incentive for the consultant; fixed-fee with milestone-based payment creates the right one for everyone. See Premium by Design for the long-form on why.

Where this connects

This checklist is the operational implementation of:

• Agentic AI Governance — the seven-layer Governed AI on Microsoft Framework.
• AI Identity Security — non-human identity governance.
• Data Governance — the Govern stage of The EPC Group Lifecycle.
• Microsoft Purview Consulting — the platform engineering.
• Microsoft Copilot Consulting — the rollout itself.
• Standards Alignment — the NIST AI RMF / COBIT / ITIL / DAMA mappings for your auditor.

Inventory the surface. Classify the data. Remediate the oversharing. Govern the identities. Audit everything. In that order.

Multiple models. One truth. Govern accordingly.