30+ Reviews
Microsoft 365 Copilot accesses everything your users can see… every SharePoint site, Teams channel, and OneDrive folder. In most tenants, that includes sensitive files shared too broadly years ago. Our AI Security Pack runs your Copilot readiness assessment and closes the governance gaps before Copilot exposes them.
Microsoft 365 Copilot is genuinely impressive. It drafts emails, summarises meetings, pulls insights from files you’d forgotten existed, and gives your team back hours every week. Most SME decision-makers we talk to are either already planning their Copilot rollout or actively being pushed toward one by Microsoft or their licence reseller.
But here’s what often doesn’t come up in those conversations: Copilot doesn’t check whether someone should see a file before it surfaces it. It works with whatever Microsoft 365 already has access to, which means if your permissions aren’t right, your sensitive data isn’t safe. HR documents, board papers, client contracts, salary information. If the wrong people can technically access those files today, Copilot will happily surface them tomorrow. Erroneous access permissions that have sat quietly in the background for years become a live data leakage risk the moment you enable Copilot at scale.
This isn’t a reason to avoid Copilot. It’s a reason to deploy it properly. The Core AI Security Pack puts the data classification, access controls, and governance layer in place before Copilot goes live, so your organisation gets all the productivity gains without the security risks. It’s not a blocker. It’s the foundation.
The Core AI Security Pack is built for SMEs running Microsoft 365 who are planning to deploy Copilot, have already purchased Copilot licences, or are being asked by their board or leadership team to have a clear AI strategy in place.
Copilot doesn’t treat a 15-person business any differently to a 500-person one. It will access what it can access, regardless of your size. Responsible AI adoption starts with making sure the right people have access to the right data, and nothing more.
You don’t need a dedicated IT department or enterprise security teams to need this. This pack is particularly relevant if any of the following applies to your organisation:
The Core AI Security Pack brings together three components that work together to make your Microsoft 365 environment safe for Copilot. Each one addresses a different layer of the problem, and together they give your organisation complete visibility and control over your data before your Copilot deployment goes live.
Microsoft Purview is the data classification and protection layer at the heart of the pack. It identifies sensitive data across your Microsoft 365 environment, applies sensitivity labels to documents and emails, enforces DLP policies that prevent confidential information from being shared inappropriately, and gives your organisation a clear picture of where business critical files live and who has access to them. Before Copilot can generate responses responsibly, it needs a governed data environment to work within. Purview builds that.
Copilot’s power comes from searching everything a user can already see across the tenant, which is exactly why it depends on Purview and AvePoint doing their job first. Claude takes a different approach. Instead of reasoning over a user’s entire M365 footprint, it only works with what’s actually put in front of it in that session… no standing, tenant-wide access to lock down. That makes it a genuine option for clients still working through their governance, or for anyone who’d rather their AI assistant simply didn’t have blanket access to everything in the first place.
Over time, most Microsoft 365 environments accumulate sprawl. Teams sites that were created for a project three years ago and never closed. SharePoint folders with permissions nobody remembers setting. Groups that include people who left the business. AvePoint brings governance to that sprawl, managing the lifecycle of Teams, Groups, and SharePoint workspaces, cleaning up access reviews, and ensuring that the organisational data Copilot can reach is only the data it should reach.
Getting the security controls right is only half the job. The other half is making sure your people actually know how to use Copilot well. The Let’s Copilot training platform is included in Year 1 of the pack and gives your team practical, hands-on guidance covering effective prompting, how Copilot works across Microsoft 365 apps including Teams, Outlook, Word, and Excel, and real use cases relevant to your sector. From Year 2 onwards this component drops away, which is reflected in the pricing below.
Microsoft Purview is the engine behind the data protection layer in the Core AI Security Pack. This guide explains what Purview does in plain language, how sensitivity labels and DLP policies work together to protect confidential information, and why data classification is the single most important step any organisation can take before enabling Copilot across their Microsoft 365 environment.
Copilot governance is about making sure your AI tools only access what they should. This guide covers how Microsoft 365 Copilot interacts with your organisational data, what good permission models look like, how to identify and fix access controls that put business sensitive data at risk, and what complete visibility over your data environment looks like before and after a Copilot rollout.
Business Price
£26.98/user/month
+ free copilot training
Not-For-Profit Price
£29.68/user/month
+ free copilot training
Before you deploy Copilot, your organisation needs a clear position on how AI tools should be used, by whom, and under what conditions. This guide helps SME decision-makers build a practical AI policy that covers responsible AI adoption, shadow AI risks, regulatory requirements, and how to give your team confidence to use Copilot well without creating new security or compliance risks.
DLP policies are one of the most effective ways to prevent sensitive data from leaving your organisation through Copilot or any other channel. This guide explains how Microsoft 365 DLP works for smaller businesses, what compliance violations it can prevent, and how it fits into a broader data protection strategy ahead of your Copilot deployment.
Claude is Anthropic’s AI assistant and one of the most capable tools available for business use today. Unlike consumer AI tools, Claude is built with safety and reliability at its core, making it a practical choice for teams handling sensitive work. This guide covers what Claude can do for your business, how it compares to Microsoft Copilot, and how to deploy it securely alongside your existing Microsoft 365 environment.
There is nothing more annoying than an IT glitch that stops you working efficiently. However, knowing you have access to immediate attention to the glitch and a solution to it, is very reassuring and that is provided by We Do Your IT. We have so appreciated the availability and response given by the team at We Do Your IT, enabling us to remain a productive firm.
Richard Sharp – Sharp Family Law
I cannot praise the team at WDYIT enough. They are incredibly responsive, reliable, and a pleasure to work with. We have been collaborating with them for over 10 years and highly recommend their services!
Mathew Grimsby – Mannings Facility Management
Not necessarily, though it can help. A Copilot readiness assessment gives you a scored picture of where your Microsoft 365 environment stands before deployment, covering your data governance, security controls, and adoption readiness. If you are unsure how prepared your organisation is, it is a good starting point. If you already know you want to move forward, the Core AI Security Pack gets the work done without needing a separate assessment first. We can advise you on which approach makes more sense for your situation.
Prompt injection is one of the more underappreciated security risks in Copilot deployments. It involves malicious instructions hidden inside documents or emails that attempt to manipulate what Copilot generates in response. While no single tool eliminates this risk entirely, the data classification and DLP policies applied through Microsoft Purview significantly reduce the attack surface by controlling what data Copilot can reach and flagging inappropriate content before it causes a problem.
Shadow AI is a primary concern for many of the businesses we work with. When staff use unsanctioned AI tools outside of Microsoft 365, your organisation loses visibility and control over what data is being shared with those systems. Getting Microsoft Copilot deployed properly, with the right access controls and governance in place, gives your team a sanctioned and well-governed AI tool to use, which reduces the incentive to go looking elsewhere.
No. The Core AI Security Pack works alongside your existing security stack rather than replacing it. Traditional security tools protect your perimeter and devices. This pack specifically addresses the data governance and permission layer inside Microsoft 365, which is the gap that Copilot exposes. It complements your existing protection rather than competing with it.
Yes, both are addressed. Microsoft Purview applies sensitivity labels and DLP policies that protect confidential information including intellectual property from being surfaced or shared inappropriately through Copilot. For organisations with regulatory requirements around data protection, including those operating under European Union data rules, Purview provides the classification and compliance controls needed to demonstrate that your organisation is handling sensitive data responsibly. We recommend discussing your specific compliance obligations with us so we can make sure the configuration is right for your sector.
This is one of the most common concerns we hear. Microsoft’s commercial Copilot licences include a commitment that your organisational data is not used to train their large language models. Copilot generates responses from your own data within your own Microsoft 365 tenant. It does not pass your content back to Microsoft for model training. The pack ensures that the data Copilot accesses is properly governed and classified, so you also have a clear record of what it can and cannot reach.
The Core AI Security Pack is built around Microsoft 365 Business Premium, which is the standard licence we recommend for SMEs. You will also need Microsoft Copilot licences for the users you want to enable. If you are on a different licence tier or channel, including monthly enterprise channel or current channel arrangements, we will review that as part of the onboarding conversation and make sure everything is aligned before deployment begins.
Most businesses get to Copilot and realise they should have sorted their data governance six months earlier. We would rather help you get ahead of that.
The Core AI Security Pack gives your organisation the data classification, access controls, and governance foundation that Microsoft 365 Copilot needs to work safely and effectively. No rushed deployments. No data leakage surprises. No compliance violations after the fact.
Talk to us and we will give you a clear picture of where your Microsoft 365 environment stands and exactly what getting it Copilot-ready looks like for your organisation.
