How Do You Successfully Deploy Microsoft 365 Copilot Across an Enterprise?

1
00:00:00,000 --> 00:00:04,020
Picture a global enterprise with offices across Europe, North America and Asia.

2
00:00:04,020 --> 00:00:05,840
The board has asked for an AI plan.

3
00:00:05,840 --> 00:00:08,020
The CEO wants a visible result this quarter.

4
00:00:08,020 --> 00:00:12,120
Procurement has negotiated the co-pilot agreement, the licenses are approved, and the first

5
00:00:12,120 --> 00:00:15,400
pilot group has already been told they'll get access next month.

6
00:00:15,400 --> 00:00:16,880
On paper, the project looks simple.

7
00:00:16,880 --> 00:00:22,160
Assign licenses, send a launch email, run a few training sessions, show usage in a dashboard,

8
00:00:22,160 --> 00:00:24,760
then the CISO asks a question that changes the meeting.

9
00:00:24,760 --> 00:00:27,960
What can co-pilot expose through the permissions we already have?

10
00:00:27,960 --> 00:00:29,740
Nobody in the room has a clean answer.

11
00:00:29,740 --> 00:00:32,400
The SharePoint estate has grown for more than a decade.

12
00:00:32,400 --> 00:00:34,480
There are project sites with no named owner.

13
00:00:34,480 --> 00:00:37,900
Teams created for initiatives that ended years ago still hold documents.

14
00:00:37,900 --> 00:00:40,620
OneDrive folders have been shared through old links.

15
00:00:40,620 --> 00:00:43,820
Some groups include external guests who no one has reviewed recently.

16
00:00:43,820 --> 00:00:47,700
A finance library has broken inheritance because someone needed to share one file quickly,

17
00:00:47,700 --> 00:00:49,520
which is how these things often start.

18
00:00:49,520 --> 00:00:51,040
Co-pilot doesn't invent new access.

19
00:00:51,040 --> 00:00:54,480
It works within the access a user already has, but that's exactly the issue.

20
00:00:54,480 --> 00:00:58,100
For years, weak permissions can hide in plain sight because most people don't know where

21
00:00:58,100 --> 00:00:59,100
to look.

22
00:00:59,100 --> 00:01:03,120
A document may sit in an old site, buried in a library with a vague name.

23
00:01:03,120 --> 00:01:06,960
Accessible to far more people than intended, it exists, but it's hard to find.

24
00:01:06,960 --> 00:01:08,200
Co-pilot changes that experience.

25
00:01:08,200 --> 00:01:12,520
It can make information easier to discover, connect, summarize, and reuse.

26
00:01:12,520 --> 00:01:13,720
That's the business promise.

27
00:01:13,720 --> 00:01:16,600
It can also make old oversharing far easier to act on.

28
00:01:16,600 --> 00:01:21,000
So the CIOC speed, the CSOC's exposure, finance sees a growing license commitment.

29
00:01:21,000 --> 00:01:24,040
Business leaders see people already using public AI tools because they're trying to get

30
00:01:24,040 --> 00:01:25,040
work done faster.

31
00:01:25,040 --> 00:01:26,140
All of them are right.

32
00:01:26,140 --> 00:01:28,480
The real question isn't whether you can deploy Co-pilot.

33
00:01:28,480 --> 00:01:29,480
You can.

34
00:01:29,480 --> 00:01:32,960
The question is whether you can turn it into a secure, scalable business capability rather

35
00:01:32,960 --> 00:01:37,160
than an expensive pilot that creates a few good demos, a spike in support tickets, and

36
00:01:37,160 --> 00:01:39,560
a difficult conversation at the next renewal.

37
00:01:39,560 --> 00:01:41,200
This isn't a software decision alone.

38
00:01:41,200 --> 00:01:42,720
It's an operating model decision.

39
00:01:42,720 --> 00:01:47,660
You're deciding how your organization will use AI with its data, how it will manage risk,

40
00:01:47,660 --> 00:01:53,800
who will own outcomes, and what evidence leadership will require before it spends more.

41
00:01:53,800 --> 00:01:55,760
Executive summary, the consultants answer.

42
00:01:55,760 --> 00:01:57,440
My recommendation is straightforward.

43
00:01:57,440 --> 00:02:02,160
To deploy Microsoft, 365 Co-pilot in phases, don't treat it as a tenant-wide license event.

44
00:02:02,160 --> 00:02:05,920
Start with a small number of business scenarios where work is repeatable, the process has a clear

45
00:02:05,920 --> 00:02:09,160
owner, the data risk is understood, and you can measure the result.

46
00:02:09,160 --> 00:02:13,360
At the same time, assess identity, data access, information structure, governance, security

47
00:02:13,360 --> 00:02:17,240
controls, and the support model needed to run this as an enterprise service.

48
00:02:17,240 --> 00:02:18,680
That sequence matters.

49
00:02:18,680 --> 00:02:21,680
Most Co-pilot programs don't fail because users can't open the app.

50
00:02:21,680 --> 00:02:25,120
They stall because the organization hasn't decided what good looks like, who owns the

51
00:02:25,120 --> 00:02:28,360
risk or how it will prove value beyond people saying they like the tool.

52
00:02:28,360 --> 00:02:30,680
The biggest risk is existing oversharing.

53
00:02:30,680 --> 00:02:31,960
Co-pilot respects permissions.

54
00:02:31,960 --> 00:02:35,880
If someone can access a file, co-pilot may use that file as context for that person.

55
00:02:35,880 --> 00:02:38,720
So your permission model becomes your AI access model.

56
00:02:38,720 --> 00:02:44,080
Old broad groups, unmanaged guest access, stale sites, and unclear ownership don't become

57
00:02:44,080 --> 00:02:45,920
less relevant because AI arrives.

58
00:02:45,920 --> 00:02:47,240
They become more visible.

59
00:02:47,240 --> 00:02:48,240
Here's the trade-off.

60
00:02:48,240 --> 00:02:52,280
You can move fast by limiting the initial scope using low-risk cohorts and control data

61
00:02:52,280 --> 00:02:54,680
sources when you repair the wider estate.

62
00:02:54,680 --> 00:02:58,760
Before you can attempt broad access immediately and accept that governance debt will arrive

63
00:02:58,760 --> 00:03:02,200
during the rollout when the cost and pressure are much higher.

64
00:03:02,200 --> 00:03:05,600
The biggest opportunity is not AI productivity in the abstract.

65
00:03:05,600 --> 00:03:09,880
It's reducing time lost in repeatable knowledge work, preparing for meetings, finding the

66
00:03:09,880 --> 00:03:14,400
current version of a policy, turning a long email chain into decisions and actions, creating

67
00:03:14,400 --> 00:03:16,600
a first draft from approved material.

68
00:03:16,600 --> 00:03:20,440
Pulling together a project update from information that already exists across Microsoft

69
00:03:20,440 --> 00:03:21,760
365.

70
00:03:21,760 --> 00:03:26,080
Those are useful scenarios because they connect co-pilot to work that people already do.

71
00:03:26,080 --> 00:03:30,440
A good deployment produces measurable workflow gains, control expansion, and a spend that

72
00:03:30,440 --> 00:03:31,920
leadership can defend.

73
00:03:31,920 --> 00:03:35,920
It also produces something less visible but more important, an operating model for the next

74
00:03:35,920 --> 00:03:39,760
wave of AI capabilities including agents, connectors, and automation.

75
00:03:39,760 --> 00:03:41,840
You should expect some scenarios to fail.

76
00:03:41,840 --> 00:03:42,840
That's fine.

77
00:03:42,840 --> 00:03:46,400
A pilot should tell you where co-pilot helps, where the process needs repair, where training

78
00:03:46,400 --> 00:03:49,720
falls short, and where controls need tightening.

79
00:03:49,720 --> 00:03:54,240
If every pilot scenario succeeds, you probably select only the easy ones, which is not the

80
00:03:54,240 --> 00:03:55,640
same as proving you can scale.

81
00:03:55,640 --> 00:03:56,640
So let's zoom out.

82
00:03:56,640 --> 00:04:01,040
Leadership in IT often look at the same co-pilot deployment and see different problems.

83
00:04:01,040 --> 00:04:05,680
Until those views meet in one business decision, the technology discussion stays noisy.

84
00:04:05,680 --> 00:04:07,680
Why co-pilot projects start now?

85
00:04:07,680 --> 00:04:11,240
Co-pilot projects rarely begin because an organization woke up one morning with a perfect

86
00:04:11,240 --> 00:04:12,240
AI strategy.

87
00:04:12,240 --> 00:04:16,080
They begin because the board asks what the company is doing with AI, employees are already

88
00:04:16,080 --> 00:04:20,800
trying public tools, and competitors are talking about faster service, lower cost, and more productive

89
00:04:20,800 --> 00:04:21,800
teams.

90
00:04:21,800 --> 00:04:25,040
The pressure is real and doing nothing can look like a decision in itself.

91
00:04:25,040 --> 00:04:26,840
You may also have a quieter problem.

92
00:04:26,840 --> 00:04:30,520
People already spend large parts of their day looking for information, reading long email

93
00:04:30,520 --> 00:04:34,520
threads, turning meeting notes into actions, and creating first drafts from material that

94
00:04:34,520 --> 00:04:36,320
exists somewhere in the business.

95
00:04:36,320 --> 00:04:37,720
Those are not new problems.

96
00:04:37,720 --> 00:04:41,880
Co-pilot puts a very visible option in front of leadership to reduce that friction, but

97
00:04:41,880 --> 00:04:43,680
it changes the shape of the conversation.

98
00:04:43,680 --> 00:04:47,160
Your data is already spread across teams, SharePoint, OneDrive, and Exchange.

99
00:04:47,160 --> 00:04:49,360
A project decision may sit in a team's chat.

100
00:04:49,360 --> 00:04:51,400
The formal document may sit in SharePoint.

101
00:04:51,400 --> 00:04:53,440
The latest approval may exist in email.

102
00:04:53,440 --> 00:04:57,360
A person preparing for a customer meeting may have to piece all of that together manually,

103
00:04:57,360 --> 00:04:58,680
often under time pressure.

104
00:04:58,680 --> 00:05:01,440
This is where Microsoft 365 co-pilot can be useful.

105
00:05:01,440 --> 00:05:06,800
It works in the context of work already happening across the Microsoft 365 estate, rather than

106
00:05:06,800 --> 00:05:11,800
asking users to move content into a separate AI tool every time they need help.

107
00:05:11,800 --> 00:05:14,920
That convenience is also why the deployment decision carries weight.

108
00:05:14,920 --> 00:05:18,760
A standalone chat tool can be useful for generic drafting or public research.

109
00:05:18,760 --> 00:05:20,640
Co-pilot's business case is different.

110
00:05:20,640 --> 00:05:24,880
Its potential value comes from helping people work with the document's conversations, meetings,

111
00:05:24,880 --> 00:05:28,080
and relationships that already shape their daily decisions.

112
00:05:28,080 --> 00:05:31,480
So leadership sees an opportunity to reduce friction in knowledge work.

113
00:05:31,480 --> 00:05:35,160
They want to know whether proposal teams can respond faster, whether managers can spend

114
00:05:35,160 --> 00:05:39,320
less time assembling status reports, whether sales teams can prepare for customer conversations

115
00:05:39,320 --> 00:05:43,440
with less manual research, whether employees can recover time from meetings that create

116
00:05:43,440 --> 00:05:44,960
more follow-up than progress.

117
00:05:44,960 --> 00:05:46,680
Those are fair questions.

118
00:05:46,680 --> 00:05:48,880
It sees the other side of the same promise.

119
00:05:48,880 --> 00:05:52,960
More usage means more demand for help, more questions about what co-pilot can access, more

120
00:05:52,960 --> 00:05:57,760
pressure on identity controls, and more concern when an answer draws from content that a user

121
00:05:57,760 --> 00:06:00,400
did not realize they could reach.

122
00:06:00,400 --> 00:06:02,400
Security teams don't want vague reassurance.

123
00:06:02,400 --> 00:06:06,520
They want to know which controls apply, what evidence exists, who reviews exceptions,

124
00:06:06,520 --> 00:06:08,520
and what happens when something goes wrong.

125
00:06:08,520 --> 00:06:09,840
Violence has a different concern.

126
00:06:09,840 --> 00:06:12,160
Should every employee receive a license?

127
00:06:12,160 --> 00:06:16,240
Or should licenses go first to roles where the work pattern and potential benefit are clear?

128
00:06:16,240 --> 00:06:20,520
A broad rollout can create momentum, but it can also create a large recurring cost

129
00:06:20,520 --> 00:06:23,600
before the organization has proved that work actually changed.

130
00:06:23,600 --> 00:06:24,760
Here's the trade-off.

131
00:06:24,760 --> 00:06:29,280
Targeted licensing gives you more control and clearer evidence, but it can create frustration

132
00:06:29,280 --> 00:06:31,400
among employees who want access.

133
00:06:31,400 --> 00:06:35,520
Broad licensing creates a sense of fairness and speed, but it often turns the value discussion

134
00:06:35,520 --> 00:06:38,960
into an argument about usage reports rather than business outcomes.

135
00:06:38,960 --> 00:06:40,760
In practice, both approaches can work.

136
00:06:40,760 --> 00:06:42,720
The choice depends on what you're trying to learn first.

137
00:06:42,720 --> 00:06:46,840
If your immediate goal is to prove value, start where there's a defined workflow and an

138
00:06:46,840 --> 00:06:48,360
accountable business leader.

139
00:06:48,360 --> 00:06:52,520
If your goal is broad AI literacy, you may choose wider access, but you still need a

140
00:06:52,520 --> 00:06:55,640
way to separate exploration from measurable business benefit.

141
00:06:55,640 --> 00:06:58,280
The real question is not whether co-pilot has useful features.

142
00:06:58,280 --> 00:07:02,160
The real question is, what business decision you are trying to improve, what work you expect

143
00:07:02,160 --> 00:07:06,240
to change, and what proof leadership will accept before you expand?

144
00:07:06,240 --> 00:07:11,360
Until that is clear, technical readiness becomes a checklist without a purpose.

145
00:07:11,360 --> 00:07:13,960
Executive strategy to find the business decision.

146
00:07:13,960 --> 00:07:16,120
Before you assess the tenant, define the decision.

147
00:07:16,120 --> 00:07:18,040
Why are you deploying co-pilot in the first place?

148
00:07:18,040 --> 00:07:19,960
Not why the board thinks AI matters.

149
00:07:19,960 --> 00:07:22,280
Not why Microsoft has put it on every roadmap.

150
00:07:22,280 --> 00:07:23,680
What change is in the business?

151
00:07:23,680 --> 00:07:24,840
If this deployment works?

152
00:07:24,840 --> 00:07:28,480
If the answer is, we want people to be more productive, you haven't defined a decision

153
00:07:28,480 --> 00:07:29,480
yet.

154
00:07:29,480 --> 00:07:30,480
You've described a hope.

155
00:07:30,480 --> 00:07:33,800
Useful strategy starts with a specific business problem.

156
00:07:33,800 --> 00:07:37,760
Maybe proposal teams lose too much time finding prior content and turning it into a first

157
00:07:37,760 --> 00:07:38,760
draft.

158
00:07:38,760 --> 00:07:42,880
Maybe managers spend too much time after meetings chasing actions across email and teams.

159
00:07:42,880 --> 00:07:46,200
Maybe service teams can't find the latest approved answer while a customer waits.

160
00:07:46,200 --> 00:07:47,240
Those are different problems.

161
00:07:47,240 --> 00:07:50,680
They need different owners, measures, controls, and rollout plans.

162
00:07:50,680 --> 00:07:54,240
The first task in a consulting engagement is to separate demand from value.

163
00:07:54,240 --> 00:07:56,040
Lots of employees may want co-pilot.

164
00:07:56,040 --> 00:07:57,280
That tells you there is interest.

165
00:07:57,280 --> 00:08:00,080
It does not tell you whether organization should invest first.

166
00:08:00,080 --> 00:08:05,240
You need an executive sponsor who can make decisions across the business, not just approve a budget.

167
00:08:05,240 --> 00:08:09,120
This person needs enough authority to bring business leaders, security, finance, legal

168
00:08:09,120 --> 00:08:13,040
HR, and IT into the same conversation when the trade-offs get uncomfortable.

169
00:08:13,040 --> 00:08:15,040
A CIO can sponsor the platform.

170
00:08:15,040 --> 00:08:16,360
That makes sense.

171
00:08:16,360 --> 00:08:21,240
But if the CIO is the only sponsor, the project can quickly become an IT rollout with a business

172
00:08:21,240 --> 00:08:22,240
audience.

173
00:08:22,240 --> 00:08:25,840
Then IT owns the license count to the support queue and the risk while business leaders

174
00:08:25,840 --> 00:08:29,280
wait for someone else to explain the value that model rarely holds.

175
00:08:29,280 --> 00:08:32,920
The sponsor needs to ask business leaders a more direct question, where do you have work

176
00:08:32,920 --> 00:08:37,440
that is repeated often enough, painful enough, and clear enough to improve, start, there?

177
00:08:37,440 --> 00:08:42,080
A good initial scenario has a known process, a group of users who perform it often, and

178
00:08:42,080 --> 00:08:44,680
an accountable leader who can say whether the work improved.

179
00:08:44,680 --> 00:08:45,840
It also has a baseline.

180
00:08:45,840 --> 00:08:48,720
Without one, every claim after launch becomes opinion.

181
00:08:48,720 --> 00:08:53,640
Consider a sales or bid team that repeatedly prepares responses from approved company material.

182
00:08:53,640 --> 00:08:57,480
The potential benefit may come from faster discovery, faster first drafts, and less time

183
00:08:57,480 --> 00:08:59,960
recreating content that already exists.

184
00:08:59,960 --> 00:09:02,200
But you still need to know how the team works today.

185
00:09:02,200 --> 00:09:05,400
How long does it take to prepare a first response, where does rework occur?

186
00:09:05,400 --> 00:09:06,400
Who approves the output?

187
00:09:06,400 --> 00:09:08,880
Does faster drafting improve the time to submit?

188
00:09:08,880 --> 00:09:11,400
Or does it simply move the waiting time to another stage?

189
00:09:11,400 --> 00:09:13,040
That brings us to the real trade-off.

190
00:09:13,040 --> 00:09:16,840
Copilot can reduce effort within a task, but reduced effort does not automatically create

191
00:09:16,840 --> 00:09:17,840
financial return.

192
00:09:17,840 --> 00:09:22,360
If people save time but use it to absorb more work, improve quality or reduce delays, that

193
00:09:22,360 --> 00:09:23,840
may still be worthwhile.

194
00:09:23,840 --> 00:09:28,040
But you need to state which outcome you expect and who will turn recovered capacity into

195
00:09:28,040 --> 00:09:29,040
business value.

196
00:09:29,040 --> 00:09:31,800
Otherwise, the ROI model becomes a time sheet fantasy.

197
00:09:31,800 --> 00:09:32,800
Everyone has seen those.

198
00:09:32,800 --> 00:09:36,600
They look excellent in a steering pack and disappear when finance asks where the money

199
00:09:36,600 --> 00:09:37,600
went.

200
00:09:37,600 --> 00:09:41,280
Your strategy should name a short portfolio of scenarios, not a long wish list.

201
00:09:41,280 --> 00:09:46,320
For each scenario, document the business owner, user group, current workflow, expected change,

202
00:09:46,320 --> 00:09:50,080
data sensitivity constraints, and the measure that will decide whether it continues.

203
00:09:50,080 --> 00:09:53,600
You also need decision rights who can approve a new pilot scenario.

204
00:09:53,600 --> 00:09:56,160
Who accepts a risk that cannot be fixed before launch?

205
00:09:56,160 --> 00:09:58,880
Who decides that a department receives more licenses?

206
00:09:58,880 --> 00:10:03,120
Who can stop a scenario if it creates poor output, weak adoption, or an unacceptable control

207
00:10:03,120 --> 00:10:04,120
issue?

208
00:10:04,120 --> 00:10:06,360
These decisions shouldn't sit in a vague working group.

209
00:10:06,360 --> 00:10:08,160
A working group is useful for coordination.

210
00:10:08,160 --> 00:10:11,840
It is not useful when someone needs to say yes, no or not yet.

211
00:10:11,840 --> 00:10:16,320
In practice, I would expect the first strategy deliverable to include an executive AI strategy,

212
00:10:16,320 --> 00:10:19,680
a scenario portfolio, and a clear record of decision rights.

213
00:10:19,680 --> 00:10:23,640
It should fit on pages that senior leaders will actually read while linking to the detail

214
00:10:23,640 --> 00:10:25,400
that delivery teams need.

215
00:10:25,400 --> 00:10:26,840
Keep the strategy practical.

216
00:10:26,840 --> 00:10:30,200
It should state what you will do first, what you will not do yet, what evidence you need

217
00:10:30,200 --> 00:10:33,320
before expansion, and what conditions would make you stop.

218
00:10:33,320 --> 00:10:34,640
That last part matters.

219
00:10:34,640 --> 00:10:38,640
A deployment plan, without a stop condition, is usually a spending plan wearing a project

220
00:10:38,640 --> 00:10:39,640
badge.

221
00:10:39,640 --> 00:10:41,960
You're not trying to predict every future co-pilot use case.

222
00:10:41,960 --> 00:10:45,880
You're building a way to make good decisions as those use cases arrive.

223
00:10:45,880 --> 00:10:48,800
Strategy without a view of readiness becomes a wish list.

224
00:10:48,800 --> 00:10:52,520
Next, you need to test whether the environment can support the business promise you've just

225
00:10:52,520 --> 00:10:54,040
made.

226
00:10:54,040 --> 00:10:56,160
Success criteria and the investment case.

227
00:10:56,160 --> 00:11:00,360
Once you have a scenario portfolio, you need to decide what success means before the first

228
00:11:00,360 --> 00:11:02,120
license is assigned.

229
00:11:02,120 --> 00:11:03,120
This sounds obvious.

230
00:11:03,120 --> 00:11:05,080
It rarely happens with enough discipline.

231
00:11:05,080 --> 00:11:09,720
Teams often start with a broad claim such as, "Co-pilot will save time."

232
00:11:09,720 --> 00:11:13,680
Then they look at usage after launch, collect a few positive comments, and call the pilot

233
00:11:13,680 --> 00:11:15,080
a success.

234
00:11:15,080 --> 00:11:21,240
The project team has no shared answer.

235
00:11:21,240 --> 00:11:23,320
Start with the outcome, not the tool activity.

236
00:11:23,320 --> 00:11:26,640
For each scenario, define the business measure that should move.

237
00:11:26,640 --> 00:11:29,920
That might be the cycle time for creating a customer proposal.

238
00:11:29,920 --> 00:11:33,640
It might be the time between a meeting and a agreed action plan.

239
00:11:33,640 --> 00:11:36,680
It might be fewer hours spent finding approved policy content.

240
00:11:36,680 --> 00:11:41,280
In a service team, it may be faster response times with no drop-in-quality or compliance.

241
00:11:41,280 --> 00:11:43,800
Time saved matters, but it isn't enough on its own.

242
00:11:43,800 --> 00:11:48,080
If a manager saves 30 minutes each day and spends it answering more email, you may have improved

243
00:11:48,080 --> 00:11:49,080
their day.

244
00:11:49,080 --> 00:11:51,160
You haven't automatically created a financial benefit.

245
00:11:51,160 --> 00:11:55,640
If that same time lets the manager handle more customer work, reduces the need for overtime,

246
00:11:55,640 --> 00:11:59,720
speeds a decision, or improves the quality of a controlled process, then you can begin

247
00:11:59,720 --> 00:12:01,920
to build a credible investment case.

248
00:12:01,920 --> 00:12:04,080
That distinction needs to be explicit.

249
00:12:04,080 --> 00:12:05,080
Ask the business owner.

250
00:12:05,080 --> 00:12:07,400
If we recover this capacity, what will change?

251
00:12:07,400 --> 00:12:10,520
If they cannot answer, don't claim a hard financial return.

252
00:12:10,520 --> 00:12:13,720
Record it as a productivity or employee experience benefit instead.

253
00:12:13,720 --> 00:12:17,460
Those benefits can still justify investment, but they should not get dressed up as cash

254
00:12:17,460 --> 00:12:19,880
savings because that makes the whole case weaker.

255
00:12:19,880 --> 00:12:21,280
You also need a baseline.

256
00:12:21,280 --> 00:12:23,960
Before the pilot starts, observe the current workflow.

257
00:12:23,960 --> 00:12:26,120
Don't rely only on what people remember.

258
00:12:26,120 --> 00:12:27,640
Measure a sample of real work.

259
00:12:27,640 --> 00:12:30,080
How long does the task take from start to finish?

260
00:12:30,080 --> 00:12:34,000
How much of that time involves searching, drafting, checking, waiting for approval or correcting

261
00:12:34,000 --> 00:12:35,000
mistakes?

262
00:12:35,000 --> 00:12:36,000
Where does work get stuck?

263
00:12:36,000 --> 00:12:39,160
How often does someone redo it because the first version was incomplete or based on

264
00:12:39,160 --> 00:12:40,480
old information?

265
00:12:40,480 --> 00:12:42,520
This is where consultants slow the room down.

266
00:12:42,520 --> 00:12:46,920
A workflow that appears to take two hours may contain 20 minutes of actual effort and

267
00:12:46,920 --> 00:12:48,480
100 minutes of waiting.

268
00:12:48,480 --> 00:12:52,640
Co-pilot may improve the effort, but it won't fix an approval queue, unclear ownership,

269
00:12:52,640 --> 00:12:57,080
or a process that requires three people to revise the same document because nobody agreed

270
00:12:57,080 --> 00:12:58,560
on the source of truth.

271
00:12:58,560 --> 00:12:59,640
Measure quality as well.

272
00:12:59,640 --> 00:13:03,880
For a proposal scenario, quality might mean fewer factual corrections, less rework from

273
00:13:03,880 --> 00:13:06,800
reviewers, and a higher rate of on-time submissions.

274
00:13:06,800 --> 00:13:11,120
For meeting follow-up, it might mean action items with a named owner and due date confirmed

275
00:13:11,120 --> 00:13:12,320
by the meeting lead.

276
00:13:12,320 --> 00:13:16,840
For information retrieval, it might mean users can find approved content faster without relying

277
00:13:16,840 --> 00:13:19,400
on informal messages or outdated copies.

278
00:13:19,400 --> 00:13:21,720
Then separate leading measures from outcome measures.

279
00:13:21,720 --> 00:13:25,440
Leading measures tell you whether people are using the scenario in the intended way.

280
00:13:25,440 --> 00:13:28,240
Are pilot users returning to co-pilot for the task?

281
00:13:28,240 --> 00:13:30,280
Are they using it within the relevant apps?

282
00:13:30,280 --> 00:13:31,800
Are they completing the enablement?

283
00:13:31,800 --> 00:13:34,320
Are managers reinforcing the new workflow?

284
00:13:34,320 --> 00:13:36,280
Outcome measures tell you whether the work changed.

285
00:13:36,280 --> 00:13:37,280
Did cycle time fall?

286
00:13:37,280 --> 00:13:38,880
Did quality hold or improve?

287
00:13:38,880 --> 00:13:40,520
Did the team increase throughput?

288
00:13:40,520 --> 00:13:42,000
Did customer response improve?

289
00:13:42,000 --> 00:13:43,320
Did operational risk reduce?

290
00:13:43,320 --> 00:13:44,320
You need both.

291
00:13:44,320 --> 00:13:46,920
A group can use co-pilot heavily and produce no business result.

292
00:13:46,920 --> 00:13:51,120
Another group may use it less often but gain real value in a high friction task.

293
00:13:51,120 --> 00:13:54,560
Prompt counts and chat activity can help you understand engagement, but they are not the

294
00:13:54,560 --> 00:13:55,720
investment case.

295
00:13:55,720 --> 00:13:58,760
For every scenario, define three decision points before launch.

296
00:13:58,760 --> 00:14:00,320
First, what would make you continue?

297
00:14:00,320 --> 00:14:01,960
Second, what would make you expand?

298
00:14:01,960 --> 00:14:05,120
Third, what would make you stop or remediate before spending more?

299
00:14:05,120 --> 00:14:06,840
Make these conditions concrete.

300
00:14:06,840 --> 00:14:11,360
For example, expansion may require that a scenario meets a target for cycle time improvement,

301
00:14:11,360 --> 00:14:16,560
maintains agreed quality levels, shows repeat use among the pilot group and has no unresolved

302
00:14:16,560 --> 00:14:17,880
control issues.

303
00:14:17,880 --> 00:14:22,520
A stop decision may follow if output quality creates too much rework if users do not change

304
00:14:22,520 --> 00:14:26,560
the workflow after proper support, or if the scenario depends on data that cannot yet

305
00:14:26,560 --> 00:14:27,960
be used safely.

306
00:14:27,960 --> 00:14:29,960
That creates a disciplined business case.

307
00:14:29,960 --> 00:14:34,040
Your initial ROI model should show the full cost, not just the license.

308
00:14:34,040 --> 00:14:38,000
Include enablement support, measurement, governance work, and the time needed from business

309
00:14:38,000 --> 00:14:39,760
leaders and pilot users.

310
00:14:39,760 --> 00:14:43,480
Finance should be able to see each assumption, challenge it, and understand what needs to happen

311
00:14:43,480 --> 00:14:45,040
for the forecast to hold.

312
00:14:45,040 --> 00:14:49,800
The deliverables here are a KPI framework, an initial ROI model, and an executive success

313
00:14:49,800 --> 00:14:50,800
charter.

314
00:14:50,800 --> 00:14:54,320
Together, they define the evidence you will collect and the decisions that evidence will support.

315
00:14:54,320 --> 00:14:57,120
Now you can test whether the tenant can support the promise.

316
00:14:57,120 --> 00:15:00,320
AI readiness assessment scored a real starting point.

317
00:15:00,320 --> 00:15:05,440
You now have a business case, a scenario portfolio, and a clear view of the evidence you need.

318
00:15:05,440 --> 00:15:07,200
The next question is less comfortable.

319
00:15:07,200 --> 00:15:09,520
Are you actually ready to run the pilot you designed?

320
00:15:09,520 --> 00:15:10,520
Not?

321
00:15:10,520 --> 00:15:11,880
Do we own Microsoft 365?

322
00:15:11,880 --> 00:15:12,880
Not?

323
00:15:12,880 --> 00:15:13,880
Can we assign licenses?

324
00:15:13,880 --> 00:15:17,320
The question is whether your current environment can support the specific scenarios you want

325
00:15:17,320 --> 00:15:22,040
to test without creating a voidable risk, poor user experience, or operational work that

326
00:15:22,040 --> 00:15:24,040
nobody planned for.

327
00:15:24,040 --> 00:15:28,080
An AI readiness assessment should not become a workshop where every team rates itself highly

328
00:15:28,080 --> 00:15:29,520
because it owns a tool.

329
00:15:29,520 --> 00:15:31,120
That happens more than people admit.

330
00:15:31,120 --> 00:15:33,440
Security says conditional access exists.

331
00:15:33,440 --> 00:15:35,520
Collaboration says SharePoint has governance.

332
00:15:35,520 --> 00:15:37,080
Identity says MFA is deployed.

333
00:15:37,080 --> 00:15:39,920
Each team says the data is in Microsoft 365.

334
00:15:39,920 --> 00:15:43,520
Each statement may be true, but none of them answers whether the controls work together

335
00:15:43,520 --> 00:15:46,840
for the people, data, and workflows entering the pilot.

336
00:15:46,840 --> 00:15:47,840
Readiness needs evidence.

337
00:15:47,840 --> 00:15:51,760
You assess identity, data access, information architecture, governance, security, post-year

338
00:15:51,760 --> 00:15:53,800
operations, and adoption capacity.

339
00:15:53,800 --> 00:15:56,800
Then you compare the result against the scope you intend to launch.

340
00:15:56,800 --> 00:16:00,600
A tenant may be ready for a controlled pilot with a small group using approved sites while

341
00:16:00,600 --> 00:16:02,960
being nowhere near ready for a broad enterprise rollout.

342
00:16:02,960 --> 00:16:04,240
Those are two different decisions.

343
00:16:04,240 --> 00:16:06,040
Start by defining the assessment boundary.

344
00:16:06,040 --> 00:16:10,080
Each business scenarios are in scope, which user groups will receive licenses, which regions

345
00:16:10,080 --> 00:16:14,320
are involved, which collaboration spaces contain the information they need, which systems

346
00:16:14,320 --> 00:16:17,800
sit outside Microsoft 365 that may affect their work.

347
00:16:17,800 --> 00:16:21,800
Without a boundary, the assessment becomes a massive enterprise cleanup program.

348
00:16:21,800 --> 00:16:24,560
That can be useful, but it will delay every practical decision.

349
00:16:24,560 --> 00:16:29,200
Your goal here is to find what could prevent a safe, useful pilot, and what needs a longer

350
00:16:29,200 --> 00:16:30,200
remediation plan.

351
00:16:30,200 --> 00:16:34,000
Think of a typical enterprise that wants co-pilot to help project managers prepare status

352
00:16:34,000 --> 00:16:35,000
updates.

353
00:16:35,000 --> 00:16:37,360
Access every document in every sharepoint site.

354
00:16:37,360 --> 00:16:43,200
You would assess the sites, teams, mailboxes, access patterns, and users tied to that workflow.

355
00:16:43,200 --> 00:16:47,720
Then you would identify what must change before the pilot, what can be monitored during

356
00:16:47,720 --> 00:16:51,080
it, and what must remain outside the initial scope.

357
00:16:51,080 --> 00:16:53,080
That is risk-based assessment.

358
00:16:53,080 --> 00:16:54,880
For each domain, ask three questions.

359
00:16:54,880 --> 00:16:56,120
First, is there a hard blocker?

360
00:16:56,120 --> 00:17:00,440
A hard blocker means you should not proceed with the planned scope until the issue is resolved.

361
00:17:00,440 --> 00:17:04,400
An example might be a user population without the identity controls your security policy

362
00:17:04,400 --> 00:17:08,960
requires, or a pilot scenario that depends on locations with unmanaged access and no

363
00:17:08,960 --> 00:17:10,920
accountable owner.

364
00:17:10,920 --> 00:17:12,640
Second, is there a manageable gap?

365
00:17:12,640 --> 00:17:16,520
This means the pilot can proceed if you narrow the scope, put a temporary control in place,

366
00:17:16,520 --> 00:17:19,400
or assign a clear remediation owner with a deadline.

367
00:17:19,400 --> 00:17:21,160
Third, is this an accepted risk?

368
00:17:21,160 --> 00:17:23,520
Some gaps will not be fixed before the pilot.

369
00:17:23,520 --> 00:17:26,920
That is normal, but someone with the right authority must accept the risk, understand

370
00:17:26,920 --> 00:17:30,080
the impact, and agree to the boundary around it.

371
00:17:30,080 --> 00:17:32,160
Accepted risk is not the same as ignored risk.

372
00:17:32,160 --> 00:17:33,160
One has an owner.

373
00:17:33,160 --> 00:17:34,160
It comes a surprise.

374
00:17:34,160 --> 00:17:37,360
A useful scorecard does not hide behind one maturity number.

375
00:17:37,360 --> 00:17:41,680
A single score may look tidy in an executive slide, but it can conceal the real issue.

376
00:17:41,680 --> 00:17:44,360
You might have strong identity controls and weak data ownership.

377
00:17:44,360 --> 00:17:48,480
You might have solid security tools, but no operational process to handle user questions,

378
00:17:48,480 --> 00:17:49,880
exceptions, or incidents.

379
00:17:49,880 --> 00:17:52,120
A green average can hide a red problem.

380
00:17:52,120 --> 00:17:54,600
Score each area by business impact and exposure.

381
00:17:54,600 --> 00:17:59,040
If a low-risk scenario uses a limited content set with named owners, an information architecture

382
00:17:59,040 --> 00:18:00,760
gap may be tolerable for the pilot.

383
00:18:00,760 --> 00:18:04,880
If the same gap affects sensitive commercial data across thousands of sites, it carries

384
00:18:04,880 --> 00:18:07,440
a different weight, context decides the rating.

385
00:18:07,440 --> 00:18:10,880
The assessment should also test the difference between policy and practice.

386
00:18:10,880 --> 00:18:15,080
A policy may require site ownership, but how many sites actually have an active owner?

387
00:18:15,080 --> 00:18:19,120
A standard may require labels, but do users apply them in ways that reflect how the business

388
00:18:19,120 --> 00:18:20,120
works?

389
00:18:20,120 --> 00:18:24,080
A governance forum may exist, but can it make a decision within the pace of a pilot?

390
00:18:24,080 --> 00:18:26,760
This is where the real starting point becomes visible.

391
00:18:26,760 --> 00:18:30,120
By the end of this phase, you should have an AI readiness scorecard that lists the

392
00:18:30,120 --> 00:18:35,280
assessed areas, evidence reviewed, risks found, business impact, current control state,

393
00:18:35,280 --> 00:18:37,560
remediation priority, and named owner.

394
00:18:37,560 --> 00:18:40,800
It should make clear what you can launch now, what needs repair first, and what remains

395
00:18:40,800 --> 00:18:41,800
out of scope.

396
00:18:41,800 --> 00:18:44,240
Would you approve your pilot based on that scorecard?

397
00:18:44,240 --> 00:18:48,320
If the answer depends on verbal reassurance from three different teams, you are not ready

398
00:18:48,320 --> 00:18:49,320
yet.

399
00:18:49,320 --> 00:18:53,400
If it shows clear boundaries, owned gaps, and evidence that the intended scope can operate

400
00:18:53,400 --> 00:18:55,720
safely, you can move forward with confidence.

401
00:18:55,720 --> 00:18:59,360
The next area deserves close attention, because identity decides who co-pilot can act

402
00:18:59,360 --> 00:19:01,160
for and what it can reach.

403
00:19:01,160 --> 00:19:03,960
Identity, licensing, and core service readiness.

404
00:19:03,960 --> 00:19:07,760
Identity comes before co-pilot because co-pilot works in the context of a user.

405
00:19:07,760 --> 00:19:09,280
It acts on behalf of that user.

406
00:19:09,280 --> 00:19:11,160
It searches what that user can search.

407
00:19:11,160 --> 00:19:13,600
It brings together information that user can reach.

408
00:19:13,600 --> 00:19:18,080
So if identity is weak, the rest of the deployment sits on weak ground, start with EntraID

409
00:19:18,080 --> 00:19:19,080
health.

410
00:19:19,080 --> 00:19:21,840
You need to know whether your pilot users have strong authentication, whether conditional

411
00:19:21,840 --> 00:19:25,560
access applies in the way you expect, and whether device posture affects access to

412
00:19:25,560 --> 00:19:27,560
Microsoft 365 services.

413
00:19:27,560 --> 00:19:29,200
MFA should be a rollout gate.

414
00:19:29,200 --> 00:19:33,640
If someone can access co-pilot from an unmanaged or risky device without the controls your organization

415
00:19:33,640 --> 00:19:37,120
expects, fix that before you make the service available.

416
00:19:37,120 --> 00:19:39,560
Conditional access needs the same level of review.

417
00:19:39,560 --> 00:19:41,560
Many enterprises have policies that grew over time.

418
00:19:41,560 --> 00:19:45,440
There may be exclusions created for a business unit, a legacy application, a service account,

419
00:19:45,440 --> 00:19:47,240
or an urgent project from years ago.

420
00:19:47,240 --> 00:19:50,280
The policy still exists because removing it feels risky.

421
00:19:50,280 --> 00:19:51,280
That is understandable.

422
00:19:51,280 --> 00:19:54,560
It also means you need to know whether the pilot population falls into one of those gaps.

423
00:19:54,560 --> 00:19:55,960
Check privileged access as well.

424
00:19:55,960 --> 00:20:00,080
A co-pilot deployment does not create a new reason for weak admin practice.

425
00:20:00,080 --> 00:20:04,880
Review who can assign licenses, change access groups, alter sharing settings, or modify policies

426
00:20:04,880 --> 00:20:06,400
that affect the pilot.

427
00:20:06,400 --> 00:20:07,720
Use least privilege.

428
00:20:07,720 --> 00:20:10,520
Keep privileged roles separate from ordinary user accounts.

429
00:20:10,520 --> 00:20:14,360
Make sure emergency access accounts are governed, tested, and not quietly used as a normal

430
00:20:14,360 --> 00:20:15,360
workaround.

431
00:20:15,360 --> 00:20:18,400
That last one always sounds obvious until you find it in the logs.

432
00:20:18,400 --> 00:20:19,960
Then move to licensing.

433
00:20:19,960 --> 00:20:22,840
The technical task of assigning a co-pilot license is simple.

434
00:20:22,840 --> 00:20:24,160
The management decision is not.

435
00:20:24,160 --> 00:20:28,320
You need to confirm that each target user has an eligible based license and that your license

436
00:20:28,320 --> 00:20:31,000
assignment method matches the rollout model.

437
00:20:31,000 --> 00:20:33,240
Individual assignment may work for a small pilot.

438
00:20:33,240 --> 00:20:37,120
Once you move into controlled waves, group based licensing through enter ID security groups

439
00:20:37,120 --> 00:20:41,240
usually gives you more control, clearer ownership, and a better audit path.

440
00:20:41,240 --> 00:20:44,160
Build those groups around the business decision.

441
00:20:44,160 --> 00:20:47,760
Don't create a group called co-pilot users and let it grow without rules.

442
00:20:47,760 --> 00:20:52,800
Create groups linked to a scenario, a department, a region, or an expansion wave.

443
00:20:52,800 --> 00:20:53,800
Name and owner.

444
00:20:53,800 --> 00:20:54,800
State the entry criteria.

445
00:20:54,800 --> 00:20:56,440
State who can remove a user.

446
00:20:56,440 --> 00:21:00,160
This gives finance and IT a clean view of who has a license and why.

447
00:21:00,160 --> 00:21:01,440
You also need reclaim rules.

448
00:21:01,440 --> 00:21:06,000
What happens if someone changes role, leaves the organization, moves out of the pilot, or

449
00:21:06,000 --> 00:21:08,320
never uses the license in the agreed period?

450
00:21:08,320 --> 00:21:12,640
If you cannot answer that, your pilot becomes a permanent license pool by accident.

451
00:21:12,640 --> 00:21:16,000
Licenses should support a business scenario, not become a status symbol.

452
00:21:16,000 --> 00:21:17,680
Core service readiness comes next.

453
00:21:17,680 --> 00:21:22,200
Microsoft 365 co-pilot depends on services your organization may already run, but already

454
00:21:22,200 --> 00:21:25,160
run is not the same as ready for this use.

455
00:21:25,160 --> 00:21:28,440
Check Exchange Online mailbox readiness for the intended experience.

456
00:21:28,440 --> 00:21:31,320
Check team settings that affect meeting content and transcripts.

457
00:21:31,320 --> 00:21:36,360
Review SharePoint and OneDrive availability, user provisioning, and service health expectations.

458
00:21:36,360 --> 00:21:39,240
Microsoft Graph forms the context layer across these services.

459
00:21:39,240 --> 00:21:41,640
You don't need to turn this into a technical lecture.

460
00:21:41,640 --> 00:21:42,760
The point is simple.

461
00:21:42,760 --> 00:21:48,160
If the information that supports a workflow lives in Exchange, Teams, SharePoint, and OneDrive.

462
00:21:48,160 --> 00:21:52,200
The quality of access and service configuration across those places affects the experience

463
00:21:52,200 --> 00:21:53,640
people receive.

464
00:21:53,640 --> 00:21:55,240
Client readiness matters too.

465
00:21:55,240 --> 00:21:59,520
Review the Microsoft 365 Apps Update channel across your target devices.

466
00:21:59,520 --> 00:22:02,480
Co-pilot experience depends on supported versions and supported channels.

467
00:22:02,480 --> 00:22:07,000
A common problem appears when the organization has a cautious update policy, while the business

468
00:22:07,000 --> 00:22:09,600
expects new co-pilot capabilities immediately.

469
00:22:09,600 --> 00:22:11,480
That is a governance choice, not a product fault.

470
00:22:11,480 --> 00:22:12,840
Here's the trade-off.

471
00:22:12,840 --> 00:22:17,120
Current channel may give users access to capabilities sooner, but it demands a support model

472
00:22:17,120 --> 00:22:19,000
that can absorb faster change.

473
00:22:19,000 --> 00:22:22,720
Monthly enterprise channel offers a more controlled rhythm, which may suit organizations

474
00:22:22,720 --> 00:22:24,800
that need more testing and communication.

475
00:22:24,800 --> 00:22:29,480
What matters is that you choose deliberately and explain the implication to users.

476
00:22:29,480 --> 00:22:31,200
Hybrid identity needs special attention.

477
00:22:31,200 --> 00:22:33,480
A typical enterprise may have cloud identities.

478
00:22:33,480 --> 00:22:37,000
Synchronized on-premises identities, guest accounts, dominant accounts, shared mailboxes,

479
00:22:37,000 --> 00:22:40,600
service accounts, and more than one tenant due to an acquisition.

480
00:22:40,600 --> 00:22:44,840
Each of those can affect access, licensing, support, and audit evidence.

481
00:22:44,840 --> 00:22:46,600
This identity is deserved a direct review.

482
00:22:46,600 --> 00:22:47,600
Who sponsors them?

483
00:22:47,600 --> 00:22:48,600
Are they still active?

484
00:22:48,600 --> 00:22:49,600
What can they access?

485
00:22:49,600 --> 00:22:51,640
Are they in groups inherited from an old project?

486
00:22:51,640 --> 00:22:53,720
The same applies to dormant user accounts.

487
00:22:53,720 --> 00:22:57,360
An account that should have been disabled is not a minor housekeeping issue when access to

488
00:22:57,360 --> 00:22:59,400
enterprise data sits behind it.

489
00:22:59,400 --> 00:23:00,920
Don't license service accounts.

490
00:23:00,920 --> 00:23:03,560
Don't treat shared mailboxes like ordinary users.

491
00:23:03,560 --> 00:23:07,360
Don't assume every identity and enter ID belongs in the co-pilot population.

492
00:23:07,360 --> 00:23:10,960
You're deliverable is a technical readiness register and a licensing strategy.

493
00:23:10,960 --> 00:23:14,640
It should show service dependencies, identity gaps, update channel decisions,

494
00:23:14,640 --> 00:23:19,120
licensing groups, cost owners, and remediation actions with named people behind them.

495
00:23:19,120 --> 00:23:20,880
Service readiness gets users through the door.

496
00:23:20,880 --> 00:23:25,200
It does not fix poor information structure once they are inside.

497
00:23:25,200 --> 00:23:28,080
Information architecture, data quality, and technical debt.

498
00:23:28,080 --> 00:23:31,800
Once identity and service readiness are understood, look at the information people expect

499
00:23:31,800 --> 00:23:33,600
co-pilot to work with.

500
00:23:33,600 --> 00:23:35,040
The first question is simple.

501
00:23:35,040 --> 00:23:36,800
Where does work actually live?

502
00:23:36,800 --> 00:23:39,320
Don't ask where the policy says it should live.

503
00:23:39,320 --> 00:23:42,960
Ask where people go when they need the latest proposal, a decision from last month,

504
00:23:42,960 --> 00:23:46,360
a customer commitment, or the approved version of a policy.

505
00:23:46,360 --> 00:23:49,800
In many enterprises, the answer is spread across several places.

506
00:23:49,800 --> 00:23:51,320
The project team says one thing.

507
00:23:51,320 --> 00:23:53,200
A SharePoint library holds another version.

508
00:23:53,200 --> 00:23:55,640
A shared mailbox contains the latest approval.

509
00:23:55,640 --> 00:23:59,560
Someone's one drive has the working draft because the formal site became too hard to use.

510
00:23:59,560 --> 00:24:02,480
Co-pilot can help people work with the information it can find.

511
00:24:02,480 --> 00:24:06,280
It cannot decide which of five conflicting versions is authoritative just because one

512
00:24:06,280 --> 00:24:07,880
has a more confident file name.

513
00:24:07,880 --> 00:24:10,800
That's a data quality problem, but not in the narrow sense.

514
00:24:10,800 --> 00:24:15,520
This is not mainly about removing blank rows from a spreadsheet or enforcing folder names.

515
00:24:15,520 --> 00:24:17,040
It is about business context.

516
00:24:17,040 --> 00:24:18,800
Does the document state its owner?

517
00:24:18,800 --> 00:24:19,960
Is there a current version?

518
00:24:19,960 --> 00:24:21,080
Does it have a clear purpose?

519
00:24:21,080 --> 00:24:25,600
Can a user tell whether it is draft guidance, a historical record, or an approved operational

520
00:24:25,600 --> 00:24:26,600
standard?

521
00:24:26,600 --> 00:24:30,280
If the answer is no, co-pilot may retrieve content that looks relevant, but sends the

522
00:24:30,280 --> 00:24:32,080
user in the wrong direction.

523
00:24:32,080 --> 00:24:33,360
The output may read well.

524
00:24:33,360 --> 00:24:35,680
That doesn't make the underlying information right.

525
00:24:35,680 --> 00:24:39,240
Start the assessment by mapping the information parts for the pilot scenarios.

526
00:24:39,240 --> 00:24:42,720
If you want project managers to prepare status updates, identify where they collect project

527
00:24:42,720 --> 00:24:43,720
information today.

528
00:24:43,720 --> 00:24:47,240
If you want account teams to prepare for customer meetings, identify the approved sources

529
00:24:47,240 --> 00:24:48,240
they rely on.

530
00:24:48,240 --> 00:24:52,320
If you want HR to help managers answer policy questions, identify the policy sources that

531
00:24:52,320 --> 00:24:54,800
should be used and the old sites that should not.

532
00:24:54,800 --> 00:24:56,480
That gives you a practical boundary.

533
00:24:56,480 --> 00:24:58,880
Then look for the patterns that create confusion.

534
00:24:58,880 --> 00:25:00,280
Unknown sites are common.

535
00:25:00,280 --> 00:25:04,800
So are duplicate libraries, stale teams, old channels, copy documents sets, and shared

536
00:25:04,800 --> 00:25:08,400
mailboxes that have become a shadow knowledge base because nobody agreed where the real

537
00:25:08,400 --> 00:25:10,120
record belongs.

538
00:25:10,120 --> 00:25:13,120
Technical debt rarely arrives as one dramatic failure.

539
00:25:13,120 --> 00:25:15,680
It accumulates through sensible local decisions.

540
00:25:15,680 --> 00:25:18,520
A team creates a new site because the old one is crowded.

541
00:25:18,520 --> 00:25:22,560
A project keeps its team after it ends because deleting it feels unsafe.

542
00:25:22,560 --> 00:25:26,000
A shared mailbox stays active because it contains useful history.

543
00:25:26,000 --> 00:25:30,720
Over time, the organization builds a large volume of content without a reliable way to separate

544
00:25:30,720 --> 00:25:33,000
current business knowledge from old material.

545
00:25:33,000 --> 00:25:34,480
That changes the co-pilot decision.

546
00:25:34,480 --> 00:25:37,320
You do not need to clean the entire tenant before running a pilot.

547
00:25:37,320 --> 00:25:40,440
That approach can become a long delay with no end date.

548
00:25:40,440 --> 00:25:44,680
But you do need to decide what content is suitable for the pilot, what needs repair first,

549
00:25:44,680 --> 00:25:47,680
and what should be excluded until ownership and structure improve.

550
00:25:47,680 --> 00:25:48,680
Here's the trade-off.

551
00:25:48,680 --> 00:25:52,400
Broad access may increase the chance that co-pilot find something useful.

552
00:25:52,400 --> 00:25:57,040
It also increases the chance that it finds stale, duplicate, or poorly governed information.

553
00:25:57,040 --> 00:26:00,040
Restricting the initial scope can reduce the richness of the experience, but it gives

554
00:26:00,040 --> 00:26:04,120
you a more reliable basis for testing whether the workflow itself improves.

555
00:26:04,120 --> 00:26:08,920
Or an initial pilot, choose content areas with named owners, current material, and a clear

556
00:26:08,920 --> 00:26:09,920
business purpose.

557
00:26:09,920 --> 00:26:14,200
Isolate sources where ownership is unclear, where content has not been reviewed, or where

558
00:26:14,200 --> 00:26:17,760
conflicting versions create a real risk of poor decisions.

559
00:26:17,760 --> 00:26:20,520
Metadata can help, but don't turn it into a paperwork exercise.

560
00:26:20,520 --> 00:26:24,080
Use metadata where it helps users and systems distinguish content that matters.

561
00:26:24,080 --> 00:26:28,360
A document type, business area, owner, status, or review date may be enough.

562
00:26:28,360 --> 00:26:32,240
If you ask users to complete 20 fields before saving a file, they will find ways around

563
00:26:32,240 --> 00:26:33,240
it.

564
00:26:33,240 --> 00:26:36,160
In a consistent, it is a predictable response to friction.

565
00:26:36,160 --> 00:26:37,800
Naming standards matter for the same reason.

566
00:26:37,800 --> 00:26:41,480
They should make information easier to identify, not satisfy, an architecture diagram that

567
00:26:41,480 --> 00:26:43,800
nobody outside I.T. understands.

568
00:26:43,800 --> 00:26:47,400
Retention and records rules must also reflect the value and purpose of the content, because

569
00:26:47,400 --> 00:26:50,120
keeping everything forever does not create a better knowledge base.

570
00:26:50,120 --> 00:26:51,200
It creates more noise.

571
00:26:51,200 --> 00:26:55,440
At this point, produce an information architecture gap map and a remediation backlog.

572
00:26:55,440 --> 00:26:59,800
The gap map shows where the pilot workflow depends on trusted information, where that information

573
00:26:59,800 --> 00:27:03,160
lives, who owns it, and what quality issues affect retrieval.

574
00:27:03,160 --> 00:27:07,280
The backlog separates immediate pilot actions from longer term work, with priorities based

575
00:27:07,280 --> 00:27:08,880
on business impact and risk.

576
00:27:08,880 --> 00:27:11,520
Good information architecture reduces future decisions.

577
00:27:11,520 --> 00:27:15,360
Without it, users spend more time asking whether they can trust what co-pilot found.

578
00:27:15,360 --> 00:27:18,640
And the next phase is where that uncertainty becomes far more direct, because permission

579
00:27:18,640 --> 00:27:21,920
cleanup is the work most teams try to postpone.

580
00:27:21,920 --> 00:27:24,520
Data and permission cleanup find the exposure.

581
00:27:24,520 --> 00:27:27,560
This is the phase almost every organization tries to shorten.

582
00:27:27,560 --> 00:27:30,960
Someone will say, "Co-pilot doesn't give anyone new access, so why do we need a permission

583
00:27:30,960 --> 00:27:32,600
cleanup before the pilot?"

584
00:27:32,600 --> 00:27:34,760
Technically, that first part is correct.

585
00:27:34,760 --> 00:27:37,600
Co-pilot works within the permissions already assigned to the user.

586
00:27:37,600 --> 00:27:38,840
Operationally, it misses the point.

587
00:27:38,840 --> 00:27:40,120
The problem is not new access.

588
00:27:40,120 --> 00:27:42,840
The problem is that old access becomes far easier to use.

589
00:27:42,840 --> 00:27:46,520
A user may have had access to a document for years without knowing it existed.

590
00:27:46,520 --> 00:27:50,880
With co-pilot, they can ask a natural question and receive a summary that brings that document

591
00:27:50,880 --> 00:27:52,360
into their working context.

592
00:27:52,360 --> 00:27:55,080
That is why a permission review belongs before broad deployment.

593
00:27:55,080 --> 00:27:57,920
Start with the forms of access that create the largest exposure.

594
00:27:57,920 --> 00:28:00,280
Look for broadly shared share point sites.

595
00:28:00,280 --> 00:28:04,120
That grant access beyond the intended audience anonymous links where they remain allowed

596
00:28:04,120 --> 00:28:06,800
and folders shared from personal one drive locations.

597
00:28:06,800 --> 00:28:08,960
Review guest access with the same discipline.

598
00:28:08,960 --> 00:28:13,200
Every guest should have a sponsor, a business reason, a defined scope and an active end date

599
00:28:13,200 --> 00:28:14,600
or review cycle.

600
00:28:14,600 --> 00:28:19,320
If you cannot explain why a guest still has access, that access should not remain by default.

601
00:28:19,320 --> 00:28:21,080
Then look at inherited permissions.

602
00:28:21,080 --> 00:28:24,880
Inheritance is useful when a site has a clear structure and a stable membership model.

603
00:28:24,880 --> 00:28:29,160
It becomes a problem when people break inheritance to solve one urgent sharing request, then add

604
00:28:29,160 --> 00:28:33,040
direct permissions to folders, files and libraries over several years.

605
00:28:33,040 --> 00:28:36,040
Eventually, nobody can explain who has access or why.

606
00:28:36,040 --> 00:28:37,040
This is common.

607
00:28:37,040 --> 00:28:40,880
It is also manageable if you treat it as an evidence exercise rather than a cleanup campaign

608
00:28:40,880 --> 00:28:42,280
based on guesswork.

609
00:28:42,280 --> 00:28:43,920
Review the groups used to grant access.

610
00:28:43,920 --> 00:28:45,680
Look for names that no longer mean anything.

611
00:28:45,680 --> 00:28:48,680
Look for male enabled groups that have become de facto security controls.

612
00:28:48,680 --> 00:28:50,160
Look for groups with no clear owner.

613
00:28:50,160 --> 00:28:53,960
Look for large nested memberships and groups that still contain people who changed role,

614
00:28:53,960 --> 00:28:56,560
left the business or joined through an old merger.

615
00:28:56,560 --> 00:28:59,900
When somebody says, "We don't know what that group does, so don't touch it," record that

616
00:28:59,900 --> 00:29:00,900
as a risk.

617
00:29:00,900 --> 00:29:02,960
It is not a reason to leave the problem invisible.

618
00:29:02,960 --> 00:29:07,260
The same review needs to cover teams because teams membership often maps to the collaboration

619
00:29:07,260 --> 00:29:09,480
spaces and files behind the experience.

620
00:29:09,480 --> 00:29:13,600
Check private channels, shared channels, old project teams and external members.

621
00:29:13,600 --> 00:29:17,880
Also examine shared mailboxes and common workspaces where teams have stored sensitive operational

622
00:29:17,880 --> 00:29:20,840
knowledge outside the normal document management pattern.

623
00:29:20,840 --> 00:29:23,120
You are not trying to make collaboration difficult.

624
00:29:23,120 --> 00:29:26,840
That matters because permission remediation can become heavy handed very quickly.

625
00:29:26,840 --> 00:29:31,840
If IT removes access without involving the business, users will work around the controls.

626
00:29:31,840 --> 00:29:36,120
They will download files, send attachments, create new unmanaged spaces or keep copies

627
00:29:36,120 --> 00:29:38,000
where nobody intended them to sit.

628
00:29:38,000 --> 00:29:40,880
The better approach uses risk-based triage.

629
00:29:40,880 --> 00:29:44,880
Prioritize content that combines high sensitivity, broad reach, stale ownership and active

630
00:29:44,880 --> 00:29:46,160
business use.

631
00:29:46,160 --> 00:29:50,160
A public project site with low risk material may need attention, but it does not carry

632
00:29:50,160 --> 00:29:55,360
the same urgency as a poorly owned location containing commercial plans, employee information,

633
00:29:55,360 --> 00:29:58,760
legal material, source code or financial records.

634
00:29:58,760 --> 00:30:00,600
Ask four questions for each exposure.

635
00:30:00,600 --> 00:30:02,760
What data sits here who can reach it today?

636
00:30:02,760 --> 00:30:05,160
Who is accountable for deciding who should reach it?

637
00:30:05,160 --> 00:30:08,440
How actively is the content used that gives you a workable queue?

638
00:30:08,440 --> 00:30:10,840
The data owner decides the intended access model.

639
00:30:10,840 --> 00:30:14,760
The platform team helps apply it, security validates the risk, the project team tracks the

640
00:30:14,760 --> 00:30:15,760
outcome.

641
00:30:15,760 --> 00:30:19,520
This is where accountability stops being a policy word and becomes a real operating

642
00:30:19,520 --> 00:30:20,520
practice.

643
00:30:20,520 --> 00:30:24,640
You may find that the safest pilot choice is not to clean every issue before launch.

644
00:30:24,640 --> 00:30:29,680
Instead, limit pilot users to approved content areas while remediation continues elsewhere.

645
00:30:29,680 --> 00:30:33,280
That is a reasonable trade-off when the scope is controlled and the risk is clear.

646
00:30:33,280 --> 00:30:37,480
What you should not do is ignore broad access because the cleanup looks difficult.

647
00:30:37,480 --> 00:30:42,480
Would you approve an AI tool to summarize and connect information across these access parts

648
00:30:42,480 --> 00:30:45,400
if a user had never seen a clear list of what they could reach?

649
00:30:45,400 --> 00:30:46,800
That is the consultant checkpoint.

650
00:30:46,800 --> 00:30:49,920
If the answer is no, you have worked to do before expanding the scope.

651
00:30:49,920 --> 00:30:54,720
The output from this phase is an oversharing inventory, a remediation plan, and named

652
00:30:54,720 --> 00:30:56,760
owners for each material finding.

653
00:30:56,760 --> 00:30:59,560
The inventory should not be a giant export that nobody reads.

654
00:30:59,560 --> 00:31:03,240
It should show the exposure, the affected business area, the likely impact, the accountable

655
00:31:03,240 --> 00:31:06,240
owner, the required action, and the target date.

656
00:31:06,240 --> 00:31:08,320
Some issues will lead immediate correction.

657
00:31:08,320 --> 00:31:10,240
Others can sit in a controlled backlog.

658
00:31:10,240 --> 00:31:13,920
The difference should be visible, agreed, and defensible.

659
00:31:13,920 --> 00:31:16,280
Permissions answer who can access content today.

660
00:31:16,280 --> 00:31:20,320
To keep that access model from degrading again, you need durable controls around classification,

661
00:31:20,320 --> 00:31:23,320
sharing, and the life of the information itself.

662
00:31:23,320 --> 00:31:25,360
Labels, life cycle, and durable controls.

663
00:31:25,360 --> 00:31:28,080
Cleaning permissions, once, is not governance.

664
00:31:28,080 --> 00:31:30,400
Without durable controls, the same problems return.

665
00:31:30,400 --> 00:31:33,320
A new team gets created with the wrong sharing settings.

666
00:31:33,320 --> 00:31:36,000
A document moves into a less protected location.

667
00:31:36,000 --> 00:31:39,560
Someone shares a sensitive file broadly to solve an urgent request.

668
00:31:39,560 --> 00:31:41,840
Six months later, you are back where you started.

669
00:31:41,840 --> 00:31:44,480
Except the AI estate is larger.

670
00:31:44,480 --> 00:31:47,560
The labels help turn a permission decision into a repeatable control.

671
00:31:47,560 --> 00:31:51,000
But keep the model simple enough that people can use it under normal work pressure.

672
00:31:51,000 --> 00:31:55,320
Most organizations need a small number of labels that employees can understand without opening

673
00:31:55,320 --> 00:31:56,720
a policy document.

674
00:31:56,720 --> 00:32:00,840
Terms such as public, general, confidential, and highly confidential can work if your organization

675
00:32:00,840 --> 00:32:04,720
defines them clearly and connects each label to a real handling rule.

676
00:32:04,720 --> 00:32:07,160
The names matter less than the behavior they trigger.

677
00:32:07,160 --> 00:32:11,560
For example, a highly confidential label may limit external sharing, apply encryption, and

678
00:32:11,560 --> 00:32:13,480
require access to named people.

679
00:32:13,480 --> 00:32:17,840
A general internal label may allow normal internal collaboration but block public access.

680
00:32:17,840 --> 00:32:20,400
Users need to know what choice they are making and why.

681
00:32:20,400 --> 00:32:22,440
Too many labels create false precision.

682
00:32:22,440 --> 00:32:27,200
If an employee has to choose between 12 similar classifications before they can save a document,

683
00:32:27,200 --> 00:32:28,200
they will guess.

684
00:32:28,200 --> 00:32:30,480
Or they will choose the default every time.

685
00:32:30,480 --> 00:32:31,840
That is not a user failure.

686
00:32:31,840 --> 00:32:35,880
That means the control designers ask people to do work that the system should handle for

687
00:32:35,880 --> 00:32:38,400
them, start at the container level where possible.

688
00:32:38,400 --> 00:32:43,240
A SharePoint site, team, or Microsoft 365 group usually represents a business purpose and

689
00:32:43,240 --> 00:32:45,000
a group of people working together.

690
00:32:45,000 --> 00:32:49,160
Apply a container label that sets the expected privacy, external sharing rules, and default

691
00:32:49,160 --> 00:32:50,160
protection.

692
00:32:50,160 --> 00:32:52,680
Then derive file labels from that container by default.

693
00:32:52,680 --> 00:32:54,760
This reduces choices at the point of work.

694
00:32:54,760 --> 00:32:59,240
If a project site is confidential, new files in its main library should inherit that classification

695
00:32:59,240 --> 00:33:01,000
unless there is a justified exception.

696
00:33:01,000 --> 00:33:05,840
A user can still need a more restrictive label for a particular document, but the safe default

697
00:33:05,840 --> 00:33:07,400
should match the workspace.

698
00:33:07,400 --> 00:33:09,760
Every exception needs a path who can change a label.

699
00:33:09,760 --> 00:33:13,560
What happens if a file sensitivity conflicts with the site where it is stored?

700
00:33:13,560 --> 00:33:17,000
Can a user move a highly sensitive document into a general workspace?

701
00:33:17,000 --> 00:33:21,040
What review happens when a label downgrade affects encryption or sharing?

702
00:33:21,040 --> 00:33:23,000
These are not edge cases once you operate at scale.

703
00:33:23,000 --> 00:33:24,160
They are normal work.

704
00:33:24,160 --> 00:33:26,240
Design the route before users find the gap.

705
00:33:26,240 --> 00:33:30,480
Microsoft PerView can support this model through data loss prevention, auto labeling, review

706
00:33:30,480 --> 00:33:31,960
cues and quarantine actions.

707
00:33:31,960 --> 00:33:35,080
The point is not to switch on every policy and hope for the best.

708
00:33:35,080 --> 00:33:39,880
But with the data types that create the clearest business and regulatory exposure, such as credentials,

709
00:33:39,880 --> 00:33:43,200
personal data, financial information or protected source code.

710
00:33:43,200 --> 00:33:47,160
Use DLP to detect conditions that should not be handled by user judgment alone.

711
00:33:47,160 --> 00:33:50,960
If someone labels a file as general, but it contains access tokens or sensitive employee

712
00:33:50,960 --> 00:33:55,240
data, the control should flag it, block an unsafe action where appropriate, or send it

713
00:33:55,240 --> 00:33:56,400
to a review queue.

714
00:33:56,400 --> 00:34:00,520
In higher risk cases, quarantine may be the right response until the content owner,

715
00:34:00,520 --> 00:34:04,400
security team or compliance function can decide what happens next.

716
00:34:04,400 --> 00:34:06,080
And needs human ownership.

717
00:34:06,080 --> 00:34:08,400
A DLP rule can detect patterns.

718
00:34:08,400 --> 00:34:12,440
It may not understand that a code name refers to an unreleased product, or that a finance team

719
00:34:12,440 --> 00:34:16,280
has a legitimate reason to handle information that would trigger a standard policy.

720
00:34:16,280 --> 00:34:19,240
Define exception groups, escalation routes and response times.

721
00:34:19,240 --> 00:34:23,240
Otherwise, your controls either block real work or become ignored alerts.

722
00:34:23,240 --> 00:34:26,680
Then manage the life cycle of the spaces and information itself.

723
00:34:26,680 --> 00:34:29,800
Every active team and share point side should have a named owner.

724
00:34:29,800 --> 00:34:32,920
That owner should periodically confirm that the site remains needed.

725
00:34:32,920 --> 00:34:36,360
Since membership is still appropriate, it's labels still fits, and its sharing settings

726
00:34:36,360 --> 00:34:37,880
reflect the current business need.

727
00:34:37,880 --> 00:34:38,880
This is attestation.

728
00:34:38,880 --> 00:34:40,760
It sounds administrative because it is.

729
00:34:40,760 --> 00:34:44,920
It is also one of the few reliable ways to stop abandoned workspaces from becoming permanent

730
00:34:44,920 --> 00:34:46,880
data risk.

731
00:34:46,880 --> 00:34:48,240
Set a sensible review cycle.

732
00:34:48,240 --> 00:34:51,800
Some sites need frequent review because they hold sensitive content or have changing external

733
00:34:51,800 --> 00:34:52,800
membership.

734
00:34:52,800 --> 00:34:54,520
Others can follow a longer cycle.

735
00:34:54,520 --> 00:34:58,560
If nobody confirms ownership, have a defined route for notification, archive, deletion

736
00:34:58,560 --> 00:34:59,760
and recovery.

737
00:34:59,760 --> 00:35:03,520
Delete business content without a recovery plan and don't retain everything forever because

738
00:35:03,520 --> 00:35:05,720
nobody wants to make a decision.

739
00:35:05,720 --> 00:35:07,720
External sharing follows the same principle.

740
00:35:07,720 --> 00:35:11,800
Allow it where there is a business need but tie it to data sensitivity named accountability

741
00:35:11,800 --> 00:35:12,800
and review.

742
00:35:12,800 --> 00:35:17,480
A supplier collaboration site does not need the same rule set as an internal planning site.

743
00:35:17,480 --> 00:35:21,480
A highly confidential file should not travel through the same sharing path as a general working

744
00:35:21,480 --> 00:35:22,480
document.

745
00:35:22,480 --> 00:35:26,880
The deliverable is an information protection baseline and a life cycle policy set.

746
00:35:26,880 --> 00:35:32,280
It should show the label, taxonomy, default controls, exception process, DLP actions, ownership

747
00:35:32,280 --> 00:35:35,240
rules, review cadence and recovery process.

748
00:35:35,240 --> 00:35:38,480
Once those controls are in place, you have a way to keep the estate from drifting back

749
00:35:38,480 --> 00:35:40,320
toward unmanaged access.

750
00:35:40,320 --> 00:35:42,240
Permissions determine access today.

751
00:35:42,240 --> 00:35:45,760
Security addresses what happens when that access comes under attack.

752
00:35:45,760 --> 00:35:48,520
Security and compliance deploy AI safely.

753
00:35:48,520 --> 00:35:50,800
Security for co-pilot starts with a plain idea.

754
00:35:50,800 --> 00:35:54,800
You do not approve a new way of finding and using enterprise information based on a promise

755
00:35:54,800 --> 00:35:56,640
that users will behave perfectly.

756
00:35:56,640 --> 00:36:00,760
You design controls that verify identity, device, session and access context each time the

757
00:36:00,760 --> 00:36:01,760
service is used.

758
00:36:01,760 --> 00:36:03,120
That is zero trust in practice.

759
00:36:03,120 --> 00:36:05,160
A user's password is not enough.

760
00:36:05,160 --> 00:36:08,680
You need to know whether the sign in carries risk, whether the device meets your management

761
00:36:08,680 --> 00:36:13,520
standard, whether the user is in an approved location or network context, and whether the requested

762
00:36:13,520 --> 00:36:15,680
access makes sense for that account.

763
00:36:15,680 --> 00:36:17,480
MFA is the baseline gate.

764
00:36:17,480 --> 00:36:21,560
If a pilot user cannot meet your MFA standard, they should not receive access.

765
00:36:21,560 --> 00:36:25,480
There is no useful argument for treating that as an optional improvement after launch.

766
00:36:25,480 --> 00:36:28,600
Unmanaged access is where you apply the policy to real working conditions.

767
00:36:28,600 --> 00:36:33,120
You may allow co-pilot from compliant managed devices while limiting access from unmanaged

768
00:36:33,120 --> 00:36:34,120
devices.

769
00:36:34,120 --> 00:36:37,600
You may require stronger controls for users handling confidential data.

770
00:36:37,600 --> 00:36:41,840
You may block high-risk sign-ins or require a fresh authentication challenge when the context

771
00:36:41,840 --> 00:36:42,840
changes.

772
00:36:42,840 --> 00:36:44,920
The policy design must match how people work.

773
00:36:44,920 --> 00:36:47,680
A global sales team may need mobile access while traveling.

774
00:36:47,680 --> 00:36:52,040
A regulated back office team may require a managed device and a restricted session.

775
00:36:52,040 --> 00:36:56,240
If you apply one rule to everyone without understanding the work, users will either lose the ability

776
00:36:56,240 --> 00:36:59,200
to do their job or search for ways around the policy.

777
00:36:59,200 --> 00:37:00,600
Here is the trade-off.

778
00:37:00,600 --> 00:37:04,080
Titer controls can reduce exposure, but they can also create friction.

779
00:37:04,080 --> 00:37:06,920
The answer is not to weaken the controls until users stop complaining.

780
00:37:06,920 --> 00:37:11,120
It is to design different access paths for different risk levels and make those paths

781
00:37:11,120 --> 00:37:13,240
clear before the roll-out starts.

782
00:37:13,240 --> 00:37:17,480
Next, define how you will protect sensitive information during normal use.

783
00:37:17,480 --> 00:37:20,640
DLP should cover the data types that matter to your organization.

784
00:37:20,640 --> 00:37:25,360
That may include credentials, personal data, payment information, financial forecasts,

785
00:37:25,360 --> 00:37:29,680
regulated records, legal material, or non-public source code.

786
00:37:29,680 --> 00:37:31,680
The control question is specific.

787
00:37:31,680 --> 00:37:35,480
What should happen when sensitive content appears in a prompt, a response, a file, or a

788
00:37:35,480 --> 00:37:36,680
sharing action?

789
00:37:36,680 --> 00:37:42,160
Some cases need monitoring, some need a user warning, some need blocking, some need escalation.

790
00:37:42,160 --> 00:37:45,520
Do not treat all DLP events as security incidents.

791
00:37:45,520 --> 00:37:49,200
If every alert reaches the security team, the team will drown in noise and business

792
00:37:49,200 --> 00:37:53,800
users will wait for answers, set severity levels, define who triages each level, agree

793
00:37:53,800 --> 00:37:57,840
what evidence they need, how quickly they need to respond, and who can make an exception.

794
00:37:57,840 --> 00:38:01,560
Or it matters because co-pilot changes how users interact with information.

795
00:38:01,560 --> 00:38:05,840
You need to retain the records required by your internal policy, legal obligations, and

796
00:38:05,840 --> 00:38:07,320
regulatory environment.

797
00:38:07,320 --> 00:38:11,600
That includes being able to investigate an allegation, respond to an e-discovery request,

798
00:38:11,600 --> 00:38:15,720
and understand what activity occurred when a potential data exposure is reported.

799
00:38:15,720 --> 00:38:17,520
Be clear with employees about this.

800
00:38:17,520 --> 00:38:19,960
DLP pilot is not a private personal notebook.

801
00:38:19,960 --> 00:38:23,700
Prompts and responses can fall within your organization's retention, audit, and legal

802
00:38:23,700 --> 00:38:25,020
discovery obligations.

803
00:38:25,020 --> 00:38:26,980
This is not a reason to create fear.

804
00:38:26,980 --> 00:38:30,600
It is a reason to set honest expectations about professional use.

805
00:38:30,600 --> 00:38:32,520
Inside a risk needs the same maturity.

806
00:38:32,520 --> 00:38:36,320
The goal is not to watch every employee or treat normal work as suspicious.

807
00:38:36,320 --> 00:38:40,720
The goal is to detect patterns that suggest a meaningful concern, particularly when sensitive

808
00:38:40,720 --> 00:38:45,480
content, unusual access behavior, and risky actions appear together.

809
00:38:45,480 --> 00:38:49,520
Usually legal HR and privacy teams need an agreed path for handling those cases.

810
00:38:49,520 --> 00:38:52,360
No single team should improvise after an alert arrives.

811
00:38:52,360 --> 00:38:57,280
For global organizations, data residency and regulatory boundaries need an early decision.

812
00:38:57,280 --> 00:38:58,280
Where are your users?

813
00:38:58,280 --> 00:38:59,440
Where does their data need to remain?

814
00:38:59,440 --> 00:39:03,800
Do particular regions have local requirements, labor rules, works councils, or sector controls

815
00:39:03,800 --> 00:39:05,880
that change what you can enable and when?

816
00:39:05,880 --> 00:39:09,040
Multigio may be part of the design, but it does not remove the need to understand local

817
00:39:09,040 --> 00:39:10,520
obligations.

818
00:39:10,520 --> 00:39:12,560
Encryption also requires practical review.

819
00:39:12,560 --> 00:39:16,640
Know which content protection's effect, how information can be used in co-pilot scenarios,

820
00:39:16,640 --> 00:39:19,240
and test the behavior with your actual labels and policies.

821
00:39:19,240 --> 00:39:23,720
A control that exists only in a design document is not a control you can rely on.

822
00:39:23,720 --> 00:39:26,600
You also need an incident path for AI specific events.

823
00:39:26,600 --> 00:39:30,160
What happens if co-pilot produces harmful or misleading content that enters a business

824
00:39:30,160 --> 00:39:31,160
process?

825
00:39:31,160 --> 00:39:34,600
What happens if a user receives information they should not have been able to discover?

826
00:39:34,600 --> 00:39:38,480
What happens when a malicious prompt attempts to manipulate an AI experience through content?

827
00:39:38,480 --> 00:39:40,080
It is asked to process?

828
00:39:40,080 --> 00:39:42,040
Don't promise that these events cannot happen.

829
00:39:42,040 --> 00:39:46,240
Define how you detect, contain, investigate, communicate, and learn from them.

830
00:39:46,240 --> 00:39:48,200
For a pilot, run a tabletop exercise.

831
00:39:48,200 --> 00:39:52,160
Give the teams a realistic scenario, then ask who does what in the first hour?

832
00:39:52,160 --> 00:39:55,920
If the response depends on finding the right people in an emergency chat, the process is

833
00:39:55,920 --> 00:39:56,920
not ready.

834
00:39:56,920 --> 00:40:00,200
The deliverable is a co-pilot security assessment and risk register.

835
00:40:00,200 --> 00:40:03,480
It should state the controls you have, the gaps you accept, the threats you monitor,

836
00:40:03,480 --> 00:40:07,040
the people who own each response, and the evidence you retain.

837
00:40:07,040 --> 00:40:10,600
Security controls only work when they fit the architecture people will actually use.

838
00:40:10,600 --> 00:40:12,960
The real architecture, choose the deployment shape.

839
00:40:12,960 --> 00:40:17,000
At this point you've established the business scenarios, tested readiness, reviewed information

840
00:40:17,000 --> 00:40:19,320
risk, and set the security boundary.

841
00:40:19,320 --> 00:40:21,080
Now you need to choose the deployment shape.

842
00:40:21,080 --> 00:40:25,320
The question isn't whether you can add co-pilot studio, connectors, agents, and Azure AI on

843
00:40:25,320 --> 00:40:26,320
day one.

844
00:40:26,320 --> 00:40:27,320
You can.

845
00:40:27,320 --> 00:40:30,280
The real question is whether each layer solves a defined business problem that standard

846
00:40:30,280 --> 00:40:33,240
Microsoft 365 co-pilot cannot solve well enough.

847
00:40:33,240 --> 00:40:35,080
Start with the core co-pilot experience.

848
00:40:35,080 --> 00:40:39,760
For many early scenarios, standard co-pilot in the Microsoft 365 apps is enough.

849
00:40:39,760 --> 00:40:42,280
A manager needs help preparing for a meeting.

850
00:40:42,280 --> 00:40:44,840
A project lead needs to turn notes into a status update.

851
00:40:44,840 --> 00:40:48,440
A sales team needs a first draft using material it already owns.

852
00:40:48,440 --> 00:40:53,640
These are usually adoption and workflow questions before they become architecture questions.

853
00:40:53,640 --> 00:40:55,840
That keeps the first deployment understandable.

854
00:40:55,840 --> 00:41:01,080
Once you introduce custom agents, external connectors, automated actions, or Azure services,

855
00:41:01,080 --> 00:41:05,760
you add new dependencies, new support needs, new security parts, and new decisions about

856
00:41:05,760 --> 00:41:06,960
ownership.

857
00:41:06,960 --> 00:41:09,880
Every architecture decision creates a governance decision.

858
00:41:09,880 --> 00:41:13,440
Microsoft Graph is central to the core experience because it provides the permission-trimmed context

859
00:41:13,440 --> 00:41:15,280
across Microsoft 365.

860
00:41:15,280 --> 00:41:20,520
Put simply, it helps connect the work a user is doing with the content, people, meetings,

861
00:41:20,520 --> 00:41:23,320
messages, and files that user is allowed to reach.

862
00:41:23,320 --> 00:41:26,280
But permission-trimmed does not mean quality-trimmed.

863
00:41:26,280 --> 00:41:30,080
Co-pilot can respect the user's access rights and still retrieve content that is outdated,

864
00:41:30,080 --> 00:41:33,320
poorly named, duplicated, or irrelevant to the decision at hand.

865
00:41:33,320 --> 00:41:36,000
That is why search architecture deserves attention.

866
00:41:36,000 --> 00:41:39,680
You need to know what content is indexed, which sources should contribute to search, who

867
00:41:39,680 --> 00:41:44,720
owns each source, and how you will handle low quality or obsolete content.

868
00:41:44,720 --> 00:41:47,040
A useful architecture question is this.

869
00:41:47,040 --> 00:41:50,440
When co-pilot gives a user an answer, where should that answer come from?

870
00:41:50,440 --> 00:41:55,040
For an HR policy scenario, the answer should come from the current approved policy source,

871
00:41:55,040 --> 00:42:00,320
not a collection of old files, informal team chats, and documents from a reorganization

872
00:42:00,320 --> 00:42:01,960
three years ago.

873
00:42:01,960 --> 00:42:06,440
For a sales scenario, it may need approved product information, account material, and current

874
00:42:06,440 --> 00:42:07,440
commercial guidance.

875
00:42:07,440 --> 00:42:10,200
The source system owner needs to define that boundary.

876
00:42:10,200 --> 00:42:14,320
Connectors can extend access to information held outside Microsoft 365.

877
00:42:14,320 --> 00:42:18,200
That may be useful where a business process relies on a CRM, service platform, knowledge

878
00:42:18,200 --> 00:42:20,080
base, or line of business system.

879
00:42:20,080 --> 00:42:21,680
Here's the trade-off.

880
00:42:21,680 --> 00:42:25,520
A connector can make co-pilot more useful by bringing relevant context closer to the

881
00:42:25,520 --> 00:42:26,520
user.

882
00:42:26,520 --> 00:42:31,120
It can also bring another systems access model, data quality issues, retention rules,

883
00:42:31,120 --> 00:42:34,080
and operational risks into the co-pilot experience.

884
00:42:34,080 --> 00:42:38,160
Before you connect anything, ask who owns the source data, who approves its use, what users

885
00:42:38,160 --> 00:42:42,080
should be able to retrieve, and who supports it when results are incomplete or wrong.

886
00:42:42,080 --> 00:42:45,440
Don't connect the system because someone says all our data should be available to AI.

887
00:42:45,440 --> 00:42:47,040
That is not an architecture principle.

888
00:42:47,040 --> 00:42:50,000
It is a future incident report waiting for a date.

889
00:42:50,000 --> 00:42:54,360
Co-pilot studio and Azure AI have a place, but only after you prove a defined workflow

890
00:42:54,360 --> 00:42:56,880
needs more than the standard capability.

891
00:42:56,880 --> 00:43:00,960
Co-pilot studio may fit when a team needs a focused agent with clear instructions, defined

892
00:43:00,960 --> 00:43:04,320
knowledge sources, and perhaps a controlled action path.

893
00:43:04,320 --> 00:43:09,000
Azure AI may fit when you need more custom orchestration, integration, model choice, or

894
00:43:09,000 --> 00:43:12,680
engineering control, than the Microsoft 365 experience provides.

895
00:43:12,680 --> 00:43:13,680
Both can be good choices.

896
00:43:13,680 --> 00:43:17,320
Neither should become a side project where every department builds its own assistant with

897
00:43:17,320 --> 00:43:22,360
different rules, unclear data sources, and nobody responsible when it stops working.

898
00:43:22,360 --> 00:43:23,760
Start with the standard experience.

899
00:43:23,760 --> 00:43:27,520
Add complexity only where a scenario has measurable value, clear ownership, and controls

900
00:43:27,520 --> 00:43:29,000
that match the scope.

901
00:43:29,000 --> 00:43:31,360
The tenant and merger situations need extra care.

902
00:43:31,360 --> 00:43:35,840
A global enterprise may run more than one tenant due to acquisitions, legal separation,

903
00:43:35,840 --> 00:43:38,920
regional structure, or historical decisions.

904
00:43:38,920 --> 00:43:42,760
Users may expect co-pilot to work across those boundaries because their business work crosses

905
00:43:42,760 --> 00:43:43,760
them.

906
00:43:43,760 --> 00:43:47,160
The architecture may not support that expectation in the simple way they imagine.

907
00:43:47,160 --> 00:43:48,880
Be explicit about data boundaries.

908
00:43:48,880 --> 00:43:52,880
Define which tenant owns the service, where identities are managed, which content sources

909
00:43:52,880 --> 00:43:56,960
are in scope, and what users can expect across organizational lines.

910
00:43:56,960 --> 00:44:01,160
Do not let an acquisition integration problem hide inside an AI project.

911
00:44:01,160 --> 00:44:02,480
It will not become easier there.

912
00:44:02,480 --> 00:44:05,200
Your target architecture should be practical enough to operate.

913
00:44:05,200 --> 00:44:09,560
Document the standard co-pilot capabilities you will enable, the approved data sources,

914
00:44:09,560 --> 00:44:14,600
search and indexing assumptions, plan connectors, custom extensions, service dependencies, and

915
00:44:14,600 --> 00:44:15,960
support ownership.

916
00:44:15,960 --> 00:44:17,400
Keep a design decisions log.

917
00:44:17,400 --> 00:44:21,400
When someone asks six months later why a connector was approved or why an agent has access

918
00:44:21,400 --> 00:44:25,720
to a certain source, you should not need to reconstruct the answer from meeting notes.

919
00:44:25,720 --> 00:44:30,400
The deliverables are a target architecture, a dependency map, and a design decisions log.

920
00:44:30,400 --> 00:44:32,800
Good architecture reduces future decisions.

921
00:44:32,800 --> 00:44:36,760
It gives teams a clear default path, a defined exception path, and a reason to say no

922
00:44:36,760 --> 00:44:40,440
when a request adds complexity without adding enough business value.

923
00:44:40,440 --> 00:44:44,000
That brings us to the next decision, how you control the cost of the architecture and the

924
00:44:44,000 --> 00:44:46,600
licenses that sit behind it.

925
00:44:46,600 --> 00:44:48,920
Licensing strategy and cost controls.

926
00:44:48,920 --> 00:44:53,040
Licensing is where a sound co-pilot strategy can quietly turn into an uncontrolled operating

927
00:44:53,040 --> 00:44:54,040
cost.

928
00:44:54,040 --> 00:44:58,720
Easy move is to buy broadly, assign widely, and hope usage grows into the spend.

929
00:44:58,720 --> 00:45:03,280
That may satisfy initial demand but it removes the discipline you need to prove where co-pilot

930
00:45:03,280 --> 00:45:07,360
changes work and where it simply becomes another unused entitlement.

931
00:45:07,360 --> 00:45:10,320
Start with the business scenario, then assign the license.

932
00:45:10,320 --> 00:45:13,520
A role does not automatically justify a co-pilot license.

933
00:45:13,520 --> 00:45:16,360
Two people with the same job title may work very differently.

934
00:45:16,360 --> 00:45:20,280
One may spend much of the week preparing documents, reviewing customer context, and running

935
00:45:20,280 --> 00:45:21,280
meetings.

936
00:45:21,280 --> 00:45:26,480
Other may work mainly in a specialist system with limited use for Microsoft 365 co-pilot.

937
00:45:26,480 --> 00:45:30,720
Treat licenses as an investment in a work pattern, not a benefit attached to a title.

938
00:45:30,720 --> 00:45:34,560
For the first waves, targeted licensing usually gives you the clearest evidence.

939
00:45:34,560 --> 00:45:38,760
You can connect each license group to a scenario, a business owner, expected use, and defined

940
00:45:38,760 --> 00:45:39,760
measures.

941
00:45:39,760 --> 00:45:43,080
If a department wants more licenses, ask them to identify the workflow, the accountable

942
00:45:43,080 --> 00:45:45,560
manager, and the outcome they expect to improve.

943
00:45:45,560 --> 00:45:47,600
That isn't bureaucracy for its own sake.

944
00:45:47,600 --> 00:45:51,720
It stops the role out becoming a queue of people asking, why do they have it and I don't?

945
00:45:51,720 --> 00:45:55,640
The answer should not depend on seniority, enthusiasm, or who asked first.

946
00:45:55,640 --> 00:46:00,400
It should depend on the current expansion criteria and whether the role fits a proven scenario.

947
00:46:00,400 --> 00:46:01,760
Broad licensing has a place.

948
00:46:01,760 --> 00:46:06,160
If your organization wants to build broad AI fluency, or if a large population has similar

949
00:46:06,160 --> 00:46:09,040
knowledge work patterns, wider access may be sensible.

950
00:46:09,040 --> 00:46:10,480
But price the decision honestly.

951
00:46:10,480 --> 00:46:13,360
The total cost is not the co-pilot line item alone.

952
00:46:13,360 --> 00:46:19,800
The base Microsoft 365 licensing position, enablement time, support capacity, governance activity,

953
00:46:19,800 --> 00:46:24,880
permission remediation, platform administration, reporting, and the time business team spend

954
00:46:24,880 --> 00:46:26,080
changing their work.

955
00:46:26,080 --> 00:46:29,880
A license that costs a fixed monthly amount may create several times that cost in the first

956
00:46:29,880 --> 00:46:32,920
year when you include the work required to make it useful and safe.

957
00:46:32,920 --> 00:46:34,600
That is not an argument against deployment.

958
00:46:34,600 --> 00:46:38,640
It is an argument against presenting procurement cost as the whole investment.

959
00:46:38,640 --> 00:46:42,480
Finance should be able to see the full model show the direct cost per licensed user, show

960
00:46:42,480 --> 00:46:44,640
shared platform and governance costs.

961
00:46:44,640 --> 00:46:48,240
Then allocate the costs to departments where that supports accountability.

962
00:46:48,240 --> 00:46:53,280
Some enterprises use chargeback where the department pays for licenses in related services.

963
00:46:53,280 --> 00:46:56,800
Others use showback where central IT pays but reports consumption and costback to each

964
00:46:56,800 --> 00:46:57,800
business unit.

965
00:46:57,800 --> 00:46:58,800
Here is the trade-off.

966
00:46:58,800 --> 00:47:03,160
Chargeback creates stronger local ownership, but it can slow adoption if leaders protect

967
00:47:03,160 --> 00:47:05,840
their budgets until every benefit is proven.

968
00:47:05,840 --> 00:47:10,160
Showback reduces that barrier, but departments may treat licenses as free and hold on to

969
00:47:10,160 --> 00:47:12,520
them long after the business case has faded.

970
00:47:12,520 --> 00:47:14,120
There is no universal answer.

971
00:47:14,120 --> 00:47:18,200
Choose the model that matches how your organization funds digital services, then make the rules

972
00:47:18,200 --> 00:47:19,200
visible.

973
00:47:19,200 --> 00:47:20,960
You also need an assumption about demand.

974
00:47:20,960 --> 00:47:23,800
Some leaders expect licenses to behave like a shared pool.

975
00:47:23,800 --> 00:47:27,360
A person uses co-pilot this month, then someone else uses the same seat next month.

976
00:47:27,360 --> 00:47:31,720
That may not match how the service is licensed or how the user experience needs to work.

977
00:47:31,720 --> 00:47:36,000
Don't build a financial forecast on pool demand unless your procurement terms and operating

978
00:47:36,000 --> 00:47:37,560
models support it.

979
00:47:37,560 --> 00:47:39,600
Model renewal exposure early.

980
00:47:39,600 --> 00:47:45,120
If the pilot expands, user rises unevenly or the organization commits to a larger volume

981
00:47:45,120 --> 00:47:48,440
before the benefits realization plan is mature.

982
00:47:48,440 --> 00:47:51,520
Set review points before renewal or major expansion decisions.

983
00:47:51,520 --> 00:47:55,560
Those reviews should assess scenario outcomes, active use, support demand, control findings

984
00:47:55,560 --> 00:47:57,480
and the remaining cost to scale.

985
00:47:57,480 --> 00:47:59,480
Unused licenses need an agreed response.

986
00:47:59,480 --> 00:48:03,120
Set a reasonable review period, look at whether the user belongs to an active scenario, whether

987
00:48:03,120 --> 00:48:08,160
they received role-based support, and whether a manager still expects the role to use co-pilot.

988
00:48:08,160 --> 00:48:11,800
Then reclaim, reassign or retain the license with a documented reason.

989
00:48:11,800 --> 00:48:13,400
Don't use activity alone as the test.

990
00:48:13,400 --> 00:48:17,680
A user may have low visible activity but gain value in a periodic high impact task.

991
00:48:17,680 --> 00:48:20,000
But don't let that become a blanket excuse either.

992
00:48:20,000 --> 00:48:23,960
The manager who owns the scenario should be able to explain the expected value.

993
00:48:23,960 --> 00:48:29,080
Your deliverables are a licensing strategy, financial controls and a 12 month cost forecast.

994
00:48:29,080 --> 00:48:32,800
They should show how licenses are assigned, who owns the spend, when usage and value

995
00:48:32,800 --> 00:48:37,640
are reviewed, how licenses are reclaimed and what triggers the next investment decision.

996
00:48:37,640 --> 00:48:42,120
Technology and licenses still need someone accountable for the decisions that follow.

997
00:48:42,120 --> 00:48:44,360
Governance, build the co-pilot operating model.

998
00:48:44,360 --> 00:48:48,720
A license strategy tells you who receives co-pilot and how you control the spend.

999
00:48:48,720 --> 00:48:52,200
Governance tells you who makes decisions after the license is active.

1000
00:48:52,200 --> 00:48:54,080
This is really a governance decision.

1001
00:48:54,080 --> 00:48:57,880
Co-pilot touches business work, enterprise data, security controls, legal duties, employee

1002
00:48:57,880 --> 00:48:59,840
concerns and departmental budgets.

1003
00:48:59,840 --> 00:49:04,560
If one team owns all of it, decisions either become slow or they happen outside the process.

1004
00:49:04,560 --> 00:49:06,440
Neither is a good operating model.

1005
00:49:06,440 --> 00:49:11,000
Just by naming the account abilities, the CIO or digital leader usually owns the platform,

1006
00:49:11,000 --> 00:49:12,560
outcome and the service model.

1007
00:49:12,560 --> 00:49:15,840
The CISO owns the security bar and security risk decisions.

1008
00:49:15,840 --> 00:49:19,720
Data owners decide whether their information is fit for the intended business use.

1009
00:49:19,720 --> 00:49:25,240
Legal, privacy and compliance teams define the obligations that apply to prompts, outputs,

1010
00:49:25,240 --> 00:49:27,040
records and regional requirements.

1011
00:49:27,040 --> 00:49:31,680
HR helps shape employee guidance, training boundaries and concerns about work change.

1012
00:49:31,680 --> 00:49:35,000
Finance owns the financial discipline, not the value claim itself.

1013
00:49:35,000 --> 00:49:36,160
Business leaders own that.

1014
00:49:36,160 --> 00:49:41,160
They must identify the workflow, nominate users, validate the result and explain what changed

1015
00:49:41,160 --> 00:49:44,240
in the business after co-pilot entered the process.

1016
00:49:44,240 --> 00:49:46,400
That last part is where many operating models fail.

1017
00:49:46,400 --> 00:49:48,040
It can make co-pilot available.

1018
00:49:48,040 --> 00:49:52,160
It cannot decide whether a sales proposal is better, whether a caseworker has made a sound

1019
00:49:52,160 --> 00:49:56,400
decision or whether a department has redirected saved time into work that matters.

1020
00:49:56,400 --> 00:49:58,480
The business leader has to own those outcomes.

1021
00:49:58,480 --> 00:50:00,640
Put this into a clear responsibility model.

1022
00:50:00,640 --> 00:50:04,600
You can use RATSI if your organization already works that way, but the format matters less

1023
00:50:04,600 --> 00:50:05,760
than the clarity.

1024
00:50:05,760 --> 00:50:10,640
For each decision, identify who recommends, who approves, who must be consulted and who

1025
00:50:10,640 --> 00:50:12,560
needs to know after the decision.

1026
00:50:12,560 --> 00:50:14,600
Keep the steering committee small enough to decide.

1027
00:50:14,600 --> 00:50:18,480
A steering committee with 20 people may represent every interest, but it rarely resolves

1028
00:50:18,480 --> 00:50:19,480
a problem.

1029
00:50:19,480 --> 00:50:24,320
Build a group with actual decision rights across business, IT, security, risk, legal or privacy,

1030
00:50:24,320 --> 00:50:25,640
finance and adoption.

1031
00:50:25,640 --> 00:50:29,720
Meet at a set cadence during the pilot and expansion phases, then adjust once the service

1032
00:50:29,720 --> 00:50:31,080
becomes stable.

1033
00:50:31,080 --> 00:50:34,480
Its job is not to review every prompt or approve every user request.

1034
00:50:34,480 --> 00:50:39,160
It should decide on expansion waves, material risk acceptance, policy exceptions, high impact

1035
00:50:39,160 --> 00:50:44,600
agent proposals, budget changes and issues that cannot be resolved within the delivery teams.

1036
00:50:44,600 --> 00:50:47,320
Give it an escalation path with defined response times.

1037
00:50:47,320 --> 00:50:51,000
If a business unit finds a serious access concern, everyone should know who receives it,

1038
00:50:51,000 --> 00:50:54,040
who assesses it and who can pause the relevant scope.

1039
00:50:54,040 --> 00:50:56,760
Then define the AI policies people will actually use.

1040
00:50:56,760 --> 00:51:01,320
Your accepted use policy should state what employees can do with co-pilot, what still requires

1041
00:51:01,320 --> 00:51:06,280
human review, what types of data needs special care and what behavior is not allowed.

1042
00:51:06,280 --> 00:51:07,800
Keep the language direct.

1043
00:51:07,800 --> 00:51:11,420
Use professional judgment and follow company policy may be true, but it doesn't help

1044
00:51:11,420 --> 00:51:15,360
someone deciding whether they can use a generated summary in a customer response or an internal

1045
00:51:15,360 --> 00:51:16,840
management decision.

1046
00:51:16,840 --> 00:51:19,640
Specify the moments where human review is mandatory.

1047
00:51:19,640 --> 00:51:23,960
That may include regulated communications, employment decisions, legal advice, financial

1048
00:51:23,960 --> 00:51:28,760
commitments, customer facing content or outputs used in high impact operational processes.

1049
00:51:28,760 --> 00:51:30,560
The point is not to ban useful work.

1050
00:51:30,560 --> 00:51:34,440
Just to make clear that co-pilot can support judgment without replacing accountable judgment.

1051
00:51:34,440 --> 00:51:36,520
Agent boundaries need their own policy.

1052
00:51:36,520 --> 00:51:41,000
A simple agent that retrieves information from approved sources has a different risk profile

1053
00:51:41,000 --> 00:51:45,120
from an agent that writes to a system, sends a message, creates a record, or triggers

1054
00:51:45,120 --> 00:51:46,280
a workflow.

1055
00:51:46,280 --> 00:51:50,600
Define which agents users can create for themselves, which need business owner approval, and

1056
00:51:50,600 --> 00:51:54,800
which need formal security, privacy and technical review before publication.

1057
00:51:54,800 --> 00:51:57,400
Every architecture decision creates a governance decision.

1058
00:51:57,400 --> 00:52:01,920
An agent with a connector creates a question about data access, an agent with an action creates

1059
00:52:01,920 --> 00:52:03,440
a question about authority.

1060
00:52:03,440 --> 00:52:08,520
An agent shared across the department creates a question about support, life cycle and ownership.

1061
00:52:08,520 --> 00:52:12,840
Write the rules before the agent catalog becomes a museum of abandoned experiments.

1062
00:52:12,840 --> 00:52:14,760
Separate enterprise standards from local playbooks.

1063
00:52:14,760 --> 00:52:17,120
The enterprise should set the non-negotiables.

1064
00:52:17,120 --> 00:52:22,720
Identity controls, data handling rules, audit expectations, security review, retention and

1065
00:52:22,720 --> 00:52:24,520
approval paths.

1066
00:52:24,520 --> 00:52:28,720
A local team can define how co-pilot supports its own workflow, what examples it trains

1067
00:52:28,720 --> 00:52:31,400
on, and what quality checks make sense in that work.

1068
00:52:31,400 --> 00:52:34,760
That gives you control without forcing every department to work the same way.

1069
00:52:34,760 --> 00:52:37,960
The risk register needs a named owner for every material item.

1070
00:52:37,960 --> 00:52:41,280
Not IT, not the program, a person or accountable role.

1071
00:52:41,280 --> 00:52:45,000
That owner tracks the mitigation, reports progress and brings the issue back to the steering

1072
00:52:45,000 --> 00:52:47,920
committee when the risk changes or the deadline slips.

1073
00:52:47,920 --> 00:52:51,160
Policy exceptions need the same discipline, record what is being accepted, why the business

1074
00:52:51,160 --> 00:52:55,440
needs it, what compensating control applies, who approved it and when it expires.

1075
00:52:55,440 --> 00:52:58,840
Permanent exceptions are often temporary decisions that nobody revisited.

1076
00:52:58,840 --> 00:53:01,280
Finally, test the controls.

1077
00:53:01,280 --> 00:53:06,440
Run regular reviews of access, policy compliance, agent ownership and unresolved risks.

1078
00:53:06,440 --> 00:53:08,800
Test whether escalation works under pressure.

1079
00:53:08,800 --> 00:53:12,120
Test whether local teams still follow the enterprise rules after the launch attention

1080
00:53:12,120 --> 00:53:13,120
has moved elsewhere.

1081
00:53:13,120 --> 00:53:16,920
The deliverables are a governance framework and a co-pilot operating model.

1082
00:53:16,920 --> 00:53:21,000
They define the people, decision rights policies, review routes and control checks that

1083
00:53:21,000 --> 00:53:25,880
allow co-pilot to operate as a business capability rather than a collection of licenses.

1084
00:53:25,880 --> 00:53:29,720
Governance becomes real when the pilot tests it under normal work pressure.

1085
00:53:29,720 --> 00:53:31,960
Pilot design, prove a business scenario.

1086
00:53:31,960 --> 00:53:36,680
The pilot is where your strategy, controls, architecture and governance model meet normal

1087
00:53:36,680 --> 00:53:37,680
work.

1088
00:53:37,680 --> 00:53:41,040
That's why a pilot should never exist to prove that co-pilot can write an email, summarize

1089
00:53:41,040 --> 00:53:43,240
a meeting or produce a first draft.

1090
00:53:43,240 --> 00:53:45,160
Everyone already knows it can do those things.

1091
00:53:45,160 --> 00:53:47,520
The pilot needs to prove something more useful.

1092
00:53:47,520 --> 00:53:51,800
Whether defined business scenario can operate safely, people will use it in real work and

1093
00:53:51,800 --> 00:53:54,760
the outcome justifies the next level of investment.

1094
00:53:54,760 --> 00:53:58,080
Start with a business scenario, not a department.

1095
00:53:58,080 --> 00:54:01,080
Let's pilot co-pilot with finance is too broad.

1096
00:54:01,080 --> 00:54:04,840
Finance contains many workflows, data types, approval rules and risk levels.

1097
00:54:04,840 --> 00:54:07,600
A stronger pilot state when sounds like this.

1098
00:54:07,600 --> 00:54:11,600
We will test whether account managers can prepare customer meeting briefings faster using

1099
00:54:11,600 --> 00:54:15,480
approved account information while maintaining the same quality standard.

1100
00:54:15,480 --> 00:54:21,520
It gives you a workflow, a user group, a source boundary, a business owner and a measure.

1101
00:54:21,520 --> 00:54:23,520
Choose departments where three conditions exist.

1102
00:54:23,520 --> 00:54:25,600
The work should repeat often enough to measure.

1103
00:54:25,600 --> 00:54:30,280
The leader should be willing to change how the team works, not just distribute licenses.

1104
00:54:30,280 --> 00:54:34,080
And the data risk should be manageable within the controls you have already tested.

1105
00:54:34,080 --> 00:54:35,960
A pilot group also needs variety.

1106
00:54:35,960 --> 00:54:38,600
Do not fill it only with enthusiastic early adopters.

1107
00:54:38,600 --> 00:54:42,680
They will find value because they enjoy testing new tools and that is useful feedback, but

1108
00:54:42,680 --> 00:54:45,440
it does not show how the broader workforce will respond.

1109
00:54:45,440 --> 00:54:49,280
To do it confident users, cautious users, experienced users and people who are busy enough to reject

1110
00:54:49,280 --> 00:54:50,880
anything that adds friction.

1111
00:54:50,880 --> 00:54:52,560
That mix gives you honest evidence.

1112
00:54:52,560 --> 00:54:54,440
Decide the pilot duration before launch.

1113
00:54:54,440 --> 00:54:57,880
It must be long enough for people to move beyond first week experimentation and use co-pilot

1114
00:54:57,880 --> 00:55:01,920
during routine work, but short enough that the pilot cannot drift without a decision.

1115
00:55:01,920 --> 00:55:06,800
Define the license count, the entry and exit process, the support route and the user commitments.

1116
00:55:06,800 --> 00:55:09,680
In practice, users should know what is expected of them.

1117
00:55:09,680 --> 00:55:12,280
They are not being asked to become AI experts.

1118
00:55:12,280 --> 00:55:16,280
They are being asked to test a small number of agreed work patterns, provide evidence about

1119
00:55:16,280 --> 00:55:19,120
what helped or failed and raise concerns quickly.

1120
00:55:19,120 --> 00:55:20,720
Managers have commitments too.

1121
00:55:20,720 --> 00:55:25,120
They need to protect time for enablement, reinforce the selected scenarios in team meetings

1122
00:55:25,120 --> 00:55:28,280
and validate whether the work output improved.

1123
00:55:28,280 --> 00:55:32,640
If a manager delegates the pilot to IT and never looks at the workflow again, you will collect

1124
00:55:32,640 --> 00:55:35,080
activity data without business evidence.

1125
00:55:35,080 --> 00:55:38,200
Write acceptance criteria before the launch communication goes out.

1126
00:55:38,200 --> 00:55:42,840
For each scenario, define the control criteria, adoption criteria and business criteria,

1127
00:55:42,840 --> 00:55:48,160
control criteria may require that no unresolved access issue appears in the approved scope.

1128
00:55:48,160 --> 00:55:52,240
Adoption criteria may require a meaningful share of the pilot group to return to the scenario

1129
00:55:52,240 --> 00:55:53,760
over several weeks.

1130
00:55:53,760 --> 00:55:57,480
Business criteria may require improved turnaround time, reduced rework or better completion

1131
00:55:57,480 --> 00:55:58,800
of follow-up actions.

1132
00:55:58,800 --> 00:56:01,120
Don't set criteria that only reward good news.

1133
00:56:01,120 --> 00:56:03,480
A pilot must have a legitimate path to stop.

1134
00:56:03,480 --> 00:56:07,920
If the data sources are unreliable, if users cannot fit the process into their work, or if

1135
00:56:07,920 --> 00:56:13,760
the quality check shows added rework, stopping or redesigning the scenario is a sound result.

1136
00:56:13,760 --> 00:56:17,560
It prevents a weak pattern from becoming an enterprise standard, build feedback into

1137
00:56:17,560 --> 00:56:20,840
the operating rhythm, each week collect user evidence.

1138
00:56:20,840 --> 00:56:25,000
Ask what task they attempted, what source material they used, what result they received,

1139
00:56:25,000 --> 00:56:29,560
what they changed before using the output, and whether the result altered the time, quality

1140
00:56:29,560 --> 00:56:31,640
or confidence involved in the work.

1141
00:56:31,640 --> 00:56:34,280
Avoid vague questions such as, did you like co-pilot?

1142
00:56:34,280 --> 00:56:35,720
People may like it and not use it.

1143
00:56:35,720 --> 00:56:38,440
They may dislike parts of it while still gaining real value.

1144
00:56:38,440 --> 00:56:40,320
You need evidence tied to the workflow.

1145
00:56:40,320 --> 00:56:44,880
Bring managers, security representatives, support leads and the executive sponsor into a regular

1146
00:56:44,880 --> 00:56:46,280
review cadence.

1147
00:56:46,280 --> 00:56:48,280
Managers report business observations.

1148
00:56:48,280 --> 00:56:52,960
Support reports recurring friction, security reports control findings and unusual events.

1149
00:56:52,960 --> 00:56:57,920
The sponsor resolves decisions that the delivery team cannot make, especially wear scope, budget,

1150
00:56:57,920 --> 00:56:59,640
or risk acceptance changes.

1151
00:56:59,640 --> 00:57:02,240
Keep executive reporting brief and decision focused.

1152
00:57:02,240 --> 00:57:07,000
Throw the scenario, the baseline, the current evidence, the open risks, the user feedback pattern,

1153
00:57:07,000 --> 00:57:08,360
and the decision needed.

1154
00:57:08,360 --> 00:57:12,560
Do not bury the steering group in screenshots, prompt examples, or feature lists.

1155
00:57:12,560 --> 00:57:16,680
They need to know whether the scenario is safe, useful, repeatable, and ready for the next

1156
00:57:16,680 --> 00:57:17,680
step.

1157
00:57:17,680 --> 00:57:19,680
Your pilot playbook should bring all of this together.

1158
00:57:19,680 --> 00:57:24,080
It defines the user's workflow, scope boundaries, support path, data sources controls, measures,

1159
00:57:24,080 --> 00:57:26,400
feedback routine, and exit criteria.

1160
00:57:26,400 --> 00:57:30,520
Parade with an executive reporting pack that makes the current state visible without requiring

1161
00:57:30,520 --> 00:57:32,520
a forensic review of project documents.

1162
00:57:32,520 --> 00:57:34,800
Before you approve launch, ask one final question.

1163
00:57:34,800 --> 00:57:39,040
If this pilot succeeds, do you know exactly what you will repeat for whom, under which controls

1164
00:57:39,040 --> 00:57:40,200
and with what evidence.

1165
00:57:40,200 --> 00:57:42,720
If you cannot answer that, you are running a product trial.

1166
00:57:42,720 --> 00:57:46,240
A successful pilot produces a repeatable expansion decision.

1167
00:57:46,240 --> 00:57:49,080
Pilot review, decide expand, fix, or stop.

1168
00:57:49,080 --> 00:57:51,680
The pilot ends with a decision meeting, not a celebration meeting.

1169
00:57:51,680 --> 00:57:55,840
That distinction matters because a pilot can feel busy, get good comments from users,

1170
00:57:55,840 --> 00:57:57,840
and still fail to justify expansion.

1171
00:57:57,840 --> 00:58:02,200
Your job is to compare the evidence against the baseline and the success criteria you agreed

1172
00:58:02,200 --> 00:58:03,960
before anyone received a license.

1173
00:58:03,960 --> 00:58:05,240
Start with the workflow result.

1174
00:58:05,240 --> 00:58:07,640
Did the selected team complete the work faster?

1175
00:58:07,640 --> 00:58:09,480
Did quality stay the same or improved?

1176
00:58:09,480 --> 00:58:10,640
Did rework fall?

1177
00:58:10,640 --> 00:58:14,160
Or did people spend the time they saved checking and correcting output?

1178
00:58:14,160 --> 00:58:15,920
Did the process become easier to follow?

1179
00:58:15,920 --> 00:58:19,800
Or did co-pilot create another step that people avoided when deadlines became real?

1180
00:58:19,800 --> 00:58:22,360
Look at the evidence across more than one source.

1181
00:58:22,360 --> 00:58:27,200
Use workflow samples, manager review, support cases, user feedback, and the control findings

1182
00:58:27,200 --> 00:58:28,640
from the pilot period.

1183
00:58:28,640 --> 00:58:30,960
A user saying this save me time is useful.

1184
00:58:30,960 --> 00:58:32,240
It is not enough on its own.

1185
00:58:32,240 --> 00:58:35,680
You need to understand which task changed, how often it changed, and whether that change

1186
00:58:35,680 --> 00:58:39,440
can repeat across the next group, then separate the cause of every shortfall.

1187
00:58:39,440 --> 00:58:41,960
A weak result may come from a product limitation.

1188
00:58:41,960 --> 00:58:43,760
It may come from a poor workflow design.

1189
00:58:43,760 --> 00:58:46,160
It may come from old or conflicting source content.

1190
00:58:46,160 --> 00:58:50,920
It may come from weak training, unclear policy, or a support route that users could not navigate.

1191
00:58:50,920 --> 00:58:53,680
These are different problems, and they need different responses.

1192
00:58:53,680 --> 00:58:57,760
If co-pilot produced weak answers because the approved source material was incomplete,

1193
00:58:57,760 --> 00:58:59,640
buying more licenses will not solve it.

1194
00:58:59,640 --> 00:59:03,920
If users struggled because the training showed generic examples rather than their real work,

1195
00:59:03,920 --> 00:59:05,320
that is an enablement issue.

1196
00:59:05,320 --> 00:59:08,600
If a controlled blocked a valid business task, the question is whether the policy needs

1197
00:59:08,600 --> 00:59:11,600
refinement, not whether the user should find a workaround.

1198
00:59:11,600 --> 00:59:15,600
This is where experienced teams avoid blaming the tool for every problem, document each

1199
00:59:15,600 --> 00:59:20,440
finding in a practical form, state what happened, what caused it, who owns the response,

1200
00:59:20,440 --> 00:59:24,760
and whether the issue affects the current scenario, the next expansion wave, or the wider operating

1201
00:59:24,760 --> 00:59:25,760
model.

1202
00:59:25,760 --> 00:59:29,160
Some findings will change policy, others will change architecture, support guidance, training

1203
00:59:29,160 --> 00:59:31,640
material, or the scope of the next pilot.

1204
00:59:31,640 --> 00:59:33,480
Not every scenario deserves another round.

1205
00:59:33,480 --> 00:59:37,520
A scenario should move forward when it shows repeatable business value, acceptable risk,

1206
00:59:37,520 --> 00:59:39,160
and a workable support model.

1207
00:59:39,160 --> 00:59:41,440
It should end when the workflow has no clear benefit.

1208
00:59:41,440 --> 00:59:45,400
The data quality cannot support the intended use, or the cost of control exceeds the likely

1209
00:59:45,400 --> 00:59:46,400
return.

1210
00:59:46,400 --> 00:59:48,360
Stopping a weak scenario is not failure.

1211
00:59:48,360 --> 00:59:52,000
It protects the enterprise from scaling a pattern that looked good in a demo, but adds

1212
00:59:52,000 --> 00:59:53,840
little under normal work conditions.

1213
00:59:53,840 --> 00:59:57,840
Frankly, that is a cheaper lesson than discovering the same thing after thousands of licenses

1214
00:59:57,840 --> 00:59:58,840
are assigned.

1215
00:59:58,840 --> 01:00:01,960
The executive decision should have four possible outcomes.

1216
01:00:01,960 --> 01:00:05,480
Expand when the evidence meets the agreed criteria, and the next group is ready.

1217
01:00:05,480 --> 01:00:08,760
Extend the pilot when the scenario still has promise, but needs more evidence within a clear

1218
01:00:08,760 --> 01:00:09,760
time limit.

1219
01:00:09,760 --> 01:00:13,920
Remediate when the business case holds, but a defined control, data, workflow, or training

1220
01:00:13,920 --> 01:00:15,560
issue needs correction first.

1221
01:00:15,560 --> 01:00:18,280
Stop when the scenario does not justify further spend.

1222
01:00:18,280 --> 01:00:21,400
Each outcome needs a written decision, named owner and next date.

1223
01:00:21,400 --> 01:00:24,600
Avoid language such as, let's keep exploring.

1224
01:00:24,600 --> 01:00:27,000
That usually means nobody wants to make the call.

1225
01:00:27,000 --> 01:00:32,080
A pilot that continues without a change scope, a new question, or a decision gate becomes

1226
01:00:32,080 --> 01:00:34,320
a standing experiment with a monthly bill.

1227
01:00:34,320 --> 01:00:38,640
Your pilot closeout report should show the original hypothesis, baseline results, unresolved

1228
01:00:38,640 --> 01:00:42,320
risks, lessons learned, changes required, and scale recommendation.

1229
01:00:42,320 --> 01:00:45,680
It becomes the evidence pack for the steering group and the starting point for the next

1230
01:00:45,680 --> 01:00:46,680
wave.

1231
01:00:46,680 --> 01:00:50,080
The next question belongs in that review, would the next group receive a better deployment

1232
01:00:50,080 --> 01:00:52,200
because of what this pilot taught you?

1233
01:00:52,200 --> 01:00:55,160
If the answer is no, you collected feedback but did not learn.

1234
01:00:55,160 --> 01:00:58,720
A pilot only earns its cost when its lessons change the next decision.

1235
01:00:58,720 --> 01:01:03,000
The next challenge is making sure a scenario that worked for one team becomes part of normal

1236
01:01:03,000 --> 01:01:05,640
work rather than fading after launch week.

1237
01:01:05,640 --> 01:01:08,800
Adoption and change management make it part of work.

1238
01:01:08,800 --> 01:01:10,560
A pilot can prove a workflow.

1239
01:01:10,560 --> 01:01:12,560
It cannot create a habit across an enterprise.

1240
01:01:12,560 --> 01:01:15,120
Once you move beyond the pilot, the work changes.

1241
01:01:15,120 --> 01:01:20,000
You are no longer asking whether a defined group can use co-pilot safely and productively.

1242
01:01:20,000 --> 01:01:24,880
You are helping people change how they prepare, communicate, search, draft, review, and make

1243
01:01:24,880 --> 01:01:26,880
decisions during a normal week.

1244
01:01:26,880 --> 01:01:28,440
Technology is rarely the hard part.

1245
01:01:28,440 --> 01:01:32,800
People need to know what is changing, why it is changing, what remains their responsibility,

1246
01:01:32,800 --> 01:01:34,280
and where the boundaries sit.

1247
01:01:34,280 --> 01:01:38,000
If they hear only that the organization has rolled out AI, they will create their own

1248
01:01:38,000 --> 01:01:39,000
story.

1249
01:01:39,000 --> 01:01:41,000
Some will assume their role is at risk.

1250
01:01:41,000 --> 01:01:43,600
Others will assume every output is correct because it came from co-pilot.

1251
01:01:43,600 --> 01:01:47,200
A few will use it aggressively, then lose trust after the first poor result.

1252
01:01:47,200 --> 01:01:50,120
Your communications need to get ahead of all three reactions.

1253
01:01:50,120 --> 01:01:53,120
Executive communication should focus on work, not product excitement.

1254
01:01:53,120 --> 01:01:57,240
A leader should explain the business reason for the rollout, the scenarios in scope, the

1255
01:01:57,240 --> 01:02:00,080
expected use, and the standards that remain in place.

1256
01:02:00,080 --> 01:02:02,640
Say clearly that co-pilot supports employee judgment.

1257
01:02:02,640 --> 01:02:07,640
It does not remove accountability for a customer response, an approval, a policy decision,

1258
01:02:07,640 --> 01:02:08,960
or a regulated outcome.

1259
01:02:08,960 --> 01:02:12,080
People also need to know what the organization expects from them.

1260
01:02:12,080 --> 01:02:15,760
They should understand which data handling rules still apply, when they need to verify

1261
01:02:15,760 --> 01:02:19,280
output, how to raise a concern, and where to get help.

1262
01:02:19,280 --> 01:02:20,440
Keep this direct.

1263
01:02:20,440 --> 01:02:24,600
An acceptable use policy hidden in a long portal page does not change behavior during

1264
01:02:24,600 --> 01:02:25,880
a busy afternoon.

1265
01:02:25,880 --> 01:02:28,960
The message from leadership should also be honest about the limits.

1266
01:02:28,960 --> 01:02:31,120
Co-pilot will sometimes give an incomplete answer.

1267
01:02:31,120 --> 01:02:33,040
It may use a source that needs checking.

1268
01:02:33,040 --> 01:02:36,680
It may produce wording that doesn't fit the audience or the decision that is normal for

1269
01:02:36,680 --> 01:02:37,920
this kind of tool.

1270
01:02:37,920 --> 01:02:41,880
Employees need permission to challenge it, correct it, and decide not to use the output

1271
01:02:41,880 --> 01:02:43,520
when it does not meet the standard.

1272
01:02:43,520 --> 01:02:46,600
Then move from broad communication to role-based enablement.

1273
01:02:46,600 --> 01:02:51,920
Generic training often begins with the interface, a list of features, and a few clever prompts.

1274
01:02:51,920 --> 01:02:55,240
That may help people feel familiar with the tool, but it rarely changes work.

1275
01:02:55,240 --> 01:03:00,560
A finance manager, project lead, HR advisor, sales executive, and service desk analyst, each

1276
01:03:00,560 --> 01:03:03,640
need to see how co-pilot fits into a task they already own.

1277
01:03:03,640 --> 01:03:06,400
Use their real working materials where policy permits.

1278
01:03:06,400 --> 01:03:10,120
Show a project manager how to prepare a status update from approved meeting notes and

1279
01:03:10,120 --> 01:03:11,400
project records.

1280
01:03:11,400 --> 01:03:15,680
Show a sales team how to prepare for an account meeting without copying old material into

1281
01:03:15,680 --> 01:03:17,080
an unapproved source.

1282
01:03:17,080 --> 01:03:21,320
Show an HR team how to use co-pilot for a first draft while keeping mandatory review and

1283
01:03:21,320 --> 01:03:23,320
approved policy sources in place.

1284
01:03:23,320 --> 01:03:25,600
That is where training becomes workflow design.

1285
01:03:25,600 --> 01:03:26,960
Prompt coaching belongs here too.

1286
01:03:26,960 --> 01:03:29,960
Don't teach prompts as magic phrases that employees memorize.

1287
01:03:29,960 --> 01:03:33,720
Teach people how to state the outcome they need, give enough context, point to the right

1288
01:03:33,720 --> 01:03:36,800
source, and define the form of the answer they want.

1289
01:03:36,800 --> 01:03:39,680
A useful prompt is often just a clear work request.

1290
01:03:39,680 --> 01:03:43,400
Help co-pilot the task, the audience, the source material, the constraints, and the quality

1291
01:03:43,400 --> 01:03:44,400
check.

1292
01:03:44,400 --> 01:03:45,400
Then review the result.

1293
01:03:45,400 --> 01:03:47,440
Employees already know how to brief a colleague.

1294
01:03:47,440 --> 01:03:51,240
Prompt coaching helps them apply that same discipline to an AI tool.

1295
01:03:51,240 --> 01:03:55,280
Build local champion networks but don't turn champions into unpaid support staff with

1296
01:03:55,280 --> 01:03:56,280
an impressive title.

1297
01:03:56,280 --> 01:03:59,800
A good champion translates between the platform team and the local team.

1298
01:03:59,800 --> 01:04:02,520
They know the work well enough to identify useful scenarios.

1299
01:04:02,520 --> 01:04:06,640
They can share practical examples, collect concerns early, and show peers how to use

1300
01:04:06,640 --> 01:04:10,000
the tool without making it feel like a central IT campaign.

1301
01:04:10,000 --> 01:04:13,080
Choose champions who are trusted, not simply the loudest volunteers.

1302
01:04:13,080 --> 01:04:17,360
They need time from their manager, clear guidance, access to current materials, and a route

1303
01:04:17,360 --> 01:04:18,560
to escalate issues.

1304
01:04:18,560 --> 01:04:22,440
If people begin asking them security, policy, or technical questions they cannot answer,

1305
01:04:22,440 --> 01:04:24,920
the support model needs to catch that quickly.

1306
01:04:24,920 --> 01:04:26,560
Resistance also deserves serious attention.

1307
01:04:26,560 --> 01:04:28,360
Some people will worry about job change.

1308
01:04:28,360 --> 01:04:31,000
Some will worry that poor output will damage their reputation.

1309
01:04:31,000 --> 01:04:34,600
Some will fear that usage data becomes a measure of effort or performance.

1310
01:04:34,600 --> 01:04:38,520
Others will resist because their current process works and changing it feels like extra

1311
01:04:38,520 --> 01:04:40,040
work with no clear return.

1312
01:04:40,040 --> 01:04:42,280
Don't dismiss these concerns as fear of change.

1313
01:04:42,280 --> 01:04:43,840
Address them in the open.

1314
01:04:43,840 --> 01:04:46,040
Explain what data you collect and why.

1315
01:04:46,040 --> 01:04:49,160
Separate adoption measures from individual performance management unless your organization

1316
01:04:49,160 --> 01:04:54,400
has explicitly chosen another path and has dealt with the legal, HR, and labour implications.

1317
01:04:54,400 --> 01:04:57,080
Show where human judgment remains required.

1318
01:04:57,080 --> 01:05:00,920
Most of all make sure the first use cases remove friction rather than add another system

1319
01:05:00,920 --> 01:05:02,600
people need to manage.

1320
01:05:02,600 --> 01:05:04,520
Support needs layers.

1321
01:05:04,520 --> 01:05:08,720
Support with self-service guidance for common questions, approved scenario examples, policy

1322
01:05:08,720 --> 01:05:13,240
reminders, and short learning material, add office hours where users can bring real work

1323
01:05:13,240 --> 01:05:18,200
questions, then define a clear escalation route for technical issues, access concerns,

1324
01:05:18,200 --> 01:05:20,960
suspected data exposure, and policy questions.

1325
01:05:20,960 --> 01:05:23,000
Every support asset needs an owner.

1326
01:05:23,000 --> 01:05:26,760
Someone must keep guidance current when the service changes, when policies change, or

1327
01:05:26,760 --> 01:05:30,480
when the pilot evidence shows that users misunderstand the scenario.

1328
01:05:30,480 --> 01:05:33,800
Otherwise, your internal knowledge base becomes another stale source that co-pilot may

1329
01:05:33,800 --> 01:05:34,800
eventually surface.

1330
01:05:34,800 --> 01:05:37,360
There's a small irony in that, but it happens.

1331
01:05:37,360 --> 01:05:41,480
The deliverable is a co-pilot adoption plan supported by a champion network and role-based

1332
01:05:41,480 --> 01:05:42,480
playbooks.

1333
01:05:42,480 --> 01:05:46,440
It should state who communicates, who trains, who supports, how feedback moves, and what

1334
01:05:46,440 --> 01:05:51,080
teams do when adoption stalls make co-pilot part of work people already need to do.

1335
01:05:51,080 --> 01:05:55,880
If it feels like an extra activity, it will disappear the moment the calendar gets busy.

1336
01:05:55,880 --> 01:05:57,960
Adoption measurement and continuous learning.

1337
01:05:57,960 --> 01:06:02,320
Once people begin using co-pilot in real work, leadership will ask a familiar question.

1338
01:06:02,320 --> 01:06:03,880
Is it working?

1339
01:06:03,880 --> 01:06:05,560
Be careful with the answer.

1340
01:06:05,560 --> 01:06:08,200
Usage data tells you whether people open the tool.

1341
01:06:08,200 --> 01:06:10,640
It does not tell you whether the tool improves the work.

1342
01:06:10,640 --> 01:06:13,320
A rising prompt count can mean adoption is improving.

1343
01:06:13,320 --> 01:06:17,040
It can also mean people are trying several times to get an answer they can use.

1344
01:06:17,040 --> 01:06:18,920
Activity is a signal it is not proof.

1345
01:06:18,920 --> 01:06:23,240
Start with a simple adoption view that shows active users, repeat users, and use by the relevant

1346
01:06:23,240 --> 01:06:24,560
apps or scenarios.

1347
01:06:24,560 --> 01:06:25,840
Look at the pattern over time.

1348
01:06:25,840 --> 01:06:28,240
Did people use co-pilot once after training?

1349
01:06:28,240 --> 01:06:29,240
Then stop.

1350
01:06:29,240 --> 01:06:31,720
Are they returning to the selected workflow each week?

1351
01:06:31,720 --> 01:06:35,040
Because one team have strong repeat use while another has almost none?

1352
01:06:35,040 --> 01:06:37,360
Those differences matter more than a tenant-wide average.

1353
01:06:37,360 --> 01:06:39,720
A low-use team may have received poor training.

1354
01:06:39,720 --> 01:06:41,440
It may lack an obvious scenario.

1355
01:06:41,440 --> 01:06:44,040
Its manager may not be reinforcing the new workflow.

1356
01:06:44,040 --> 01:06:47,600
Or the team may be correct because co-pilot does not solve a meaningful problem in that

1357
01:06:47,600 --> 01:06:48,600
part of the business.

1358
01:06:48,600 --> 01:06:51,920
Don't assume every low adoption number is a user problem.

1359
01:06:51,920 --> 01:06:53,640
Ask what the users are actually doing.

1360
01:06:53,640 --> 01:06:58,200
Are they using co-pilot to prepare for meetings, create drafts, find information, or reduce

1361
01:06:58,200 --> 01:06:59,440
follow-up work?

1362
01:06:59,440 --> 01:07:03,360
Or are they only experimenting in chat, trying prompts once and moving on?

1363
01:07:03,360 --> 01:07:06,600
This is the distinction between exploration and changed behavior.

1364
01:07:06,600 --> 01:07:10,400
A consulting team tracks the behavior that connects to the business scenario.

1365
01:07:10,400 --> 01:07:14,760
If the scenario is faster customer meeting preparation, measure whether account teams use

1366
01:07:14,760 --> 01:07:18,440
the approved sources and whether their preparation process changes.

1367
01:07:18,440 --> 01:07:22,560
If the scenario is reducing project follow-up effort, measure whether teams use the agreed

1368
01:07:22,560 --> 01:07:24,880
process and whether action tracking improves.

1369
01:07:24,880 --> 01:07:26,680
You don't need surveillance to do this.

1370
01:07:26,680 --> 01:07:31,400
Use sampled workflow reviews, manager feedback user interviews, support trends, and aggregated

1371
01:07:31,400 --> 01:07:32,400
service data.

1372
01:07:32,400 --> 01:07:35,560
Employees should understand what you measure, why you measure it, and what you will not

1373
01:07:35,560 --> 01:07:36,560
use it for.

1374
01:07:36,560 --> 01:07:40,320
If they believe every interaction becomes a personal performance score, they will either

1375
01:07:40,320 --> 01:07:43,760
avoid the tool or use it in ways that distort the evidence.

1376
01:07:43,760 --> 01:07:45,640
Keep the measurement focused on learning.

1377
01:07:45,640 --> 01:07:49,680
Pure learning helps here because people often trust a practical example from someone doing

1378
01:07:49,680 --> 01:07:52,480
the same job more than a central training session.

1379
01:07:52,480 --> 01:07:56,880
Get a route for teams to share what worked, what failed, and what they changed in their process.

1380
01:07:56,880 --> 01:07:58,880
The useful examples are specific.

1381
01:07:58,880 --> 01:08:00,640
Not copilot helped me save time.

1382
01:08:00,640 --> 01:08:04,200
Instead, I use this approach to prepare a briefing from these approved sources.

1383
01:08:04,200 --> 01:08:05,880
I still check these parts manually.

1384
01:08:05,880 --> 01:08:09,320
It removed this step from my process but it did not replace this review.

1385
01:08:09,320 --> 01:08:12,480
That kind of evidence gives colleagues a pattern they can test.

1386
01:08:12,480 --> 01:08:14,160
Managers also need a regular review point.

1387
01:08:14,160 --> 01:08:17,480
They should ask whether the chosen workflow still makes sense whether users have adopted

1388
01:08:17,480 --> 01:08:21,560
the agreed practice and whether the quality or risk controls need adjustment.

1389
01:08:21,560 --> 01:08:25,280
This should sit inside normal operational conversations where possible.

1390
01:08:25,280 --> 01:08:29,400
Not become a separate monthly ritual that disappears when priorities change.

1391
01:08:29,400 --> 01:08:34,160
Training cannot be a one-time event because the product, policy, and work itself will change.

1392
01:08:34,160 --> 01:08:37,480
Refresh guidance when new capabilities alter what users can do.

1393
01:08:37,480 --> 01:08:39,640
Update it when a security rule changes.

1394
01:08:39,640 --> 01:08:44,160
Rework it when evidence shows that users misunderstand a source boundary, skip a review step, or keep

1395
01:08:44,160 --> 01:08:46,400
asking the same question through support.

1396
01:08:46,400 --> 01:08:48,960
Treat each recurring problem as a learning backlog item.

1397
01:08:48,960 --> 01:08:52,920
In the issue, identify the affected scenario, decide who owns the fix, and test whether

1398
01:08:52,920 --> 01:08:54,920
the revised guidance changes behavior.

1399
01:08:54,920 --> 01:08:57,360
Some fixes will be a short prompt example.

1400
01:08:57,360 --> 01:09:01,760
Others will require a policy clarification, a better source of truth, or a change to the

1401
01:09:01,760 --> 01:09:02,840
workflow itself.

1402
01:09:02,840 --> 01:09:06,280
The deliverable is an adoption dashboard and a continuous learning backlog.

1403
01:09:06,280 --> 01:09:08,360
The dashboard shows where behavior is taking hold.

1404
01:09:08,360 --> 01:09:11,280
The backlog shows what the organization will improve next.

1405
01:09:11,280 --> 01:09:15,360
Together they stop adoption reporting from becoming a monthly count of clicks with no connection

1406
01:09:15,360 --> 01:09:16,560
to the work that changed.

1407
01:09:16,560 --> 01:09:20,480
Now connect that usage evidence to financial and business outcomes.

1408
01:09:20,480 --> 01:09:23,080
Measuring ROI build a defensible case.

1409
01:09:23,080 --> 01:09:26,520
ROI is where many co-pilot programs lose credibility.

1410
01:09:26,520 --> 01:09:30,560
Not because co-pilot cannot improve work, but because teams claim value before they define

1411
01:09:30,560 --> 01:09:31,560
what value means.

1412
01:09:31,560 --> 01:09:36,320
They count prompts, active users, or training attendance, then present that as a return on

1413
01:09:36,320 --> 01:09:37,320
investment.

1414
01:09:37,320 --> 01:09:39,880
Finance will quite reasonably ask a harder question.

1415
01:09:39,880 --> 01:09:41,200
What changed in the business?

1416
01:09:41,200 --> 01:09:43,600
Start with business KPIs tied to each scenario.

1417
01:09:43,600 --> 01:09:47,560
If a commercial team uses co-pilot to prepare account briefings, measure preparation time,

1418
01:09:47,560 --> 01:09:51,440
meeting readiness, follow-up speed, and perhaps the quality of customer response.

1419
01:09:51,440 --> 01:09:55,680
If a project team uses it to reduce meeting administration, measure the time from meeting

1420
01:09:55,680 --> 01:09:59,400
end to assigned actions, missed actions, and decision delays.

1421
01:09:59,400 --> 01:10:01,400
The measure must belong to the work.

1422
01:10:01,400 --> 01:10:03,960
Cycle time is often a good place to start because it is visible.

1423
01:10:03,960 --> 01:10:07,880
How long does it take to turn a request into a first draft, a reviewed draft, or a customer

1424
01:10:07,880 --> 01:10:08,880
response?

1425
01:10:08,880 --> 01:10:10,920
Yet faster work is not always better work.

1426
01:10:10,920 --> 01:10:12,240
Add a quality measure.

1427
01:10:12,240 --> 01:10:16,200
Ask the manager or a sample reviewer whether the output met the existing standard, needed

1428
01:10:16,200 --> 01:10:18,240
less rework or created new errors.

1429
01:10:18,240 --> 01:10:19,440
Decision speed can also matter.

1430
01:10:19,440 --> 01:10:23,540
A leadership team may spend days reconstructing context from emails, documents, and meeting

1431
01:10:23,540 --> 01:10:25,840
records before it can make a routine decision.

1432
01:10:25,840 --> 01:10:30,160
If co-pilot shortens that process while preserving sound review, the value is not merely

1433
01:10:30,160 --> 01:10:31,480
time-saved.

1434
01:10:31,480 --> 01:10:35,600
It can reduce delay in a project, customer issue, or operational approval.

1435
01:10:35,600 --> 01:10:39,240
Customer experience belongs in the model where the scenario touches customers.

1436
01:10:39,240 --> 01:10:43,080
You might measure response time, resolution time, consistency of communication or customer

1437
01:10:43,080 --> 01:10:44,080
feedback.

1438
01:10:44,080 --> 01:10:48,040
Don't claim that co-pilot improved customer experience because users like the tool show

1439
01:10:48,040 --> 01:10:49,760
the link through the workflow.

1440
01:10:49,760 --> 01:10:51,240
Technical KPIs have a different purpose.

1441
01:10:51,240 --> 01:10:55,200
They tell you whether the service is being used in the way your scenario expected and whether

1442
01:10:55,200 --> 01:10:57,040
the operating model can support it.

1443
01:10:57,040 --> 01:11:02,040
Track active users, repeat use, relevant feature use, support demand, error patterns, and

1444
01:11:02,040 --> 01:11:03,040
control events.

1445
01:11:03,040 --> 01:11:05,640
A rise in support tickets is not automatically bad.

1446
01:11:05,640 --> 01:11:08,240
During a new wave, it may show that people are engaging.

1447
01:11:08,240 --> 01:11:12,040
The question is whether the same issues keep returning and whether the support model resolves

1448
01:11:12,040 --> 01:11:13,640
them.

1449
01:11:13,640 --> 01:11:15,040
Feature use also needs context.

1450
01:11:15,040 --> 01:11:19,520
A department might use co-pilot chat frequently, but rarely use the app experiences tied

1451
01:11:19,520 --> 01:11:20,520
to the scenario.

1452
01:11:20,520 --> 01:11:23,800
That can tell you the workflow design has not taken hold.

1453
01:11:23,800 --> 01:11:27,000
Or it may show that the scenario itself needs a different route.

1454
01:11:27,000 --> 01:11:31,040
Don't force adoption into a feature just because the original plan expected it, then

1455
01:11:31,040 --> 01:11:34,800
calculate the financial picture, start with full cost per user, not just the license,

1456
01:11:34,800 --> 01:11:40,920
through the license cost, training, support, administration, governance work, security controls,

1457
01:11:40,920 --> 01:11:44,640
and the share of remediation needed to operate the service responsibly.

1458
01:11:44,640 --> 01:11:48,680
At department level show the local license allocation and the common service costs that

1459
01:11:48,680 --> 01:11:49,760
support it.

1460
01:11:49,760 --> 01:11:51,280
That makes the discussion more honest.

1461
01:11:51,280 --> 01:11:53,760
Next, calculate capacity recovered.

1462
01:11:53,760 --> 01:11:56,040
This is where teams often get ahead of themselves.

1463
01:11:56,040 --> 01:12:00,480
If employees save 30 minutes a day, that does not automatically create 30 minutes of financial

1464
01:12:00,480 --> 01:12:01,480
benefit.

1465
01:12:01,480 --> 01:12:05,040
Deception pays the same salary unless it uses that recovered time differently.

1466
01:12:05,040 --> 01:12:07,400
The real question is what happened to the capacity?

1467
01:12:07,400 --> 01:12:10,400
Did the team handle more customer cases without extra hiring?

1468
01:12:10,400 --> 01:12:12,240
Did it reduce contractor spend?

1469
01:12:12,240 --> 01:12:14,840
Did it improve response times within the same headcount?

1470
01:12:14,840 --> 01:12:19,240
Did people shift time from repetitive coordination into revenue work, quality checks, or project

1471
01:12:19,240 --> 01:12:20,240
delivery?

1472
01:12:20,240 --> 01:12:23,040
Or did the saved minutes simply disappear into the day?

1473
01:12:23,040 --> 01:12:24,480
There is no shame in the last answer.

1474
01:12:24,480 --> 01:12:29,280
It may still improve employee experience, but it is not the same as a hard financial return,

1475
01:12:29,280 --> 01:12:31,280
build the model with visible assumptions.

1476
01:12:31,280 --> 01:12:35,400
State the number of users in the scenario, the frequency of the task, the baseline effort,

1477
01:12:35,400 --> 01:12:39,400
the measured change, the percentage of recovered time that becomes productive capacity, and

1478
01:12:39,400 --> 01:12:41,920
the cost basis used by finance.

1479
01:12:41,920 --> 01:12:44,560
If an assumption is uncertain, label it as uncertain.

1480
01:12:44,560 --> 01:12:46,680
That is more credible than false precision.

1481
01:12:46,680 --> 01:12:49,520
Use scenario level baselines before the rollout.

1482
01:12:49,520 --> 01:12:51,960
Then validate the result with samples.

1483
01:12:51,960 --> 01:12:55,880
Compare work completed before and after, while allowing for changes in demand, seasonality

1484
01:12:55,880 --> 01:12:57,440
and team composition.

1485
01:12:57,440 --> 01:13:01,240
Ask managers for evidence, but don't let manager opinion replace measurement.

1486
01:13:01,240 --> 01:13:04,280
Investments should review the model before it reaches the executive group.

1487
01:13:04,280 --> 01:13:06,280
A good business case has three views.

1488
01:13:06,280 --> 01:13:11,600
The conservative case counts only verified cost avoidance or measurable throughput gains.

1489
01:13:11,600 --> 01:13:16,240
The expected case includes validated capacity redirected into agreed business work.

1490
01:13:16,240 --> 01:13:21,240
The strategic case may include softer benefits such as faster decisions or improved employee

1491
01:13:21,240 --> 01:13:24,520
experience, but it keeps those separate from cashable savings.

1492
01:13:24,520 --> 01:13:25,840
Here is the trade-off.

1493
01:13:25,840 --> 01:13:28,400
Generic vendor studies can help you form a hypothesis.

1494
01:13:28,400 --> 01:13:30,640
They cannot prove your organization's return.

1495
01:13:30,640 --> 01:13:34,080
Your data estate work patterns, controls and adoption level are different.

1496
01:13:34,080 --> 01:13:37,800
Use external research as context, not as the number you take to the board.

1497
01:13:37,800 --> 01:13:42,080
The deliverables are an executive dashboard and ROI model and a benefits realization plan.

1498
01:13:42,080 --> 01:13:46,720
The dashboard gives leaders a view of outcomes, cost, adoption, support and risk.

1499
01:13:46,720 --> 01:13:49,360
The ROI model explains how the numbers were calculated.

1500
01:13:49,360 --> 01:13:54,000
The benefits realization plan assigns owners to turn recovered capacity into an outcome the

1501
01:13:54,000 --> 01:13:55,440
business can actually see.

1502
01:13:55,440 --> 01:13:58,400
A good dashboard does not justify scale by itself.

1503
01:13:58,400 --> 01:14:02,400
The scale decision depends on whether you can repeat the controls, the workflow patterns

1504
01:14:02,400 --> 01:14:07,280
and the financial discipline across the next part of the enterprise.

1505
01:14:07,280 --> 01:14:10,840
Scaling enterprise wide from hundreds to tens of thousands.

1506
01:14:10,840 --> 01:14:13,920
Scaling co-pilot is not a larger version of a pilot.

1507
01:14:13,920 --> 01:14:18,600
At 500 users, a central team can still know most of the use cases, answer many questions

1508
01:14:18,600 --> 01:14:23,880
directly and intervene when something goes wrong at 50,000 users that model breaks.

1509
01:14:23,880 --> 01:14:25,600
Request to arrive from every region.

1510
01:14:25,600 --> 01:14:27,160
Policies meet local practice.

1511
01:14:27,160 --> 01:14:28,320
Support tickets multiply.

1512
01:14:28,320 --> 01:14:31,720
A small number of week controls can create a large operational burden.

1513
01:14:31,720 --> 01:14:35,840
So scale through repeatable scenario clusters, not through one large license upload.

1514
01:14:35,840 --> 01:14:40,480
A scenario cluster groups people who do similar work, you similar sources, face similar risks

1515
01:14:40,480 --> 01:14:42,000
and can learn from the same playbook.

1516
01:14:42,000 --> 01:14:46,000
It might include account teams preparing customer briefings, project managers converting

1517
01:14:46,000 --> 01:14:52,080
meetings into actions or HR teams preparing internal communications under defined review rules.

1518
01:14:52,080 --> 01:14:54,360
The expansion unit is not the whole department.

1519
01:14:54,360 --> 01:14:58,240
It is a group with a known work pattern and accountable business lead, a support route

1520
01:14:58,240 --> 01:15:00,720
and evidence from a prior wave that the pattern works.

1521
01:15:00,720 --> 01:15:04,880
This gives you a way to expand without rebuilding the deployment from scratch every time.

1522
01:15:04,880 --> 01:15:07,560
Global rollout adds decisions that local pilots can hide.

1523
01:15:07,560 --> 01:15:08,560
Language is one of them.

1524
01:15:08,560 --> 01:15:12,880
A prompt pattern that works well in English may need adjustment for local business language,

1525
01:15:12,880 --> 01:15:15,680
document standards or cultural expectations.

1526
01:15:15,680 --> 01:15:18,840
Training needs a local example, not simply translated slides.

1527
01:15:18,840 --> 01:15:23,720
Support also needs people who understand the user's working context, not just the platform.

1528
01:15:23,720 --> 01:15:25,520
Social policy differences matter as well.

1529
01:15:25,520 --> 01:15:30,280
Data residency, local regulatory requirements, labor rules, privacy expectations and works

1530
01:15:30,280 --> 01:15:32,840
councils may change the sequence of the rollout.

1531
01:15:32,840 --> 01:15:37,080
In some regions, you may need more consultation before enabling certain capabilities.

1532
01:15:37,080 --> 01:15:41,840
In others, local laws may affect which data sources monitoring practices or employee communications

1533
01:15:41,840 --> 01:15:42,840
are acceptable.

1534
01:15:42,840 --> 01:15:46,560
Don't treat this as a blocker to global scale, treat it as deployment design.

1535
01:15:46,560 --> 01:15:51,440
Set a global minimum standard for identity, security, data handling, audit and governance.

1536
01:15:51,440 --> 01:15:55,920
And let local accountable owners apply that standard within their legal and operating context.

1537
01:15:55,920 --> 01:15:59,320
The global team should not guess how a regional requirement works.

1538
01:15:59,320 --> 01:16:02,960
The regional team should not create a separate co-pilot policy because it is easier than

1539
01:16:02,960 --> 01:16:04,720
working through the shared model.

1540
01:16:04,720 --> 01:16:06,360
That brings us to ownership at scale.

1541
01:16:06,360 --> 01:16:09,760
You need central coordination, but you do not need a central bottleneck.

1542
01:16:09,760 --> 01:16:14,640
An AI center of excellence should provide standards, reusable assets, architecture patterns,

1543
01:16:14,640 --> 01:16:17,880
controls, measurement methods and expert support.

1544
01:16:17,880 --> 01:16:21,560
It should also identify issues that recur across the enterprise and turn those lessons into

1545
01:16:21,560 --> 01:16:22,760
better guidance.

1546
01:16:22,760 --> 01:16:24,920
It should not approve every routine request.

1547
01:16:24,920 --> 01:16:30,200
If every license wave, training session and low-risk scenario needs central committee approval,

1548
01:16:30,200 --> 01:16:32,160
the business will root around the model.

1549
01:16:32,160 --> 01:16:35,240
Give local teams a clear path for standard scenarios.

1550
01:16:35,240 --> 01:16:40,480
Reserve central review for exceptions, high-risk data, external connectors, agents with actions,

1551
01:16:40,480 --> 01:16:43,880
regional regulatory concerns or material changes to the service.

1552
01:16:43,880 --> 01:16:47,120
Think of the AI center of excellence as a coordination function.

1553
01:16:47,120 --> 01:16:51,320
It sets the root, maintains the shared standards and watches for problems that cross organizational

1554
01:16:51,320 --> 01:16:52,320
boundaries.

1555
01:16:52,320 --> 01:16:55,840
Business units still own their workflows, data owners still own their data, security still

1556
01:16:55,840 --> 01:16:59,640
owns security decisions, the center helps those groups move in the same direction without

1557
01:16:59,640 --> 01:17:01,000
taking over their jobs.

1558
01:17:01,000 --> 01:17:03,960
The support model has to mature at the same pace as the rollout.

1559
01:17:03,960 --> 01:17:07,960
At enterprise scale, a single mailbox or team's channel is not a service model.

1560
01:17:07,960 --> 01:17:09,320
You need tiered support.

1561
01:17:09,320 --> 01:17:14,720
The first tier handles common, how-to questions, approved scenario guidance and access issues.

1562
01:17:14,720 --> 01:17:18,000
Local enablement leads provide peer support close to the work.

1563
01:17:18,000 --> 01:17:22,480
Platform operations handles service configuration, licensing and technical defects.

1564
01:17:22,480 --> 01:17:27,240
Security and compliance teams own escalations, involving data exposure, policy breaches or

1565
01:17:27,240 --> 01:17:28,720
suspicious activity.

1566
01:17:28,720 --> 01:17:31,680
Vendor management also becomes part of the operating model.

1567
01:17:31,680 --> 01:17:36,320
Track service changes, licensing changes, support commitments, known limitations and road map

1568
01:17:36,320 --> 01:17:39,400
items that may affect your controls or training material.

1569
01:17:39,400 --> 01:17:40,680
Product change moves quickly.

1570
01:17:40,680 --> 01:17:44,840
A feature introduced into the tenant can alter user expectations before the operating model

1571
01:17:44,840 --> 01:17:48,360
catches up, which is always a popular surprise for a governance team.

1572
01:17:48,360 --> 01:17:50,360
Your expansion waves should have entry criteria.

1573
01:17:50,360 --> 01:17:54,120
A regional business group enters when it has an accountable leader, a usable scenario

1574
01:17:54,120 --> 01:17:58,760
set, required controls, local support coverage and capacity for enablement.

1575
01:17:58,760 --> 01:18:03,200
It exits the wave review when it shows stable use, manageable support demand, acceptable

1576
01:18:03,200 --> 01:18:07,680
risk and evidence that its chosen workflows are producing the expected outcomes.

1577
01:18:07,680 --> 01:18:11,360
This creates a rolling enterprise rollout plan rather than a single launch date.

1578
01:18:11,360 --> 01:18:12,880
Some groups will move quickly.

1579
01:18:12,880 --> 01:18:18,160
Others will need time to resolve data, policy or organizational issues that is not inconsistency.

1580
01:18:18,160 --> 01:18:19,600
It is risk-based delivery.

1581
01:18:19,600 --> 01:18:24,360
The deliverables are an AI center of excellence blueprint and an enterprise rollout plan.

1582
01:18:24,360 --> 01:18:30,000
The blueprint defines central and local responsibilities, decision routes, service layers and escalation

1583
01:18:30,000 --> 01:18:31,000
parts.

1584
01:18:31,000 --> 01:18:35,000
The rollout plan shows each expansion wave, its readiness criteria, its local owners and

1585
01:18:35,000 --> 01:18:38,560
the support capacity required before licenses are assigned.

1586
01:18:38,560 --> 01:18:42,680
As co-pilot reaches more of the enterprise, every shortcut taken in the first phase becomes

1587
01:18:42,680 --> 01:18:44,560
easier to see.

1588
01:18:44,560 --> 01:18:47,000
Continuous optimization and the 12 month road map.

1589
01:18:47,000 --> 01:18:50,880
An enterprise rollout does not end when the last planned license wave goes live.

1590
01:18:50,880 --> 01:18:54,640
That is usually when the more difficult work begins, because the service now has users

1591
01:18:54,640 --> 01:18:59,040
with different needs, regions with different constraints and a steady flow of new co-pilot

1592
01:18:59,040 --> 01:19:01,760
features, connectors and agent requests.

1593
01:19:01,760 --> 01:19:06,240
We need a 12 month road map that makes those decisions deliberate for the first 30 days

1594
01:19:06,240 --> 01:19:08,040
focus on the foundation.

1595
01:19:08,040 --> 01:19:12,520
Confirm the executive strategy, complete the readiness work for the initial scope, prioritize

1596
01:19:12,520 --> 01:19:16,080
the risks that can block the pilot and establish the control baseline.

1597
01:19:16,080 --> 01:19:18,240
This is not the period for broad access.

1598
01:19:18,240 --> 01:19:22,120
The main decisions in this first period are practical, which business scenarios enter

1599
01:19:22,120 --> 01:19:25,400
the pilot, who owns each one which data sources are in scope.

1600
01:19:25,400 --> 01:19:27,920
What permission risks need immediate remediation?

1601
01:19:27,920 --> 01:19:31,040
What control evidence must exist before users begin normal work?

1602
01:19:31,040 --> 01:19:35,240
By day 30 you should have a named sponsor, accountable business leads, a risk register and initial

1603
01:19:35,240 --> 01:19:39,880
scenario portfolio and a pilot design that can be approved or rejected on evidence.

1604
01:19:39,880 --> 01:19:44,120
From day 31 to day 90, run the controlled pilot and build the adoption system around

1605
01:19:44,120 --> 01:19:45,120
it.

1606
01:19:45,120 --> 01:19:48,720
This period is about testing the chosen workflows under normal business pressure.

1607
01:19:48,720 --> 01:19:53,160
Users need role-based guidance, managers need to review whether the work actually changes,

1608
01:19:53,160 --> 01:19:55,840
support teams need to see what users struggle with.

1609
01:19:55,840 --> 01:19:59,320
Security and governance teams need to observe whether the controls behave as intended.

1610
01:19:59,320 --> 01:20:01,320
Keep a decision gate at the end of this period.

1611
01:20:01,320 --> 01:20:03,520
You are not asking whether people enjoyed the pilot.

1612
01:20:03,520 --> 01:20:07,680
You are deciding whether the scenario should expand, whether a known gap needs remediation

1613
01:20:07,680 --> 01:20:10,760
or whether the organization should stop spending on that use case.

1614
01:20:10,760 --> 01:20:12,200
The difference is expensive.

1615
01:20:12,200 --> 01:20:16,360
During months, fall through eight, expand through the scenario clusters that have already

1616
01:20:16,360 --> 01:20:17,720
shown enough evidence.

1617
01:20:17,720 --> 01:20:21,160
Do not widen scope simply because a quarter has ended and the roll-out plan needs a new

1618
01:20:21,160 --> 01:20:22,160
number.

1619
01:20:22,160 --> 01:20:25,520
Expand where the next groups meet the readiness criteria, where their work resembles

1620
01:20:25,520 --> 01:20:29,480
the proven scenario and where local support can handle the change.

1621
01:20:29,480 --> 01:20:33,120
This is also the period where regional readiness becomes more visible.

1622
01:20:33,120 --> 01:20:37,680
Some locations will need local training, adapted materials, regional data decisions, or

1623
01:20:37,680 --> 01:20:40,000
extra consultation before they move forward.

1624
01:20:40,000 --> 01:20:44,480
Build those activities into the wave plan rather than treating them as late exceptions.

1625
01:20:44,480 --> 01:20:46,600
Your support model should mature at the same time.

1626
01:20:46,600 --> 01:20:50,720
The first waves often depend heavily on central experts because the questions are new.

1627
01:20:50,720 --> 01:20:54,040
By the middle of the year, common issues should have clear self-service guidance, repeatable

1628
01:20:54,040 --> 01:20:58,760
support procedures, and local champions who can handle the normal workflow questions.

1629
01:20:58,760 --> 01:21:02,760
Central teams should spend less time explaining basic usage and more time addressing patterns,

1630
01:21:02,760 --> 01:21:05,440
risks, and requests that need enterprise decisions.

1631
01:21:05,440 --> 01:21:07,640
Months 9-12 are for optimization.

1632
01:21:07,640 --> 01:21:11,200
Review license allocation against actual scenario outcomes.

1633
01:21:11,200 --> 01:21:13,680
Reclaim licenses where the business case did not develop.

1634
01:21:13,680 --> 01:21:16,800
Reassign capacity where demand and evidence are stronger.

1635
01:21:16,800 --> 01:21:20,040
Update the financial forecast based on operating costs, not the assumptions you made before

1636
01:21:20,040 --> 01:21:21,040
the pilot.

1637
01:21:21,040 --> 01:21:23,640
This is also when agent opportunities become more credible.

1638
01:21:23,640 --> 01:21:27,720
By now you should know which workflows have stable source material, clear business ownership,

1639
01:21:27,720 --> 01:21:31,160
repeat use, and enough friction left that a focused agent might help.

1640
01:21:31,160 --> 01:21:34,520
That does not mean every successful co-pilot scenario needs an agent.

1641
01:21:34,520 --> 01:21:38,840
It means you can assess agent proposals with real evidence rather than a slide deck full

1642
01:21:38,840 --> 01:21:40,080
of ambition.

1643
01:21:40,080 --> 01:21:43,720
New product capabilities, connectors, and agent patterns will continue to appear throughout

1644
01:21:43,720 --> 01:21:44,720
the year.

1645
01:21:44,720 --> 01:21:46,280
Apply the same framework every time.

1646
01:21:46,280 --> 01:21:47,960
What business problem does this solve?

1647
01:21:47,960 --> 01:21:49,600
Who owns the workflow and data?

1648
01:21:49,600 --> 01:21:53,400
What new access, support, security, or life cycle decisions does it create?

1649
01:21:53,400 --> 01:21:55,440
What happens if it scales beyond the first team?

1650
01:21:55,440 --> 01:21:58,720
If you cannot answer those questions, the request is not ready for production.

1651
01:21:58,720 --> 01:22:03,200
Your deliverable is a 12 month enterprise roadmap with named milestones and decision gates.

1652
01:22:03,200 --> 01:22:06,720
It should show what happens in each phase, who owns the outcome, what evidence allows

1653
01:22:06,720 --> 01:22:09,480
the next move, and what conditions pause expansion.

1654
01:22:09,480 --> 01:22:12,320
A roadmap without decision gates is just a calendar.

1655
01:22:12,320 --> 01:22:16,400
It tells people when activity will happen, but not whether that activity should continue.

1656
01:22:16,400 --> 01:22:20,400
Before we come to the recommendation, we need to confront the mistakes that repeatedly

1657
01:22:20,400 --> 01:22:23,320
turn a sound investment into an expensive pilot.

1658
01:22:23,320 --> 01:22:26,600
What experience consultants stop early?

1659
01:22:26,600 --> 01:22:29,160
The first mistake happens before the project even has a name.

1660
01:22:29,160 --> 01:22:34,480
An organization buys licenses, announces an AI program, and only then asks what co-pilot can

1661
01:22:34,480 --> 01:22:36,560
reach through existing permissions.

1662
01:22:36,560 --> 01:22:39,840
By that point, the pressure is already moving in the wrong direction.

1663
01:22:39,840 --> 01:22:43,800
Procurement once the licenses are signed, leaders want visible progress.

1664
01:22:43,800 --> 01:22:45,040
Security is asked to catch up.

1665
01:22:45,040 --> 01:22:47,040
That sequence creates a voidable risk.

1666
01:22:47,040 --> 01:22:48,320
Co-pilot doesn't invent access.

1667
01:22:48,320 --> 01:22:49,840
It makes access easier to use.

1668
01:22:49,840 --> 01:22:54,560
So if your SharePoint sites contain broad groups, old sharing links, unclear ownership, or folders

1669
01:22:54,560 --> 01:22:58,480
with broken inheritance, co-pilot makes the result of that history more visible.

1670
01:22:58,480 --> 01:23:01,080
The fix isn't to panic or shut down collaboration.

1671
01:23:01,080 --> 01:23:04,920
It is to assess the risk before you make broad access part of the user experience.

1672
01:23:04,920 --> 01:23:07,120
The next mistake is confusing activity with value.

1673
01:23:07,120 --> 01:23:11,240
A dashboard may show lots of users, lots of chats, and lots of time spent in the service

1674
01:23:11,240 --> 01:23:15,480
that can look reassuring, but a busy pilot can still produce no measurable business

1675
01:23:15,480 --> 01:23:16,480
result.

1676
01:23:16,480 --> 01:23:17,800
What changed in the workflow?

1677
01:23:17,800 --> 01:23:19,920
Did a team respond to customers faster?

1678
01:23:19,920 --> 01:23:22,680
Did a manager spend less time rebuilding project context?

1679
01:23:22,680 --> 01:23:24,400
Did document review produce fewer errors?

1680
01:23:24,400 --> 01:23:27,560
If nobody can answer those questions, the pilot has evidence of interest, not evidence

1681
01:23:27,560 --> 01:23:28,560
of return.

1682
01:23:28,560 --> 01:23:31,280
This is where experience consultants slow the conversation down.

1683
01:23:31,280 --> 01:23:33,240
They ask the uncomfortable question.

1684
01:23:33,240 --> 01:23:36,360
Would you renew these licenses if the usage report disappeared?

1685
01:23:36,360 --> 01:23:39,960
If the answer is unclear, your measures are too weak.

1686
01:23:39,960 --> 01:23:44,280
Another common failure is treating co-pilot as an IT project, while business leaders remain

1687
01:23:44,280 --> 01:23:45,520
spectators.

1688
01:23:45,520 --> 01:23:49,920
It can configure services, manage licenses, secure identity, and provide support.

1689
01:23:49,920 --> 01:23:54,440
It cannot decide which work is worth changing, whether output quality meets a business standard

1690
01:23:54,440 --> 01:23:56,440
or where recovered capacity should go.

1691
01:23:56,440 --> 01:23:58,080
The business has to own the workflow.

1692
01:23:58,080 --> 01:24:01,360
When a business leader says, "It is rolling out co-pilot to us?"

1693
01:24:01,360 --> 01:24:02,960
You already have a warning sign.

1694
01:24:02,960 --> 01:24:04,200
The language should be different.

1695
01:24:04,200 --> 01:24:08,920
The business is improving a defined work pattern, with IT providing the platform and controls.

1696
01:24:08,920 --> 01:24:13,240
That shared model changes the quality of decisions, because each group owns the part

1697
01:24:13,240 --> 01:24:14,800
it can actually influence.

1698
01:24:14,800 --> 01:24:17,520
Training is another area where good intentions often fail.

1699
01:24:17,520 --> 01:24:22,160
A broad launch webinar, a prompt library, and a few video links may create a burst of attention.

1700
01:24:22,160 --> 01:24:26,280
Then usage drops, because people cannot see how the tool fits into the work waiting on

1701
01:24:26,280 --> 01:24:27,280
their desk.

1702
01:24:27,280 --> 01:24:28,800
Generic training teaches a product.

1703
01:24:28,800 --> 01:24:30,280
It rarely changes a process.

1704
01:24:30,280 --> 01:24:34,080
Give people examples that match their role, their source material, their review duties,

1705
01:24:34,080 --> 01:24:35,360
and their real constraints.

1706
01:24:35,360 --> 01:24:37,920
Then give them a place to ask questions after the training ends.

1707
01:24:37,920 --> 01:24:41,840
Without that, people either stop using the tool or create workarounds that bypass the

1708
01:24:41,840 --> 01:24:43,960
controls you spend months putting in place.

1709
01:24:43,960 --> 01:24:46,880
Questions help, but only when the organization supports them.

1710
01:24:46,880 --> 01:24:51,240
Naming enthusiastic volunteers as champions, without giving them time, guidance, or a root

1711
01:24:51,240 --> 01:24:54,200
for escalation, simply moves the burden into the business.

1712
01:24:54,200 --> 01:24:58,120
They become the unofficial help desk, then burn out or give inconsistent advice.

1713
01:24:58,120 --> 01:25:02,520
A champion network needs a purpose, a support path, and managers who recognize that this is

1714
01:25:02,520 --> 01:25:03,960
part of the role.

1715
01:25:03,960 --> 01:25:06,960
Missing executive sponsorship creates a different kind of failure.

1716
01:25:06,960 --> 01:25:11,800
Without a sponsor who can make cross-functional decisions, every difficult issue gets stuck.

1717
01:25:11,800 --> 01:25:13,080
He waits for legal.

1718
01:25:13,080 --> 01:25:14,520
Legal waits for business ownership.

1719
01:25:14,520 --> 01:25:16,240
Finance asks for a case that nobody owns.

1720
01:25:16,240 --> 01:25:20,520
The project continues because no one formally stops it, but it cannot move with confidence

1721
01:25:20,520 --> 01:25:21,520
either.

1722
01:25:21,520 --> 01:25:23,560
The sponsor doesn't need to approve every detail.

1723
01:25:23,560 --> 01:25:27,800
They need the authority to resolve trade-offs when the groups around the table disagree.

1724
01:25:27,800 --> 01:25:31,040
Unclear governance has the same effect at a larger scale.

1725
01:25:31,040 --> 01:25:34,800
If nobody knows who can approve an exception, accept a risk, or decide whether an agent should

1726
01:25:34,800 --> 01:25:38,880
move beyond the team, people will either wait too long or act without approval.

1727
01:25:38,880 --> 01:25:43,640
The outcome is cost-time, poor information architecture is often harder to see because it sits beneath

1728
01:25:43,640 --> 01:25:45,240
the visible project plan.

1729
01:25:45,240 --> 01:25:49,280
Teams may have documents in several places, competing versions of the same policy, vague

1730
01:25:49,280 --> 01:25:52,480
names, abandoned workspaces, and no clear source of truth.

1731
01:25:52,480 --> 01:25:56,320
Co-pilot cannot determine which document your organization intended to trust.

1732
01:25:56,320 --> 01:26:00,440
It can work with the content available to it, and that makes information discipline a business

1733
01:26:00,440 --> 01:26:03,560
responsibility, not an optional cleanup exercise.

1734
01:26:03,560 --> 01:26:05,520
Then there is the missing post-pilot road map.

1735
01:26:05,520 --> 01:26:10,040
A pilot reaches its end, people share positive feedback, and the organization announces success.

1736
01:26:10,040 --> 01:26:14,080
But no one has defined the next wave of the support model, the control changes, the licensing

1737
01:26:14,080 --> 01:26:16,280
rules, or the decision gate for expansion.

1738
01:26:16,280 --> 01:26:20,720
The pilot becomes a permanent small program too successful to stop and too incomplete to scale.

1739
01:26:20,720 --> 01:26:23,800
Finally, don't expect AI to fix a broken process.

1740
01:26:23,800 --> 01:26:28,440
If a workflow has unclear ownership, poor source data, unnecessary approvals, and conflicting

1741
01:26:28,440 --> 01:26:31,960
policy, co-pilot may help people produce documents faster.

1742
01:26:31,960 --> 01:26:34,480
It will not make the underlying process coherent.

1743
01:26:34,480 --> 01:26:38,480
In some cases, it simply helps the organization move confusion at a higher speed.

1744
01:26:38,480 --> 01:26:40,320
Pause and look at your own plan.

1745
01:26:40,320 --> 01:26:42,480
Which of these mistakes has already entered it?

1746
01:26:42,480 --> 01:26:46,840
Which one is someone calling a later phase because it is politically easier to postpone?

1747
01:26:46,840 --> 01:26:50,720
The answer depends less on whether co-pilot is impressive and more on whether your organization

1748
01:26:50,720 --> 01:26:53,680
can carry the operating model that comes with it.

1749
01:26:53,680 --> 01:26:55,960
Should every enterprise deploy co-pilot?

1750
01:26:55,960 --> 01:26:59,360
Should every enterprise deploy a Microsoft 365 co-pilot?

1751
01:26:59,360 --> 01:27:01,000
No, not automatically.

1752
01:27:01,000 --> 01:27:02,520
And that isn't a rejection of co-pilot.

1753
01:27:02,520 --> 01:27:04,760
It's a rejection of a poor deployment decision.

1754
01:27:04,760 --> 01:27:08,560
An enterprise should deploy co-pilot when it can point to business scenarios where

1755
01:27:08,560 --> 01:27:13,320
better access to context, faster drafting, less time spent finding information, or more

1756
01:27:13,320 --> 01:27:16,840
consistent follow-up will change work in a measurable way.

1757
01:27:16,840 --> 01:27:21,680
It should also have enough control over identity, data access, security, and support to operate

1758
01:27:21,680 --> 01:27:23,000
the service responsibly.

1759
01:27:23,000 --> 01:27:24,000
That is the threshold.

1760
01:27:24,000 --> 01:27:25,080
You don't need a perfect tenant.

1761
01:27:25,080 --> 01:27:26,400
Few enterprises have one.

1762
01:27:26,400 --> 01:27:30,080
You do need an honest view of the risks in the scope you plan to enable, named owners

1763
01:27:30,080 --> 01:27:34,560
who can deal with them and a plan that prevents a small pilot from turning into uncontrolled

1764
01:27:34,560 --> 01:27:36,440
access at scale.

1765
01:27:36,440 --> 01:27:39,680
For small and mid-market organizations, the answer can be simpler.

1766
01:27:39,680 --> 01:27:43,880
They often have fewer regions, fewer policy layers, and a smaller number of data stores.

1767
01:27:43,880 --> 01:27:47,520
That can make a focused rollout easier, but it also means there may be less capacity for

1768
01:27:47,520 --> 01:27:49,640
governance, support, and change work.

1769
01:27:49,640 --> 01:27:50,640
Keep the scope narrow.

1770
01:27:50,640 --> 01:27:53,160
Pick a small number of repeatable scenarios.

1771
01:27:53,160 --> 01:27:55,200
Give ownership to leaders who know the work.

1772
01:27:55,200 --> 01:27:57,360
Set clear rules for data handling and review.

1773
01:27:57,360 --> 01:28:01,720
Then expand only where users and managers can show a real change in the work.

1774
01:28:01,720 --> 01:28:03,480
Large enterprises need more formal discipline.

1775
01:28:03,480 --> 01:28:07,640
They operate across regions, business units, legal entities, labor rules, and inherited

1776
01:28:07,640 --> 01:28:08,640
systems.

1777
01:28:08,640 --> 01:28:12,800
A decision that looks simple from Central IT can create a different effect in a local market.

1778
01:28:12,800 --> 01:28:17,720
So large enterprises need clear global standards, local owners, lifecycle controls, regional rollout

1779
01:28:17,720 --> 01:28:22,120
design, and a coordination model that can manage exceptions without creating gridlock.

1780
01:28:22,120 --> 01:28:24,640
The scale of the tenant does not create value.

1781
01:28:24,640 --> 01:28:27,160
It increases the cost of weak decisions.

1782
01:28:27,160 --> 01:28:30,560
Highly regulated organizations should set a higher bar before broad access.

1783
01:28:30,560 --> 01:28:35,160
If you operate in healthcare, financial services, public sector, defense, or another closely

1784
01:28:35,160 --> 01:28:38,720
governed field, you need evidence that your controls work in the scenarios you intend

1785
01:28:38,720 --> 01:28:39,720
to support.

1786
01:28:39,720 --> 01:28:40,760
You need audit parts.

1787
01:28:40,760 --> 01:28:43,320
You need clear retention and e-discovery positions.

1788
01:28:43,320 --> 01:28:47,440
You need to know how data boundaries, local obligations, and human review requirements affect

1789
01:28:47,440 --> 01:28:48,440
the service.

1790
01:28:48,440 --> 01:28:50,440
That does not mean you should wait indefinitely.

1791
01:28:50,440 --> 01:28:55,160
It means you prove the controls and the workflow in a contained scope before you invite

1792
01:28:55,160 --> 01:28:56,760
the whole organization in.

1793
01:28:56,760 --> 01:28:59,720
A controlled pilot can be a sensible way to build evidence.

1794
01:28:59,720 --> 01:29:04,240
A broad launch without that evidence is simply asking the risk team to bless uncertainty.

1795
01:29:04,240 --> 01:29:05,880
So my recommendation is direct.

1796
01:29:05,880 --> 01:29:06,880
Fix identity first.

1797
01:29:06,880 --> 01:29:08,880
Review permissions before broad deployment.

1798
01:29:08,880 --> 01:29:11,880
Establish governance before you create demand you cannot manage.

1799
01:29:11,880 --> 01:29:15,320
Improve the information architecture around the scenarios you want to support.

1800
01:29:15,320 --> 01:29:20,200
Then deploy co-pilot in phases with business ownership and a clear test for value.

1801
01:29:20,200 --> 01:29:23,680
If your plan starts with a tenant-wide license assignment, pause it.

1802
01:29:23,680 --> 01:29:27,960
You may still reach a broad rollout, but first, earn the right to scale.

1803
01:29:27,960 --> 01:29:30,160
Next steps the first 90 days.

1804
01:29:30,160 --> 01:29:34,840
The first 90 days should produce decisions, not just activity, start by naming four

1805
01:29:34,840 --> 01:29:35,840
accountabilities.

1806
01:29:35,840 --> 01:29:39,240
You need an executive sponsor with authority to resolve business trade-offs.

1807
01:29:39,240 --> 01:29:41,960
You need an accountable platform owner for the co-pilot service.

1808
01:29:41,960 --> 01:29:45,800
You need a security owner who can set and assess the control bar, and you need business

1809
01:29:45,800 --> 01:29:47,840
leads who own the workflows being tested.

1810
01:29:47,840 --> 01:29:49,120
Write those names down.

1811
01:29:49,120 --> 01:29:53,240
If any of those roles are shared across several people, make the decision rights clear.

1812
01:29:53,240 --> 01:29:57,600
A large team can contribute expertise, but someone still needs to make the call when the business

1813
01:29:57,600 --> 01:30:00,120
wants speed and security needs more evidence.

1814
01:30:00,120 --> 01:30:04,120
Next, commission an AI readiness assessment and a permission risk inventory for the first

1815
01:30:04,120 --> 01:30:05,120
intended scope.

1816
01:30:05,120 --> 01:30:08,960
Don't ask whether the whole enterprise is ready in the abstract, assess the users, data

1817
01:30:08,960 --> 01:30:13,720
sources, workspaces, and services that support the first scenarios.

1818
01:30:13,720 --> 01:30:17,520
The result should separate hard blockers from issues you can manage during the pilot,

1819
01:30:17,520 --> 01:30:20,680
and risks the sponsor is willing to accept for a defined period.

1820
01:30:20,680 --> 01:30:23,680
That gives the organization a starting point based on evidence.

1821
01:30:23,680 --> 01:30:25,760
Then select a small set of pilot workflows.

1822
01:30:25,760 --> 01:30:29,520
Choose work that repeats, has a clear business owner, and has an outcome you can measure without

1823
01:30:29,520 --> 01:30:31,360
inventing a new reporting program.

1824
01:30:31,360 --> 01:30:33,800
Avoid choosing only the most exciting use case.

1825
01:30:33,800 --> 01:30:37,240
Choose one where you can compare the work before and after, and where the team has enough

1826
01:30:37,240 --> 01:30:39,000
incentive to change its habits.

1827
01:30:39,000 --> 01:30:40,880
Set up the governance forum before launch.

1828
01:30:40,880 --> 01:30:43,040
It doesn't need to be a large committee at this stage.

1829
01:30:43,040 --> 01:30:44,400
It needs the right people.

1830
01:30:44,400 --> 01:30:47,800
A fixed cadence, a decision log, and clear escalation routes.

1831
01:30:47,800 --> 01:30:50,920
Agree the success criteria before licenses go live.

1832
01:30:50,920 --> 01:30:54,800
Agree what will cause you to expand, what will require remediation, and what will stop

1833
01:30:54,800 --> 01:30:55,800
the scenario.

1834
01:30:55,800 --> 01:30:59,120
This protects the pilot from becoming an open-ended experiment.

1835
01:30:59,120 --> 01:31:03,880
For days one through 30 complete ownership, scope, readiness, evidence, and the pilot design.

1836
01:31:03,880 --> 01:31:08,880
For days 31 through 60, remediate the priority risks in the pilot scope, prepare the users

1837
01:31:08,880 --> 01:31:12,680
and support teams, and validate the controls that matter to the scenarios.

1838
01:31:12,680 --> 01:31:17,760
For days 61 through 90, run the pilot under normal working conditions, collect

1839
01:31:17,760 --> 01:31:21,920
workflow evidence, and bring the results to the executive decision point.

1840
01:31:21,920 --> 01:31:24,920
Keep the roadmap visible.

1841
01:31:24,920 --> 01:31:29,480
At the end of 90 days, you should not be asking, what should we do next?

1842
01:31:29,480 --> 01:31:33,600
You should be deciding whether the evidence supports expansion, a focused correction,

1843
01:31:33,600 --> 01:31:34,600
or a stop.

1844
01:31:34,600 --> 01:31:38,040
That is the discipline that turns co-pilot into a managed business capability instead

1845
01:31:38,040 --> 01:31:40,040
of a very expensive experiment.

1846
01:31:40,040 --> 01:31:42,040
Three decisions that determine the result.

1847
01:31:42,040 --> 01:31:43,720
Three decisions determine the result.

1848
01:31:43,720 --> 01:31:47,640
First, treat co-pilot deployment as a business decision, not a license purchase.

1849
01:31:47,640 --> 01:31:49,200
The license gives a user access.

1850
01:31:49,200 --> 01:31:53,120
It does not tell you which work should change, who owns the outcome, or whether the investment

1851
01:31:53,120 --> 01:31:54,840
earns its place in the budget.

1852
01:31:54,840 --> 01:31:59,240
Second, accept that your existing permissions and information architecture define the risk

1853
01:31:59,240 --> 01:32:00,240
boundary.

1854
01:32:00,240 --> 01:32:02,440
Co-pilot works within the access people already have.

1855
01:32:02,440 --> 01:32:07,160
If access is too broad, content is stale, or ownership is unclear, AI will expose that

1856
01:32:07,160 --> 01:32:10,320
operational debt faster than a normal search experience.

1857
01:32:10,320 --> 01:32:15,640
Third, sustained value comes from workflow adoption, evidence, and operating discipline.

1858
01:32:15,640 --> 01:32:19,800
People need a reason to use co-pilot in real work, managers need to see a measurable change,

1859
01:32:19,800 --> 01:32:23,720
and the enterprise needs controls that remain in place after the first rollout wave.

1860
01:32:23,720 --> 01:32:28,000
The biggest risk is scaling access and cost before you have proved control and business

1861
01:32:28,000 --> 01:32:28,840
value.

1862
01:32:28,840 --> 01:32:33,240
The biggest opportunity is redesigning high friction knowledge work around secure, measurable

1863
01:32:33,240 --> 01:32:34,880
patterns that people can repeat.

1864
01:32:34,880 --> 01:32:36,960
So the recommended next step is simple.

1865
01:32:36,960 --> 01:32:40,280
Approve a readiness assessment before approving broad deployment.

1866
01:32:40,280 --> 01:32:43,840
If you're facing a similar challenge, or you'd like an independent perspective on your

1867
01:32:43,840 --> 01:32:48,080
Microsoft strategy, architecture, or governance, connect with me on LinkedIn.

1868
01:32:48,080 --> 01:32:52,320
I work independently and collaborate with a trusted network of Microsoft MVPs and domain

1869
01:32:52,320 --> 01:32:55,440
experts to help organizations make better technology decisions.