The Microsoft 365 Copilot Readiness Checklist You Actually Need

# Graph PowerShell — list users and their assigned licence SKUs
Connect-MgGraph -Scopes "User.Read.All","Directory.Read.All"
Get-MgUser -All -Property DisplayName,AssignedLicenses |
  Select-Object DisplayName, @{N='Licences';E={($_.AssignedLicenses.SkuId -join ', ')}}

GET https://graph.microsoft.com/v1.0/users?$select=displayName,assignedLicenses

# Check for Copilot licence assignment
$copilotSkuId = "639dec6b-bb19-468b-871c-c5c441c4b0cb"
Get-MgUser -All -Property DisplayName,AssignedLicenses |
  Where-Object { $_.AssignedLicenses.SkuId -contains $copilotSkuId } |
  Select-Object DisplayName

# Check via Intune device configuration or registry
# Registry path on device:
#   HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
# Value: CDNBaseUrl
#   "492350f6-3a01-4f97-b9c0-c7c6ddf67d60" = Current Channel
#   "55336b82-a18d-4dd6-b5f6-9e5095c314a6" = Monthly Enterprise Channel

# Via Intune Graph API — get device configurations
GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$select=deviceName,operatingSystem

# Test connectivity to key Copilot endpoints
$endpoints = @(
    "copilot.microsoft.com",
    "substrate.office.com",
    "graph.microsoft.com",
    "login.microsoftonline.com"
)
foreach ($ep in $endpoints) {
    Test-NetConnection -ComputerName $ep -Port 443 |
      Select-Object ComputerName, TcpTestSucceeded
}

M365 Admin Centre > Settings > Copilot > Manage how Copilot can reference web content

Connect-MgGraph -Scopes "Policy.Read.All"
# List all Conditional Access policies and their state
Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{N='GrantControls';E={$_.GrantControls.BuiltInControls -join ', '}},
    @{N='IncludeUsers';E={$_.Conditions.Users.IncludeUsers -join ', '}}

GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies

# Requires Microsoft.Graph.Beta module
Connect-MgGraph -Scopes "AuditLog.Read.All","UserAuthenticationMethod.Read.All"
Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object { $_.IsMfaRegistered -eq $false } |
  Select-Object UserPrincipalName, IsMfaRegistered, MethodsRegistered

Get-MgIdentityConditionalAccessPolicy -All |
  Where-Object { $_.GrantControls.BuiltInControls -contains 'compliantDevice' } |
  Select-Object DisplayName, State

Get-MgIdentityConditionalAccessNamedLocation -All |
  Select-Object DisplayName, @{N='Type';E={$_.AdditionalProperties.'@odata.type'}}

# List all guest users
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "userType eq 'Guest'" -All |
  Select-Object DisplayName, UserPrincipalName, CreatedDateTime, AccountEnabled

# Check external collaboration settings
GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy
# Review: allowInvitesFrom, guestUserRoleId, allowedToSignUpEmailBasedSubscriptions

# List Global Admin role members
$globalAdminRoleId = (Get-MgDirectoryRole -Filter "displayName eq 'Global Administrator'").Id
Get-MgDirectoryRoleMember -DirectoryRoleId $globalAdminRoleId |
  Select-Object @{N='UPN';E={$_.AdditionalProperties.userPrincipalName}}

# List all OAuth2 permission grants (admin consent)
Connect-MgGraph -Scopes "Directory.Read.All"
Get-MgOAuth2PermissionGrant -All |
  Select-Object ClientId, ConsentType, Scope, ResourceId

# List app registrations with broad permissions
Get-MgApplication -All |
  Select-Object DisplayName, @{N='Permissions';E={
    $_.RequiredResourceAccess.ResourceAccess.Id -join ', '
  }}

# Check Security Defaults status
(Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy).IsEnabled

# Verify break-glass accounts exist and check their exclusion in CA policies
# Manual review: ensure break-glass UPNs appear in Conditions.Users.ExcludeUsers
# for all CA policies retrieved in 2.1

Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Get-SPOTenant | Select-Object SharingCapability, OneDriveSharingCapability,
  DefaultSharingLinkType, DefaultLinkPermission,
  PreventExternalUsersFromResharing
# SharingCapability values:
#   Disabled = no external sharing
#   ExistingExternalUserSharingOnly = existing guests only
#   ExternalUserSharingOnly = new and existing guests
#   ExternalUserAndGuestSharing = anyone (anonymous links)

# SharePoint Advanced Management — Site permissions report
# Run from SharePoint Admin Centre > Reports > Data access governance
# Or via PowerShell:
Get-SPOSite -Limit All | ForEach-Object {
    Get-SPOSiteFileVersionExpirationReportJobProgress -ReportUrl $_.Url
}
# Note: The full "sharing links" audit typically requires SharePoint Advanced Management
# or the SharePoint admin centre Data Access Governance reports

Get-SPOSite -Limit All |
  Where-Object { $_.SharingCapability -ne (Get-SPOTenant).SharingCapability } |
  Select-Object Url, SharingCapability, Owner

# SharePoint Advanced Management — "Site permissions for the organization" report
# Scans all sites and lists:
#   - Total permissioned users
#   - Content shared with "Everyone"
#   - Content shared with EEEU
#   - Guest user access count
# Available via SharePoint Admin Centre or:
# Start-SPODataAccessGovernanceReport (SAM required)

Get-SPOTenant | Select-Object DefaultSharingLinkType, DefaultLinkPermission,
  OneDriveDefaultShareLinkScope, OneDriveDefaultShareLinkRole
# DefaultSharingLinkType: None, Direct (specific people), Internal (org), AnonymousAccess

Get-SPOSite -Limit All |
  Select-Object Url, SensitivityLabel, Template |
  Where-Object { [string]::IsNullOrEmpty($_.SensitivityLabel) }
# Returns sites WITHOUT a sensitivity label — these are your gaps

Get-SPOSite -Limit All |
  Where-Object { $_.LastContentModifiedDate -lt (Get-Date).AddMonths(-12) } |
  Select-Object Url, LastContentModifiedDate, Owner, StorageUsageCurrent

# RCD is configured via SharePoint Advanced Management
# Check restricted search mode:
Get-SPOTenant | Select-Object IsRestrictedSearchEnabled
# Check site-level RCD:
Get-SPOSite -Identity <siteUrl> | Select-Object RestrictContentOrgWideSearch

# RAC is configured per-site via SAM
Get-SPOSite -Identity <siteUrl> | Select-Object RestrictedAccessControl
# Or set via:
# Set-SPOSite -Identity <siteUrl> -RestrictedAccessControl $true

# Security & Compliance PowerShell
Connect-IPPSSession
Get-Label | Select-Object DisplayName, Priority, Disabled, ParentId,
  @{N='Encryption';E={$_.EncryptionEnabled}}

# Microsoft Purview > Information Protection > Content Explorer
# Or via:
# M365 Admin Centre > Reports > Microsoft Purview > Label activity
# Data Access Governance reports in SharePoint Admin Centre also show labelling rates

# Check library-level default label via PnP PowerShell
Connect-PnPOnline -Url <siteUrl> -Interactive
Get-PnPList | Select-Object Title, DefaultSensitivityLabelForLibrary

Get-Label | Where-Object { $_.EncryptionEnabled -eq $true } |
  Select-Object DisplayName,
    @{N='RightsDefinitions';E={$_.EncryptionRightsDefinitions}}
# Review for "EXTRACT" right in the rights definitions

Get-Label | Where-Object { $_.EncryptionEnabled -eq $true } |
  Select-Object DisplayName, EncryptionProtectionType
# EncryptionProtectionType: Template = admin-defined, UserDefined = UDP

Get-AutoSensitivityLabelPolicy | Select-Object Name, Mode, Enabled,
  @{N='Rules';E={$_.AutoSensitivityLabelPolicyRuleLinks.Count}}
# Mode: Enable (enforcing) or TestWithNotifications (simulation)

# List M365 Groups with their sensitivity labels
Connect-MgGraph -Scopes "Group.Read.All"
Get-MgGroup -Filter "groupTypes/any(g:g eq 'Unified')" -All |
  Select-Object DisplayName, @{N='SensitivityLabel';E={$_.AssignedLabels.LabelId}}

Connect-IPPSSession
Get-DlpCompliancePolicy |
  Where-Object { $_.Workload -match 'Copilot' -or $_.CopilotLocation -ne $null } |
  Select-Object Name, Mode, Enabled

Get-DlpComplianceRule |
  Where-Object { $_.ParentPolicyName -match 'Copilot' } |
  Select-Object Name, ContentContainsSensitiveInformation,
    @{N='LabelConditions';E={$_.ContentContainsSensitivityLabel}}

Get-DlpCompliancePolicy |
  Select-Object Name, Mode, Enabled, Workload,
    @{N='RuleCount';E={(Get-DlpComplianceRule -Policy $_.Name).Count}}

# Microsoft Purview portal > AI Hub > Data Security Posture Management
# Review: Oversharing alerts, sensitive content in Copilot interactions, user risk scores

Connect-ExchangeOnline
# Admin-configured forwarding
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Select-Object DisplayName, ForwardingSmtpAddress, ForwardingAddress

# User Inbox rules with forwarding
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    Get-InboxRule -Mailbox $_.UserPrincipalName |
      Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
      Select-Object MailboxOwnerId, Name, ForwardTo, RedirectTo, Enabled
}

Get-HostedOutboundSpamFilterPolicy |
  Select-Object Name, AutoForwardingMode
# AutoForwardingMode: Automatic, On, Off

# Full Access permissions
Get-Mailbox -ResultSize Unlimited | Get-MailboxPermission |
  Where-Object { $_.User -ne 'NT AUTHORITY\SELF' -and $_.IsInherited -eq $false } |
  Select-Object Identity, User, AccessRights

# Send As permissions
Get-Mailbox -ResultSize Unlimited | Get-RecipientPermission |
  Where-Object { $_.Trustee -ne 'NT AUTHORITY\SELF' } |
  Select-Object Identity, Trustee, AccessRights

Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited |
  ForEach-Object {
    $mbx = $_
    Get-MailboxPermission -Identity $mbx.Identity |
      Where-Object { $_.User -ne 'NT AUTHORITY\SELF' -and $_.IsInherited -eq $false } |
      Select-Object @{N='SharedMailbox';E={$mbx.DisplayName}}, User, AccessRights
  }

# Org-level check
Get-OrganizationConfig | Select-Object AuditDisabled
# Should be False

# Find any individual overrides
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.AuditEnabled -eq $false } |
  Select-Object DisplayName, UserPrincipalName, AuditEnabled

Get-TransportRule | Where-Object {
    $_.BlindCopyTo -or $_.CopyTo -or $_.RedirectMessageTo
} | Select-Object Name, State, BlindCopyTo, CopyTo, RedirectMessageTo

# Check M365 Group creation restriction
Connect-MgGraph -Scopes "Directory.Read.All"
$settings = Get-MgDirectorySetting |
  Where-Object { $_.DisplayName -eq 'Group.Unified' }
$settings.Values | Where-Object { $_.Name -eq 'EnableGroupCreation' } |
  Select-Object Name, Value
# Value = false means creation is restricted
# Also check GroupCreationAllowedGroupId for the allowed security group

# Teams admin settings
Connect-MicrosoftTeams
Get-CsTeamsGuestMeetingConfiguration
Get-CsTeamsGuestCallingConfiguration
Get-CsTeamsGuestMessagingConfiguration
# Also check org-wide Teams settings:
Get-CsTeamsClientConfiguration | Select-Object AllowGuestUser

Get-CsTenantFederationConfiguration |
  Select-Object AllowFederatedUsers, AllowedDomains, BlockedDomains,
    AllowTeamsConsumer, AllowTeamsConsumerInbound

# List all teams and their channels with type
Connect-MicrosoftTeams
Get-Team -All | ForEach-Object {
    $team = $_
    Get-TeamChannel -GroupId $team.GroupId |
      Select-Object @{N='Team';E={$team.DisplayName}}, DisplayName, MembershipType
}
# MembershipType: Standard, Private, Shared

Get-CsTeamsAppPermissionPolicy |
  Select-Object Identity, DefaultCatalogAppsType, GlobalCatalogAppsType,
    PrivateCatalogAppsType

Get-CsTeamsMeetingPolicy |
  Select-Object Identity, AllowTranscription, AllowCartCaptionsAndTranscriptions,
    CopilotWithoutTranscript
# Note: Specific Copilot meeting policy settings may vary by release channel

Connect-ExchangeOnline
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled
# Must be True

# Search for Copilot interaction events
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
  -RecordType CopilotInteraction -ResultSize 10 |
  Select-Object CreationDate, UserIds, Operations

Get-UnifiedAuditLogRetentionPolicy |
  Select-Object Name, Priority, RetentionDuration, RecordTypes

# Microsoft Purview portal > eDiscovery > Content Search
# Search for Copilot interaction data using the "Copilot interactions" item type
# Requires E5 + Copilot for full Copilot audit data in eDiscovery

# Microsoft Purview portal > Communication Compliance > Policies
# Check for policies targeting the "Microsoft 365 Copilot" location

# Requires SharePoint Advanced Management
# SharePoint Admin Centre > Reports > Data access governance > Sharing links
# Filter for "Everyone except external users" permissions
# Alternatively use the site permissions report (see 3.4)

Get-Team -All | Where-Object { $_.Visibility -eq 'Public' } |
  Select-Object DisplayName, GroupId, MemberCount, Visibility
# Review public Teams — especially any with "org-wide" in the name or description

Get-MgGroup -Filter "groupTypes/any(g:g eq 'Unified') and visibility eq 'Public'" -All |
  Select-Object DisplayName, Id, Visibility, CreatedDateTime

Get-SPOHubSite | Select-Object Title, SiteUrl, Permissions

# This requires per-user OneDrive enumeration
# Large-scale audit typically needs SharePoint Advanced Management reports
# Or third-party tools (Syskit, ShareGate, etc.)

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgPolicyCrossTenantAccessPolicyPartner -All |
  Select-Object TenantId,
    @{N='B2BCollab';E={$_.B2bCollaborationInbound.Applications.AccessType}},
    @{N='B2BDirectConnect';E={$_.B2bDirectConnectInbound.Applications.AccessType}}

M365 Admin Centre > Reports > Usage > Microsoft 365 Copilot > Readiness tab

SharePoint Admin Centre > Settings > SharePoint Advanced Management
# Or check licence assignment for the SAM add-on SKU

# Use M365 Admin Centre Copilot readiness report "Suggested candidates" column

M365 Admin Centre > Reports > Usage > Microsoft 365 Copilot > Usage tab
# Also: Viva Insights Copilot Dashboard (requires Viva Insights licence)