A Nordic municipality moved to Microsoft 365 Copilot on evidence rather than optimism. The work took under four weeks from scan to decision support.
01
Inventory
An automated scan of the central M365 tenant — SharePoint, Teams, OneDrive and email — identifying unstructured and forgotten information, mapped against the information security policy already in force.
02
Classification
Automated classification integrated into Microsoft Purview: sensitive data tagged from the policy and its templates, and DLP rules configured to decide what Copilot could reach.
03
Decision support
Reporting answered the question each part of the organisation was actually asking — management, which areas were mature enough to roll out to; operations, which specific risks they had to manage first.
04
Policy violations, named
Sensitive data being handled against the policy already in force, identified with how and where — the findings a rollout has to clear before it starts.
What comes out of it
Millions of objects analysed, and a fact-based basis for rolling Copilot out to the parts of the business that were ready for it. Under four weeks from initiated scan to data in the report module.