Copilot and agents are about to reach the whole company — and you don't want to spend the months after go-live cleaning up whatever the rollout exposed. We put governance in place before launch, not as a patch afterward. For IT administrators, SharePoint and Teams admins, security teams, and IT managers.
Daniel Rohregger: Dual Microsoft MVP (Copilot & Copilot Studio), Most Active Speaker 2024 and 2025.
The usual mistake isn't a technical one: governance gets built after the first agent is already running in the tenant. Yet the mechanism fits in one sentence. An agent inherits the access rights of the person it works for, so it finds everything that SharePoint oversharing has already made reachable — documents open to far more people than intended. That's why governance comes before the rollout, not after.
For whom
The situation
Rollout first — the usual way
Governance first — the way that holds
You can spot it by what happens next. A Copilot agent goes live and reads files that only a small circle was ever supposed to see — but that, technically, far more people have had access to for years. An agent acts “on behalf of the organization,” but nobody decided up front who's accountable when it gets something wrong — the agent identity was never settled. Sensitivity labels, which mark a document as public, internal, or confidential, have often been in the tenant for years, but aren't enforced or are applied incorrectly, so Copilot can't rely on them. A misconfigured agent reaches half the organization within hours before anyone notices — its blast radius, the worst-case reach, was never limited. And teams across the business build their own agents and hook them up to external systems through MCP servers — connections based on the Model Context Protocol, which let an agent reach tools and data outside Microsoft 365 — with no central oversight.
Then there's a question that has nothing to do with your own tenant: the EU Data Boundary, Microsoft's commitment to process EU customers' data inside the EU, determines where Microsoft may process your data in the first place. It doesn't replace your own governance for access inside the tenant, though. One covers where the data lives; the other covers who gets to see it.
Where you start
For IT teams and admins, the usual starting point is stage 3: Workflows — running processes end to end across systems, rather than just using Copilot day to day. Alongside it runs the Control track — administration, configuration, governance — which applies at every level.
For IT teams that want to run Copilot agents and processes in production across the tenant
The side track for IT and admins — not a stage of its own, but part of every level
What we do
No theory about AI security — a plan you work through right in your own tenant, applied to your actual setup instead of a generic example.
We decide which step comes first by looking at your tenant — the same pattern we use throughout the coaching: Checkpoint, Route, and Doing.
An example
In coaching, prompts and queries are built on your own data. This one is the starting point for a SharePoint oversharing audit — in a session, we tailor it to your tenant, your roles, and your classification scheme.
Find the SharePoint sites where, according to the access list, more than ten people outside the core team have access. Sort them by sensitivity label if one is applied, otherwise by the number of people with access. Flag every site that is labeled confidential but is open to more than ten people — that's your fix list before the agent rollout.
For: IT admins, security teams
Formats
Here, too, what sets the formats apart is the goal, not the price. A single session answers one specific technical question. The ten-session package prepares an entire pilot rollout. The governance workshop gets the whole IT team around one table — working on your own tenant, not a demo tenant.
Coaching, consulting, and workshops on Microsoft 365 Copilot run online by default and, by arrangement, on site in Germany, Austria, and Switzerland.
| Format | Ideal for | Outcome |
|---|---|---|
| Single session | One specific technical question | A clear answer and a next step |
| Ten-session package | Complete governance planning before a pilot rollout | Governance documentation, implemented in your own tenant |
| Governance workshop | The whole IT team learning together on your own tenant | A shared governance baseline and a clear rollout order |
free 20 min
Twenty minutes to figure out which format fits your task — and whether any of them do at all.
You're not sure yet whether a single session, a package, or a workshop is the right call.
€225 net 45 min
One coaching session on your actual task. By the end, something works.
You have a specific task and want it handled this week.
€2,250 net 10 sessions, booked as needed
incl. free onboarding call
A free onboarding call, then at least ten sessions built around a learning plan we design together — no fixed rhythm, booked as needed.
You want to genuinely change how you work, and be able to keep building on it yourself afterward.
on request 1 day, IT team
Tenant size and governance maturity determine the price
A day with your IT team on your own tenant: oversharing, labels, agent boundaries, and the right order for rollout.
Several people in IT need the same basis for their decisions.
All formats side by side, plus the questions people usually ask: Pricing and packages.
From the field
Daniel helped us roll out M365 Copilot and, in individual sessions, showed us what AI with Microsoft can do and where it pays off for us.
The focus was a company-wide rollout: not a single automation, but individual sessions showing what Copilot and Microsoft AI actually deliver for the company.
Frequently asked
Copilot Coaching helps IT teams, admins, and security teams build governance for Copilot and agents on their own tenant, before go-live. It works from a ten-step readiness plan that runs from the tenant inventory to wave planning for the pilot.
A single session answers one specific technical question, the ten-session package prepares a full pilot rollout, and the governance workshop puts the whole IT team around one table. All three run on your own tenant, not a demo tenant.
It starts with an inventory: sensitivity labels, sharing settings, Teams channels, and a SharePoint oversharing audit. Data classification, build rights for agents, agent identities, an assessment of MCP servers, and wave planning for the pilot follow.
Because an agent inherits the access rights of the person it works for, so it finds everything that oversharing has already made reachable. If governance only follows after go-live, all that is left is cleaning up what the rollout exposed.
Tell us where your rollout stands — a pilot in planning, halfway through go-live, or just getting started. We'll get back to you within two business days with our take on which format fits your tenant, and an honest answer if none of them does.