Copilot Readiness Assessment Tool

Why Microsoft’s baseline isn’t enough

The Microsoft baseline tool runs 182 individual licence and feature checks across six service areas, then outputs a flat recommendations list. The JFDI tool starts from the same tenant data and goes further:

The biggest Copilot risk isn’t licensing, it’s what Copilot can already see

The single biggest deployment-day shock with Microsoft 365 Copilot is over-shared SharePoint content. Copilot does not need a permission of its own; it surfaces whatever the prompting user has access to. Sites set to “Everyone except external users”, libraries shared via “Anyone with the link” anonymous links, individual permission grants outside SharePoint groups, broken inheritance, and forgotten restore-snapshot sites all become Copilot exposure paths the moment a licence is provisioned.

The JFDI tool ingests existing permissions reports and turns them into a Copilot Rollout Risk Score: a single 0-to-100 metric with five colour-banded thresholds (Clean, Low, Moderate, High, Severe). A supplementary Permission Hygiene % sits alongside it and tells you how much of the estate is on clean inheritance.

What it analyses

The score is a weighted composite of five sub-scores:

• Unique Permission Breadth: proportion of resources that break inheritance from their parent site.
• External Exposure: external Full Control grants, elevated external access, and the breadth of sites exposed externally.
• Direct Grant Density: permissions granted to individual users outside SharePoint groups, weighted by severity (Full Control, Edit, or Read).
• Broadcast Sharing: Anyone anonymous links, Everyone except external users (EEEU) grants, and Everyone permissions at site level.
• Stale and Ownerless Surface: inactive risky sites, ownerless sites, and restore/snapshot collections that still appear in tenant search.

What it reads

The tool accepts permissions reports from the providers consultants and tenant admins already use, in either CSV or XLSX. Two complementary source types are supported:

Using both gives the most complete picture. Type A supplies user-level detail; Type B adds broadcast-sharing signals Type A may not capture. Non-Casper365 sources are handled via a simple JSON column-mapping file, with no per-tool parser engineering required.

What it produces

• Copilot Rollout Risk Score with band (Clean, Low, Moderate, High, or Severe), embedded into the deck and the Word report alongside the readiness scorecard.
• Per-site risk summary: every site labelled Critical, High, Medium, Low, Archive, or Clean, with the driving signals shown.
• Highest-risk areas panel: the small set of sites driving most of the score, ready to bring into an executive conversation.
• Remediation appendix: direct-grants register, external-user detail, broken-inheritance hotspots, and restore-site inventory, in tables consultants can hand to the remediation team.
• CSV recommendations row alongside the rest of the findings, so over-sharing items are roadmapped and included in time-to-ready alongside every other remediation.

How the assessment runs

The assessment runs as a guided pipeline. Connect it to a tenant, authenticate, and wait for collection to complete.

1. Configure the tenant and scope

Enter the Entra Tenant ID for the tenant you are assessing (licensed deployments are validated against this Tenant ID), sign in with Microsoft (or use a service principal for unattended collection of the Graph, Defender, and Power Platform domains), and choose which of the six domains to assess: M365, Entra ID, Defender, Purview, Power Platform, and Copilot Studio. Optional imports (for example, a SharePoint permissions report for the over-sharing analysis) attach in the same step.

2. Watch the pipeline run

The pipeline collects data in parallel from Microsoft Graph, Defender, Exchange Online, and the Power Platform API (which also powers the Copilot Studio assessment). Each domain reports its own elapsed time and progress so consultants and tenant administrators can see exactly where collection is up to.

3. Get the recommendations

Each domain completes with a recommendation count, broken down by high, medium, and low priority across the composite assessments. The Generating Reports phase writes the XLSX, CSV, PowerPoint, and Word outputs, and the dashboard opens with the score, verdict, and remediation roadmap ready to walk through.

The business-intelligence layer

Every finding the tool surfaces is enriched with the metadata stakeholders ask for before they sign off a programme.

Consultant-grade deliverables, generated from your tenant data

Charts inside the application

The Charts view inside the application gives consultants four interactive lenses on the same data: findings distribution (status pie), findings by priority (stacked bar per domain), findings by status (stacked bar per domain), and a six-axis domain-readiness radar. Each chart is exported as an embedded PNG in the PowerPoint deck, so the customer’s presentation displays correctly on any system without chart-rendering dependencies.

The three exemplar charts below show the same outputs as they appear in the PowerPoint deck, drawn from a redacted customer assessment.

Export to whichever format your stakeholders need

The Export action surfaces every output format generated by the pipeline: a presentation-ready PowerPoint deck for executives, a multi-worksheet Excel workbook for the remediation team, a flat CSV for project-management imports, and a Word document for internal documentation. Every format is built from the same underlying assessment state, so there is no double-keying.

Where your data goes

The tool runs against a live Microsoft 365 tenant, so it is worth being explicit about where that data goes.

• Runs as a cross-platform desktop application (Windows, macOS, Linux) on the consultant’s or administrator’s own machine.
• Authenticates with Microsoft identity (interactive sign-in, or a service principal for unattended collection of the Graph, Defender, and Power Platform domains).
• Reads tenant configuration and the selected reports from Microsoft Graph, Defender, Exchange Online, and the Power Platform API (which also powers the Copilot Studio assessment).
• Generates every output locally. All analysis runs on your machine.
• No tenant assessment data is sent to JFDI servers. Every report is generated and stored on your own machine. (Licence activation validates your Entra Tenant ID against JFDI’s licensing service; nothing from your assessment is transmitted.)

For the full picture of what the tool reads, the authentication models on offer, and how access is granted and revoked, see the permissions and privacy reference, written for the administrators and security reviewers who sign off the access before an assessment runs.

Pricing

The Copilot Readiness Assessment Tool is licensed per Microsoft 365 tenant. Each licence is activated against a specific Entra Tenant ID and allows unlimited assessment runs, exports, snapshots, and delta reporting for that tenant. Once activated, a licence cannot be reassigned to another tenant. It runs as a cross-platform desktop application (Windows, macOS, Linux). Buy directly from us as a perpetual licence, or subscribe on the Microsoft Marketplace.

Prefer a subscription? Now on Microsoft Marketplace

For teams that need a longer runway to embed the findings — rerunning the assessment as remediation lands, tenancies grow, or risk profiles shift — the tool is also available as a monthly or annual subscription on the Microsoft Marketplace, billed through your existing Microsoft agreement. Live pricing tracks your local currency and is shown at checkout.

Azure customers can also deploy the tool directly from the Azure Portal.

Frequently asked questions