Microsoft 365 Copilot or Gemini Enterprise rollout with real adoption
Cohash runs Microsoft 365 Copilot and Gemini Enterprise rollouts that get used. We fix oversharing in SharePoint, Drive and connected systems first, because the assistant answers from whatever each user can open. Then we pick real tasks per department, train people on those tasks, and measure repeat use and time saved, not logins. Licences move to people who use them, and custom agents get an owner and a review.
- 01Fix oversharing first
- 02Task portfolio per department
- 03Pilot with a baseline
- 04Training on real work
- 05Connectors and agents
- 06Measure and reassign
The story
Told without the client's name or anything that could identify them.
A professional services firm had bought Microsoft 365 Copilot licences, and the usage report showed far fewer active users than enabled ones. Then a pilot user found a salary file through the assistant, training had been one generic prompt webinar, and finance was asking about renewal. We started with oversharing, using SharePoint Advanced Management and Purview sensitivity labels to restrict sites shared with everyone or broad groups. Then we sat with each department to list real tasks with sample prompts and owners, recorded a baseline in a few pilot departments, and trained people on their own documents. Connectors to Salesforce and ServiceNow kept source permissions, user-built agents went through a light review, and idle licences moved to people on the waiting list.
why it was urgentMicrosoft says Copilot grounds answers in data users already have permission to access, and its secure-and-governed blueprint starts with fixing oversharing. Google introduced Gemini Enterprise on 9 October 2025. Under the EU AI Act, Article 4's AI literacy duty has applied since 2 February 2025, with supervision and enforcement from 2 August 2026.
- openThe Copilot usage report shows far fewer active users than enabled users.
- recurringA pilot user found a salary file or board deck through the assistant.
- blockedTraining so far has been a generic prompt webinar.
- openTeams are already building their own agents in Copilot Studio or Gemini Enterprise. Nobody's reviewing them.
- recurringFinance is asking whether the licences should be renewed.
The estate, before and after
Before: Copilot on top of years of oversharing
Copilot answered from everything each user could open, including sites shared with everyone. Usage was measured by logins, and teams built agents with no review.
Read the diagram as text
- SharePoint and OneDrive → Microsoft 365 Copilot: grounding
- Teams and mail → Microsoft 365 Copilot: grounding
- Microsoft 365 Copilot → Licensed users: answers
- User-built agents → Licensed users: shared agents
- Licensed users → Login counts: logins
After: governed content, named tasks and measured use
Oversharing is restricted before content reaches the assistant, and connectors bring CRM and ticketing data in with source permissions. Reviewed agents and department tasks drive use, measured by active days and a time-saved survey.
Read the diagram as text
- SharePoint Advanced Management → Microsoft 365 Copilot: permitted content
- Salesforce → Microsoft 365 Copilot: per-item ACLs
- ServiceNow → Microsoft 365 Copilot: per-item ACLs
- Agent review → Microsoft 365 Copilot: approved agents
- Microsoft 365 Copilot → Department tasks: task answers
- Department tasks → Adoption dashboard: usage · survey
- Adoption dashboard → Licence reassignment: idle licences
How we run it, phase by phase.
6 phases take you from Licences bought, low weekly use to Copilot or Gemini Enterprise in daily work. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Fix oversharing first
Find sites, drives and libraries shared with everyone or with broad groups. Use SharePoint Advanced Management, which comes with the Copilot licence, and Purview sensitivity labels to restrict what's overexposed, or the matching Google Workspace sharing and label controls.
- phase 02
Task portfolio per department
Sit with each department and list the tasks the assistant can help with: drafting, summarizing meetings, searching policy, preparing reviews. Each task gets a sample prompt, an owner and a way to tell if it worked.
- phase 03
Pilot with a baseline
We pilot with two or three departments. Time and quality on the chosen tasks get recorded before anyone has the licence, so the after numbers have something to compare against.
- phase 04
Training on real work
Short sessions built on each department's own documents and tasks, plus clear rules on what data can go into prompts and which tools are approved.
- phase 05
Connectors and agents
Connect systems such as Salesforce or ServiceNow through Copilot connectors that keep source permissions. Agents built by users go through a light review for owner, data scope and actions before sharing.
- phase 06
Measure and reassign
Use the Copilot usage report's enabled users, active users and active days, plus a short survey on time saved. Licences idle for a set period move to people on the waiting list.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
The assistant only finds what people should see
We restricted sites and libraries shared with everyone or with broad groups, using SharePoint Advanced Management and sensitivity labels, before the wider rollout.
- result 02
Each department has named tasks
A task portfolio lists what the assistant helps with per department, each task with a sample prompt, an owner and a way to tell if it worked.
- result 03
Adoption is measured by repeat use
We stopped counting logins. Now the measure is a dashboard built from the Copilot usage report's active users and active days, plus a time-saved survey.
- result 04
Licences go to people who use them
Licences idle for a set period move to people on the waiting list, which gives finance a clear basis for the renewal decision.
- result 05
Agents and connectors have owners
We set up Copilot connectors that keep source permissions. Agents built by users are reviewed for owner, data scope and actions before anyone can share them.
Risks we plan for
-
Oversharing becomes discoverable
A bad permission on an old site used to be hard to stumble on. Once an assistant can search everything a user can open, it isn't.
-
Measuring the wrong thing
Logins and prompt counts mostly measure curiosity. Repeat use on named tasks, plus a time-saved survey, tells you whether the licence is paying for itself.
-
Unreviewed agents
Agents made by users can call actions and connectors with broad rights. Without an owner and a review, nobody knows what they do or who to call when one misbehaves.
-
Shadow AI stays
If the approved tool is slow to reach people or blocked for their task, they keep using personal accounts. Fast access to the approved tool works better than a ban alone.
Where AI helps, and where it needs guardrails
Copilot connectors index external systems with an access list per item, and federated connectors fetch live data through MCP with OAuth 2.0, so the assistant can reach CRM and ticketing data under each user's own permissions. Gemini Enterprise offers agents on Google's side. The governance work is ours: each connector and agent gets an owner, a data scope and DLP coverage, and write actions need approval.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- report01
Oversharing findings with remediation steps per site or drive
yours to keep - document02
Task portfolio per department with sample prompts and owners
yours to keep - document03
Data-use rules and approved-tool list for staff
yours to keep - report04
Adoption dashboard built from the usage report and survey
yours to keep - code05
Agent and connector review checklist with an approval flow
yours to keep
Platforms and services on this move
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Copilot or Gemini Enterprise?
Usually the one that matches your productivity suite. Copilot fits a Microsoft 365 tenant and Gemini Enterprise fits Google Workspace, and some companies use both. The rollout work doesn't change. It's oversharing, task design and measurement either way.
02Why is usage low when everyone has a licence?
Most often people weren't shown which of their own tasks it helps with, or they aren't sure what data they're allowed to use. Training on each department's real work fixes more than generic prompt tips.
03Do we have to fix all permissions before rollout?
No. Fix the high-risk sites and drives first, apply interim restrictions where needed, and keep cleaning up as you go. Waiting for perfect permissions delays everything.
04How do we know if it's worth the money?
Compare repeat use on named tasks and survey time savings against the licence cost per department. Where the numbers don't hold, reassign licences rather than renewing them all.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyAI pilot to production with forward deployed engineers
Taking an AI pilot into production with forward deployed engineers who work with the business team, build evals, connect real systems and hand over cleanly.
read the case studya8d2a7b2 - 01Microsoft Learn: Secure and governed data foundation for Microsoft Copilot (deployment blueprint)learn.microsoft.com ↗
- 02Microsoft Learn: Microsoft Copilot usage reportlearn.microsoft.com ↗
- 03Microsoft Learn: Copilot connectors overviewlearn.microsoft.com ↗
- 04Google blog: Gemini Enterprise introduced (9 Oct 2025)blog.google ↗
- 05European Commission: AI literacy questions and answersdigital-strategy.ec.europa.eu ↗
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it