Copilot Readiness for CPA Firms: Audit Before You License

Picture a managing partner asking Copilot to pull together everything the firm has on a client's engagement. It works. It also returns a spreadsheet of staff bonuses that has sat in a shared folder since 2019. Nobody broke in. Copilot did its job, and the firm's permissions did the rest.

For firms running Microsoft 365, the order of operations matters more than the licensing math. Here is what to finish before the first seat goes out.

What Does Copilot Actually Have Access To?

Copilot can surface anything the signed-in user can already reach. This sounds harmless until you remember how permissions accumulate. Every file someone was mistakenly granted, every SharePoint site shared with the whole organization years ago, every folder inherited from a departed employee becomes reachable through a chat prompt rather than through a deliberate search. Assigning licenses before a tenant readiness review risks oversharing, because Copilot reveals exposure. That makes a rollout a governance project first and a licensing project second. The pre-rollout work includes a permissions audit across sites and shared drives, sensitivity labels applied through Microsoft Purview, and an access review to remove what nobody should still be able to access. A firm that skips it will discover its permissions debt from a partner’s chat window.

Microsoft documents this design: Copilot reaches emails, chats, and documents through Microsoft Graph, limited to what the user has permission to open. Microsoft's training material sets the bar at View permission across SharePoint, OneDrive, and Teams. That is the security model working as intended. The weak point is the permission layer underneath it, which most firms never audit. Microsoft's own SharePoint guidance for Copilot acknowledges that users may see Copilot as exposing overshared content. A misfiled document used to stay hidden because nobody knew where to look. Now, a plain-English question does the looking.

The September 2026 column in CPA Practice Advisor calls Copilot the safest AI product for documents that contain client data. That safety describes where the data travels. It does not change which staff inside the firm can reach client tax records and engagement files.

Why is Assigning a Copilot License a Governance Decision?

A license switches on that access path for a specific person. Treating it as a purchasing task hides the real decision: who gets a search engine over everything they can touch.

The admin center's readiness report covers license eligibility and update channels. Microsoft's tenant readiness training lists a SharePoint governance and data-readiness review as its own checklist item, one that checks for oversharing and stale permissions before Copilot can surface content through them. A green licensing report and a clean permission model are different things.

Policy is the second gap. An AI policy written last year usually answers one narrow question: whether staff can paste client data into a public chatbot. Copilot raises a different set. Who owns each SharePoint site? Which guests still have access? How long do chats and files live? Does the engagement letter cover AI-assisted work? Who decides what agents can reach? PK Tech walks firms through important questions to consider, and a policy written last year rarely answers them. The tool changed what staff can do without asking anyone, so the policy has to change with it.

What Should a Firm Audit Before the First Copilot License Goes Out?

Start with permissions. The data access governance reports in SharePoint Advanced Management give you a baseline of existing oversharing, and activity reports catch new oversharing as it happens. Look for sites shared with everyone in the organization, sites with no owner, files that no longer inherit from their parent, and folders left behind by people who have gone.

Next, run an access review. A site access review allows an administrator to hand off a flagged site to its owner, who either removes overly broad access or justifies it. Owners know whether the tax-planning site really needs 60 members. For sites you cannot fix before launch, Restricted Content Discovery hides them from organization-wide search and Copilot's broad discovery without changing a single permission, which buys time. Restricted Access Control goes further by limiting access to named groups. Skip Restricted SharePoint Search. Microsoft's training notes it is retiring, and new enablement has been blocked since July 31, 2026.

Then pilot. Assign seats to a small group, monitor what Copilot returns, and widen the rollout only after the access picture stabilizes.

PK Tech packages this as a tenant readiness engagement. We baseline the tenant, fix permissions, and configure Microsoft 365 Business Premium with Defender and Purview so that the controls are in place before the licenses are. Business Premium already includes Defender for Business, and Microsoft's Purview Suite add-on for Business Premium adds default labels for SharePoint libraries, automatic labeling, and DLP for Microsoft 365 Copilot.

Do Sensitivity Labels Stop Copilot From Surfacing a File?

Not by themselves. A label that only marks a document “Confidential” tells people how to handle it. It does not block retrieval. Protection arrives when the label applies encryption. Copilot returns encrypted content only to users who hold both the VIEW and EXTRACT usage rights. If you do not want Copilot to summarize certain files at rest, Microsoft's Purview guidance for Copilot recommends labels that apply encryption without EXTRACT. You can also use DLP for Microsoft 365 Copilot to keep Copilot away from content carrying specific labels.

Sequence matters here. Labeling a file estate you have not reviewed means guessing which files are sensitive. Audit first, label what the audit finds, then review access again.

Copilot will earn its place at your firm. What you control is whether the first thing it shows a partner is a useful answer or a forgotten permission. If a Copilot rollout is on your calendar, PK Tech can review your firm's Microsoft 365 security defaults and permissions before you begin.

As a managed IT service provider, PK Tech brings more than 16 years of experience working with small to medium-sized businesses. PK Tech holds AICPA SOC 2 Type II attestation, verified through an independent third-party audit of its security and privacy controls.

Schedule a tenant readiness assessment with PK Tech.

Key Takeaways:

• Copilot surfaces anything the signed-in user can already reach, so it reveals permission debt rather than creating exposure.
  
• The pre-rollout work includes a permissions audit, sensitivity labels via Microsoft Purview, and an access review to remove stale access.
• A Copilot rollout is a governance project first and a licensing project second.