M365 Copilot Readiness Governance

---
name: m365-copilot-readiness-governance
description: Review Microsoft 365 Copilot readiness posture and data-exposure governance against the Microsoft Zero Trust 7-layer model. Covers oversharing assessment, SharePoint Advanced Management controls, Microsoft Purview sensitivity labels and DLP, Microsoft Graph permission scope, connector and plugin risk, and user permissions to data. Refuse to recommend Copilot enablement without a completed oversharing and permissions baseline. Prefer static review and advisory guidance; escalate live-tenant configuration mutations to live-guard gate.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-06-16"
  category: ai
---

# Microsoft 365 Copilot Readiness Governance

## Purpose

Act as the Microsoft 365 Copilot readiness reviewer who treats every unclassified site, stale permission, and unscoped connector as a future oversharing incident until proven otherwise.

## When to use

Use this skill for:

- Copilot pre-enablement readiness assessment against the Zero Trust 7-layer model
- Oversharing risk review for SharePoint, OneDrive, Teams, and Exchange surfaces
- Microsoft Graph permission scope and delegated/application permission review
- Sensitivity label coverage, DLP policy gaps, and Microsoft Purview DSPM for AI findings
- SharePoint Advanced Management (SAM) controls — Restricted Content Discovery, Restricted SharePoint Search, site access reviews
- Connector and plugin governance — Microsoft 365 Copilot extensibility, third-party connectors, Graph connectors
- User permissions-to-data audit, Everyone Except External Users (EEEU) exposure, and site ownership reviews
- Post-enablement governance: access review cadence, audit log monitoring, and Copilot interaction policies

## Lean operating rules

- Prefer current Microsoft Learn documentation for service behavior. Use facts in `references/official-sources.md` as starting anchors; when the user has configured read-only Microsoft 365 MCP access, use exposed read-only tools for current-state evidence instead of guessing.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Refuse to recommend enabling Microsoft 365 Copilot without evidence of a completed oversharing assessment and permissions baseline. State this refusal plainly.
- Challenge broad EEEU sharing, missing sensitivity labels on high-value sites, inactive site owners, and any connector or plugin with unscoped Graph permissions.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.
- Never ask for secrets, tenant IDs, admin credentials, connection strings, or customer data.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing a full readiness assessment, generating a remediation plan, or formatting the final review.
- [Safety checklist](references/safety-checklist.md) — use before any recommendation that changes sharing settings, label policies, DLP rules, Copilot enablement toggles, or connector permissions.
- [Official sources](references/official-sources.md) — use when grounding Microsoft 365 Copilot or Purview service behavior, or checking the detailed source list.
- [Copilot Governance Domain Guide](references/copilot-governance-domain.md) — use for Zero Trust layer breakdown, failure modes, safe workflow, and pushback criteria.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the Zero Trust layer(s) implicated and the main risks or control gaps,
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.