Fixed-scope engagement · 2–3 weeks

Copilot and AI Agent Security Readiness

Before you switch on Microsoft 365 Copilot or let an AI agent call your systems, know exactly what it can reach. A two-to-three-week, identity-led readiness review that finds the over-shared data and over-privileged access Copilot will surface, and gives you the controls to deploy with confidence.

Who it’s for

CISOs, IT and identity leaders planning or piloting Microsoft 365 Copilot, Copilot Studio agents or other AI assistants across a Microsoft Entra ID estate, particularly in regulated sectors where a data-exposure incident becomes a reportable event.

The problem

Copilot doesn’t create new access. It uses the access people already have, at machine speed, across everything they can technically open. Years of over-shared SharePoint sites, stale group memberships, guest accounts and standing admin rights become instantly searchable. Most organisations discover this after the pilot, from a user who asked Copilot a question and got an answer they should never have seen.

What you get

1. Identity and access exposure review. Where your Entra ID tenant stands on Conditional Access, MFA coverage, privileged roles, guest and B2B access, and stale identities, and what that means once Copilot is on.

2. Permission and over-sharing analysis. The SharePoint, OneDrive and Teams content that is more widely accessible than its owners believe, prioritised by sensitivity.

3. Agent governance design. How Copilot Studio agents, plugins and connectors are registered, owned, scoped and reviewed, treating every agent as a non-human identity with least-privilege access and an audit trail back to a human principal.

4. Deployment guardrails. The Conditional Access policies, sensitivity labels, DLP alignment and rollout cohorts that let you enable Copilot for a first group safely, and expand from there.

5. Readiness scorecard and remediation plan. A red/amber/green view by control area and a prioritised list of fixes, most of which your existing team can complete before go-live.

How it runs

Week 1: tenant and access review, stakeholder interviews.
Week 2: permission analysis, agent inventory and governance design.
Week 3: scorecard, guardrails, remediation plan and a walkthrough with your team.

Delivered remotely, with read-only access to your tenant. Nothing is changed without your sign-off.

Why United Kloud

Led by Shailesh Kejadiwal, an identity architect who has designed Entra ID and federated identity for UK banks, government departments and the NHS, and who published a framework mapping the OWASP LLM Top 10 to identity controls. This is an identity review first, not a licensing exercise: the output is a set of controls and fixes, not a recommendation to buy more seats.