Defined implementation
Correct oversharing before expanding your Copilot rollout.
Oversharing is corrected across the agreed areas and the guardrails are set. A pilot group then runs real work through Copilot. The go, wait or expand decision comes from what that pilot actually showed.
PricePrice fixed after a short scope call.
DeliveryThe proposal names the start date, the change windows and the completion date before anything is agreed.
What you receive · illustrative sample
A readiness decision backed by access evidence.
Illustrative pilot decision register. Licensing and data permissions are checked for the agreed use cases.
| Question | Evidence | Decision |
|---|---|---|
| Can this pilot access the right data? | Permission and sharing review | Resolve findings before expansion |
| Are licenses suitable? | Qualifying base plan and feature needs | Confirm current entitlements |
| Who accepts the result? | Business owner and pilot tests | Record acceptance and exceptions |
Meet the person responsible for delivery.
Alwatheq Zboun leads the agreed work. A sample shows the format; the statement of work defines your deliverable and acceptance checks.
Engagement context
When this engagement applies.
Copilot licenses are bought, or the spend is being weighed up, and access to SharePoint and OneDrive is wider than anyone intended.
Related source documentation
Microsoft: secure and govern data for Microsoft 365 CopilotScope considerations
- Bounded location list, agreed up front
- Purview labelling only where licensed
- Client owns the pilot users
The defined work
Engagement scope.
- 01
If the spend is still a question, the funding case comes first. Which teams would use it, what the seats cost at your real headcount, and what has to be fixed before any of it is worth paying for.
- 02
The sites and locations in the agreed scope are ranked by exposure, and the high-risk ones are reviewed against what sharing was actually intended.
- 03
The agreed oversharing fixes are made: company-wide links retired, orphaned guest access removed, over-broad group permissions narrowed to the people who need them.
- 04
Limits are put in place: tighter access where it is needed, file labelling where your license covers it, and the default sharing setting changed so the problem does not build back up.
- 05
A pilot group runs Copilot against real work, and what it surfaces is checked person by person against what those people were already entitled to see.
- 06
The go, defer or expand decision is made from the pilot evidence, with the remaining exceptions recorded and owned.
Acceptance
Completion has an agreed standard.
Every location in the agreed scope has been reviewed and carries a decision
The agreed oversharing fixes are made and verified against real accounts
The access and guardrail configuration is applied and tested
The pilot group has completed the agreed use cases and what Copilot surfaced has been checked against entitlement
A go, defer or expand decision is recorded with the evidence behind it, and every remaining exception has an owner
Where the spend was still open, the funding case is delivered with the seat cost at your headcount and the named teams it was built against
Commercial basis
Price, scope and timing are considered together.
Engagement price
Price fixed after a short scope call.
The price is agreed in writing before any work starts and before anyone is given access. The call itself costs nothing. What moves the number:
What determines the scope
- Number of SharePoint sites, Teams and OneDrive locations in scope
- Volume of company-wide and guest sharing to unwind
- Whether sensitivity labelling is configured as part of the work
- Size of the pilot population and the number of use cases tested
- Whether the tenant licensing supports the guardrails in the design
- Whether the funding case is needed, or the decision to buy has already been made
Delivery calendar
The proposal names the start date, the change windows and the completion date before anything is agreed.
How engagements workScope & responsibilities
The full engagement boundary.
Review the exclusions, required client participation, change controls and operational handover for this engagement.
Exclusions
- Copilot license procurement
- Site-by-site permission reconstruction outside the agreed location list
- A full Purview classification or DLP programme
- Content migration or information-architecture redesign — that is SharePoint & Teams Cleanup
- Any guarantee about what Copilot returns, which depends on tenant content that keeps changing
Client responsibilities
- Nominate someone who can confirm which sharing was intentional
- Approve the list of locations before any changes are made
- Provide the pilot users and their real use cases
- Own end-user communications and support through the pilot
- Provide the licensing the agreed guardrails require
Change and rollback method
- Sharing is narrowed in batches with a hold period, so an access change that breaks someone’s work is caught and reversed inside the same week rather than discovered a quarter later.
- Every batch is verified from a real account in the affected group, not from the admin console alone.
- The pilot runs on the corrected scope only; Copilot is not enabled beyond it until the pilot evidence supports it.
Operational record and handover
- The exposure ranking across the locations in scope, before and after
- Every permission and sharing change made, with the reason
- Per-person access examples drawn from real groups in the tenant
- The guardrail configuration as applied
- The pilot record and the written go, defer or expand decision
- Where the spend was still open, the funding case: the teams, the use it would get, and the seat cost at your headcount
Before you commit
A clear first step.
You stay in control.
Start with the problem and the result you need. The initial fit conversation is free and does not require access to your systems.
Check client feedback on Upwork ↗Prefer to contract through Upwork? Contact Alwatheq there. Existing Upwork engagements continue through Upwork.
Who will actually do the work?
Alwatheq Zboun leads the scope, technical work and handover. If a specialist collaborator is needed, their role is agreed with you before work starts. Your proposal names the responsibilities and delivery windows.
What happens before you get access?
We agree the scope, fee and completion checks in writing. Access uses named accounts and only the permissions the work requires. Approved access is reviewed and removed at handover.
How do we know the change worked?
Your scope defines the pilot, test cases and acceptance checks. Results and exceptions are recorded. Recovery options and their limits are agreed before production changes; a failed check is addressed before the next approved stage.
Will we need an ongoing retainer?
A defined project can end at handover. Your team receives the agreed configuration records, runbook and walkthrough. Any limited support period is written into the proposal; ongoing support or additional work is a separate agreement.
Discuss this engagement
Put the scope in context.
Describe the problem, systems and deadline. Alwatheq will review the fit and the scope questions before preparing a written proposal.
Plan the Copilot Pilot