Buyer guide
How to choose a Copilot readiness partner.
Firms that sell Copilot readiness tend to do one part of the work well. A license reseller, a Purview specialist, a training firm, a life-sciences validation firm and an implementation partner can answer the same request with very different proposals. Below are the five kinds side by side, what each usually leaves to you, and the questions that show the difference in a first call. QueryNow is an implementation partner, so read our own section at the end with that in mind.
Updated November 2026
The problem
Why proposals for the same request look so different.
Many assessments stop at a report
In the published Copilot readiness offers we read in November 2026, most ended with a report and a roadmap, and several listed remediation, training, the AI policy and agents as out of scope. The work that unblocks a rollout then falls back on your own team.
Policy and tenant work sit with different firms
Advisers write the AI policy, and someone else configures the sensitivity labels and data loss prevention (DLP) rules that enforce it. When the two never compare notes, the policy promises controls the tenant does not have.
Agents widened the scope
Microsoft now lists agents in an Agent Registry in the Microsoft 365 admin center and gives Copilot Studio agents their own identity in Entra, its identity service. A readiness plan needs rules for who builds and shares agents, and a register with an owner for each one.
Regulated companies need more than settings
Life sciences, banking and insurance add a data protection impact assessment (DPIA) where GDPR calls for one, a works council agreement at German sites that have a council, and a written line on where AI may touch regulated records. None of the published offers we read covered all of these.
Five kinds of partner
Five kinds of Copilot readiness partner, side by side.
Most firms fit one row best, and some combine two. Use the table to decide which kind your blocker calls for, then ask the questions further down.
| Kind of partner | Good at | Usually leaves to you | Fits when |
|---|---|---|---|
| License resellers and Cloud Solution Providers (CSPs) | Buying the right Copilot and Microsoft 365 licenses, billing, renewals and first-line support | Oversharing cleanup, the AI policy and staff training, unless you buy them as separate projects | You already know which controls you need and want the right license terms |
| Purview and security specialists | Sensitivity labels, DLP, Defender and Conditional Access sign-in rules, often in depth on Microsoft 365 E5 | The AI policy, the AI tool register, staff training and the rules for agents | The security review is the blocker and the policy is already written |
| Training and change firms | Adoption campaigns, champions, prompt training and communication to staff | The tenant controls, so training can start while sites are still overshared | The controls are in place and people still are not using Copilot |
| Validation-first life-sciences firms | GxP risk assessment, computer system validation, quality documents and audit readiness | Most of the Microsoft 365 configuration, and training for staff outside GxP work | AI will touch GxP records or a regulated submission |
| Implementation partners | The whole foundation in one engagement: discovery, tenant controls, AI policy, registers, training and a pilot, handed over to IT | Legal sign-off and license purchasing, which stay with your counsel and your reseller, and formal GxP validation where it applies | Data, policy and legal are all holding the rollout up at once |
Match the blocker
Start from what is actually blocking the rollout.
Write down who said no and why before you compare firms. When the security review stopped the rollout over overshared sites, you need tenant work: labels, DLP, permission fixes, and Restricted Content Discovery for the sites that must stay out of Copilot search. A Purview specialist or an implementation partner fits that.
Legal and compliance usually stop a rollout for a different reason. They need an AI policy they can approve and a list of the AI tools already in use, so a firm that only configures the tenant leaves them with nothing to sign. Look for a partner that writes the policy and the registers with your compliance lead and maps each rule to a setting in the tenant or a documented procedure with a named owner.
Low use after a rollout points to training, but check the controls before you buy it. People trained on a tenant that is still overshared learn to find files they should never see. In regulated work, add a validation firm or a partner with a regulated track for the GxP boundary, the DPIA and the works council.
Questions to ask
Questions that show the difference in a first call.
Ask every candidate the same questions, in writing if you can. A partner who has done this work answers with specifics from a tenant like yours.
Who does the work in our tenant, and who approves each change?
A good answer names the people who make the changes, the approval step on your side, and the test mode DLP rules run in before they enforce.
What do we have at the end?
Look for controls running in your tenant, a runbook your IT team can follow and acceptance tests your IT lead signs. A report and a roadmap leave the work with you.
Which of the proposed controls work on our licenses?
The DLP policy that keeps labeled files out of Copilot needs E5-level rights, and so does automatic labeling, through E5 or the Purview Suite for Business Premium. Ask for this mapping before any control is proposed.
How will you deal with overshared sites?
Expect SharePoint Advanced Management reports and site access reviews, with site owners deciding who should have access, and Restricted Content Discovery for sites that must stay out of Copilot search. A plan built on Restricted SharePoint Search is out of date, because Microsoft is retiring it.
What goes into the AI policy, and who signs it?
Approved tools, which data may go where, AI features inside department software, disclosure to clients and how staff report a mistake. Leadership signs it after your counsel has reviewed it.
How will you train each team, and what record do we keep?
The EU AI Act requires measures that support AI literacy, sized to the role and the risk, and the European Commission suggests internal records. Ask whether the training uses your teams' own documents and tasks.
Who may build agents after you leave, and where is each one recorded?
Microsoft documents no switch that stops people creating Agent Builder agents, so the answer should combine sharing settings, Copilot Studio environment rules, maker training and a register with an owner and a review date for each agent.
For German sites, who prepares the DPIA and the works council pack?
A partner can prepare both with your data protection officer, and your counsel gives the legal sign-off. Ask who writes the German versions of the documents.
Warning signs
Answers that should make you ask again.
Be careful with any claim that a sensitivity label on its own keeps a file out of Copilot. Encryption on a label can stop Copilot using a file when it withholds the rights Copilot needs, and a DLP policy for Copilot can keep labeled content out of answers with E5-level rights, so ask which of the two the partner proposes and how they will test it. Be equally careful with a promise that Business Premium covers automatic labeling, which needs E5 or the Purview Suite for Business Premium.
A plan that trains everyone before the oversharing work is done risks a second round of training once the permissions change, so ask how training will match the access people have at launch. Ask too who will own the agents staff have already built. A policy written without the people who run the tenant is hard to defend in an audit, because nobody can show the setting or the procedure behind each rule.
Where QueryNow fits
Where QueryNow fits among the five.
QueryNow is an implementation partner. Our team runs discovery, configures the Microsoft 365 controls, writes the AI policy and the registers with your compliance lead, trains each team and runs the pilot, then hands the controls to your IT team with a runbook. Licenses come from your reseller, legal sign-off stays with your counsel, and formal GxP validation is done with your quality unit. Microsoft partner since 2015, with teams in Texas and Munich.
Copilot AI Foundation
Our package: discovery, the data foundation, the AI foundation, staff training in four layers and a measured pilot.
OpenCopilot readiness for GxP teams
The life-sciences version of the package, with the GxP boundary and the German steps.
OpenChoosing an AI partner for a preclinical CRO
A buyer's checklist for life-sciences AI work beyond Copilot.
OpenSources
Sources for the Microsoft and EU facts in this guide.
Checked in November 2026. Microsoft changes features and licensing often, so confirm the current position with your reseller.
- Microsoft Learn, Microsoft Purview service description (October 29, 2026)
- Microsoft Learn, Data loss prevention for Microsoft 365 Copilot (October 16, 2026)
- Microsoft Learn, Restrict discovery of SharePoint sites and content (October 11, 2026)
- Microsoft Learn, Restricted SharePoint Search (July 6, 2026)
- Microsoft Learn, Agent settings in the Microsoft 365 admin center (September 3, 2026)
- Microsoft Learn, Secure and governed data foundation for Microsoft Copilot (May 6, 2026)
- European Commission, AI literacy: questions and answers (updated October 20, 2026)
How it works
What a good partner leaves you with.
Controls in use, with tests
Labels, DLP and permission fixes running in your tenant, each with an acceptance test your IT lead signed.
A runbook
So your IT team can repeat each change for new sites, new joiners and new tools.
A signed AI policy
Approved by leadership after review by your counsel.
Registers with owners
For AI tools and for agents, each entry with a review date.
Training records
Who learned what and when, kept as internal records.
A rollout plan with costs
License and running costs, with go or no-go criteria from a measured pilot.
Our method
From one scoped workflow to an agent in daily use.
- Day one
Scope and sign
We define the workflow and the acceptance criteria it has to meet, and agree them in writing before the build starts.
- The build
Build
We build the agent in your environment, with Claude Code and automated evaluation against your own data, and test it against the criteria you signed.
- After launch
Run
We run, monitor and improve the agent after launch, measured against those criteria, with a named person on your side approving what it produces.
Compliance & security
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner
How we engage
Four ways to work with us.
We do not resell Microsoft licenses. Discovery comes first and ends with a confirmed plan, and each later phase has acceptance criteria you sign before it starts.
Advisory
Strategy, roadmap and readiness for an AI program.
Build
One scoped workflow at a time, with acceptance criteria agreed in writing before the build starts.
Run
Managed operations after launch, measured against those criteria.
Outcome-linked terms
Commercial terms can be tied to the acceptance criteria you sign.
Every engagement starts with one scoped workflow and a written definition of done. Commercial terms are set in the statement of work.
Go deeper
Related solutions
- Copilot AI FoundationOur Copilot readiness package
- Copilot deploymentThe wider Copilot rollout once the foundation is in
- AI governanceGovernance for AI beyond Microsoft 365
- Controlling agent sprawlHow to find, own and retire agents
- Copilot Studio implementation guideBuilding and governing Copilot Studio agents
- How we engageAdvisory, build, run and outcome-linked terms
Frequently asked
Questions buyers ask.
What does a Copilot readiness partner do?
It prepares a Microsoft 365 tenant, and the company around it, for company-wide Copilot use. Depending on the firm, that means licenses, security controls, training, validation or the whole foundation at once, which is why proposals for the same request differ so much.
Do we need a partner at all?
Not always. A company with a strong IT team, labels and DLP already in use and a written AI policy can follow Microsoft's own deployment blueprint and adoption material. A partner earns its place when data, policy and legal are all holding the rollout up, or when your IT team has no time to clean up years of sharing.
Should one firm do both the AI policy and the tenant controls?
It helps. When one team writes the policy and configures the controls, each rule points to the setting or the procedure that enforces it, and an auditor can follow the line. If you split the work, ask both firms to sign the same controls map.
Is a Copilot readiness assessment enough?
It is enough when your own team has time to do the work it recommends. Most assessments end with a report and a roadmap. If the rollout is already blocked, ask for the fixes, the policy and the training in the same scope, with a runbook at the end.
Can a partner tell us which Microsoft licenses we need?
Yes, and a good one does it before proposing controls. Business Premium covers manual sensitivity labels, DLP for email and files and standard audit. Automatic labeling and the DLP policy that keeps labeled content out of Copilot need E5 or the Purview Suite for Business Premium. Label encryption, which Business Premium includes, can also stop Copilot using a file, and a partner should test that in the apps you use. Your reseller then sets the price.
What should a life-sciences company add?
A written GxP boundary that keeps AI from ever being the source of GxP data, a DPIA where the processing is likely to be high risk, works council involvement at German sites that have a council, and validation where AI touches a GxP record. A validation-first firm or a partner with a regulated track covers these.
How do we compare proposals fairly?
Compare what each proposal leaves running in your tenant. List the controls, documents, registers and training records each one hands over, who signs each of them, and what your own team still has to do afterwards.
Research paper
Past the stall: Why M365 Copilot rollouts plateau and the governed path through
Why Copilot pilots stall, and the governed path from pilot to measured adoption.
Read the paperReady to ship AI that actually works?
Every engagement starts with one scoped workflow and a written definition of done. Commercial terms are set in the statement of work.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner