Teams Insider

Microsoft Copilot's Role in Compliance, Governance and Adoption

Prefer audio?

Who should listen: Microsoft 365 service owners, SharePoint and information governance leads, and adoption/change managers planning or recovering a Copilot rollout — particularly in GDPR-regulated organisations.

Guest: Ragnar Heil — Business Development Manager Microsoft, Microsoft MVP, HanseVision (Bechtle)

Ragnar Heil is a Microsoft MVP and Business Development Manager at HanseVision, a Bechtle company, and a former Microsoft Germany and Rencore employee who co-leads its Employee Experience competence centre. He talks to Tom Arbuthnot about why Copilot has forced governance and compliance up the priority list, how to keep tenant content fresh and correctly labelled, and why adoption and change management budgets are consistently underestimated.

Many thanks to Neat, sponsor of this episode.

Key insights

Copilot has not changed permissions, it has just made oversharing obvious — the governance advice (monthly reviews of SharePoint, Teams and other workspaces) is the same as 2007, but where old SharePoint search meant paginating through results, Copilot surfaces the sensitive document in one sentence. ▶ 5:07
A useful readiness test before buying Copilot licences: ask the customer how they handled Delve. If the answer is "we locked it down and never used it", the culture is probably not ready for Copilot's transparency and the project risks crashing. ▶ 6:40
Treat Copilot rollout as toolset, mindset and skillset, not just licence assignment. Locking everything down to be safe destroys the value case — you cannot have a serious ROI conversation if you have restricted the service too heavily, and that balance is especially delicate in regulated sectors like banking, defence and public sector. ▶ 7:42
E5 plus Purview is enough — no extra SKUs needed — but the priority is Purview retention and deletion labels, because Purview can map country and industry regulator rules to retention periods (e.g. delete an unsuccessful job application after six months, keep it six to nine years if the person was hired) rather than leaving users to tag documents themselves. ▶ 13:24
Much of what users report as hallucination is actually outdated content: 30 versions of the same PowerPoint or Word file with no way for the user to tell version 38 from version 61. Content freshness, archiving and deletion matter as much as the permissions matrix, which consultants design carefully and users then destroy by clicking share repeatedly. ▶ 15:26
Don't enable Copilot licences first — start with Purview labels for archive and delete, because tenants get cluttered 12–15 months after a Teams rollout with unused teams, duplicate sites and five "marketing" teams, and users then retreat to email attachments and chat because they don't know where to post or search. ▶ 17:29
Practical governance reporting: scan for files whose names or contents include words like "confidential" but carry no sensitivity label, and monitor the growth in the number of labels — too many labels becomes too complex to use, too few gives no protection. ▶ 21:38
Customers reserve budget for Copilot licences but underestimate adoption and change management, and interest typically drops off after four to twelve weeks when users are disappointed by PowerPoint generation. Deploy to whole teams that work together with a named champion rather than scattering licences across individuals, and use Viva Insights (with Power BI dashboards embedded, in private preview) as the Copilot adoption dashboard tied to the KPIs agreed in change workshops. ▶ 25:19