Copilot and agents are headed into the whole company — and you don't want to be left cleaning up what the rollout exposed afterward. We build the governance before go-live, not as a fix-up after the fact. For IT administrators, SharePoint and Teams admins, security teams, and IT managers.
The typical mistake isn't technical: governance gets built only after the first agent is already running in the tenant. And yet the mechanism fits in one sentence — an agent inherits the access rights of the person it acts on behalf of, and so reaches exactly what's already reachable through SharePoint oversharing — more people have access to a document than was actually intended. That's why governance belongs before the rollout, not after.
For whom
The situation
Rollout first — the usual way
Governance first — the one that holds up
You can tell by the situations that come up afterward. A Copilot agent goes live and reads files that, in principle, nobody outside a small circle should have access to — but technically has had access to for a long time. An agent acts “on behalf of the organization,” but nobody clarified beforehand who's liable when it does something wrong — the agent identity was never settled. Sensitivity labels, the confidentiality marking of a document as public, internal, or confidential, have often been sitting ready in the environment for a long time, but Copilot doesn't take them into account yet, or gets them wrong. A misconfigured agent reaches half the organization within hours, before anyone notices — its blast radius, the worst-case reach, simply wasn't bounded. And decentralized teams build their own agents connected to external systems via MCP servers — connections using the Model Context Protocol, through which an agent reaches tools and data outside M365 — without any central oversight, because nobody's watching.
On top of that, there's a question that has to be answered independently of your own tenant: the EU Data Boundary, Microsoft's commitment to process EU customers' data within the EU, determines where Microsoft is allowed to process the data at all. But it doesn't replace your own governance for access within the tenant — one governs the location, the other governs who sees what.
Where you start
For IT and admins, the usual entry point is stage 3: Workflows — automating processes end-to-end across system boundaries, instead of just using Copilot day to day. Running alongside it is the Control track — administration, configuration, governance — present at every level.
For IT teams that want to put Copilot agents and processes into productive use across the tenant
The side-track for IT and admins — not a stage of its own, but running across every level
What we do
Instead of theory about AI security: a plan you work through directly in your own tenant — applied to your real structure, not to a generic example.
Which step comes first, we decide on your own tenant — following the same pattern as everywhere else in the coaching: Checkpoint, Route, and Doing.
An example
Prompts and queries take shape in coaching using your own data. This one is the starting point for a SharePoint oversharing audit — in coaching, it gets tailored to your tenant, your roles, and your classification.
Look at the SharePoint sites where, according to the access list, more than ten people outside the actual team circle have access. Sort them first by sensitivity label, if one is set, otherwise by the number of people with access. Flag every site that carries a confidential label despite having access broader than ten people — that's the fix list for before the agent rollout.
Rolle: IT administration, security
Formats
Here too, the difference is in the intent, not the price. The single session clarifies one concrete technical question. The ten-hour package prepares a whole pilot rollout. The governance workshop brings the entire IT team to one table — on your own tenant, not a sample one.
| Format | Ideal for | Outcome |
|---|---|---|
| Single session | One concrete technical question | A clear answer and a next step |
| Ten-hour package | Full governance planning before a pilot rollout | Governance documentation, implemented in your own tenant |
| Governance workshop | The whole IT team learns together on your own tenant | A shared governance baseline and a clear rollout order |
kostenlos 20 Min
Zwanzig Minuten, in denen wir klären, welches Format zu deiner Aufgabe passt — und ob eines davon überhaupt passt.
Du weißt noch nicht, ob Einzelstunde, Paket oder Workshop das Richtige ist.
225 € netto 45 Min
Eine Coaching-Stunde an deiner echten Aufgabe. Danach läuft etwas.
Du hast eine konkrete Aufgabe und willst sie diese Woche vom Tisch haben.
2.250 € netto Zehn-Stunden-Paket
inkl. kostenlosem Onboarding-Call
Kostenloser Onboarding-Call, danach mindestens zehn Termine für einen gemeinsam ausgearbeiteten Lernplan — ohne festen Rhythmus, nach Bedarf abgerufen.
Du willst dich wirklich umstellen und danach selbst weiterbauen können.
auf Anfrage 1 Tag, IT-Team
Tenant-Größe und Governance-Stand bestimmen den Preis
Ein Tag mit deinem IT-Team am eigenen Tenant: Oversharing, Labels, Agent-Grenzen und die Reihenfolge des Rollouts.
Mehrere Leute in der IT müssen dieselbe Entscheidungsgrundlage haben.
All formats compared, with the questions that come up regularly: Pricing and packages.
From the field
Daniel supported us in rolling out M365 Copilot and, in individual sessions, highlighted and demonstrated the possibilities and benefits of AI with Microsoft for us.
The focus was on a company-wide rollout: not a single automation, but individual sessions that show what Copilot and Microsoft AI concretely bring to your own company.
Tell us where your rollout currently stands — a pilot in planning, mid-go-live, or still right at the start. We'll get back to you within two business days — with an assessment of which format fits your tenant, and an honest answer if none of them do.