Phase 1: Scoping

Goal: know what Copilot can reach, which licenses and clouds you hold, and which requirements the controls must satisfy.

📄️What Copilot Can Reach

The data estate Copilot inherits, and why oversharing is the first finding in every tenant.

E3, E5, E7 and the G-SKUs; the Copilot add-on; Copilot Studio credits; Agent 365; and how availability differs by cloud.

Mapping Copilot controls to NIST SP 800-171 and CMMC, ISO 27001, and the NIST AI RMF; what an assessor asks.