Where should a mid-market organisation start with AI in Microsoft 365?

The question behind the question

Most boards are now asking what the organisation’s AI plan is. The usual answer is to buy some Copilot licences and run a pilot with a keen team. Then the pilot stalls.

The reason is mechanical. Microsoft is plain about how Copilot works: it only surfaces organisational data to which individual users have at least view permissions. In a tenant nobody has read in years, that includes the HR folder somebody shared with everyone years ago. Copilot is only as good as the SharePoint underneath it.

So the honest answer to “where do we start with AI?” is that you start by not starting with it. We work through four steps, in order, and each one is useful on its own if you stop there.

Read the tenant first

Before anyone switches on an assistant, find out what it would be able to see. That means permissions, external sharing, site sprawl, storage and licensing, read rather than guessed at.

The pattern we see most often is Copilot licences already assigned and no sensitivity labels on anything. Nobody did anything wrong. Access just grew the way it always does, through inherited permissions and links sent to the whole company that nobody ever took back.

Our SharePoint Audit does this in two to three weeks. It’s read-only and it ends in a plan you own. If you want to see the scale of it first, the free external sharing risk scanner shows what’s shared outside your organisation from inside your own tenant.

Use what you already pay for

Most mid-market organisations already own SharePoint, Lists and Power Automate through their Microsoft 365 plan. The second step is to use them before buying anything new.

Local Government Procurement is the clearest example we have. They’d bought and abandoned two SaaS tools for tracking their OKRs, and then Microsoft retired Viva Goals. We built an OKR tracker on SharePoint lists instead. No new licences, a running cost of a few dollars a month on Azure, and an executive report that now builds itself every week.

“Because the solution was built around how we work and integrated into our existing Microsoft environment, adoption was strong from day one.”

Michelle Despas, Director of People & Culture, Local Government Procurement

No new subscriptions. No new login. And the data now sits where an AI will eventually read it.

Move the work into SharePoint

This is the step that turns SharePoint from a file server into something closer to the operating system for the business. Every operation runs on a handful of registers and workflows — incidents, assets, approvals, onboarding, renewals. While those live in spreadsheets and inboxes, there’s nothing for an AI to work with except the documents.

As more of the operation moves into the tenant, look at each core application and ask one of three questions. Can we replace it with something built in SharePoint? Can we connect it, so its data lands where everything else is? Or is it fine where it is?

Achieve Australia ran thirty onboarding and offboarding events a month by hand, across five systems. One pipeline built in their own tenant now provisions accounts, licences, groups and devices from a single request. It recovered 120 hours a month and $126K a year. We’ve written up what running your operation on SharePoint looks like in more detail.

Then put AI on top

Once the work runs in the tenant, you can measure it. That’s what shows you where AI earns its keep, because the use cases stop being guesses.

Some of the best first ones aren’t Copilot at all. Achieve’s NDIS claim notifications used to be opened by hand, typed, matched to one of four clusters and routed to an admin. Azure Functions now do all of it, with a weekly audit report, inside Azure’s free monthly grant.

Copilot has its place too: answering questions across documents once the permissions are right, and SharePoint agents scoped to one site or one process. The difference is that you’re adding it to records that are current and access that’s deliberate.

Go small before you go big

None of this needs to happen at once, and it shouldn’t. Pick one process and one team. Get it working, let people get used to it, then do the next one. Change management belongs in the build decision, not in a training session at the end.

The expensive version of an AI programme is new licences on top of a tenant nobody has read. Small steps are how you skip it.

Where to start this month

Three things you can do this month without spending anything:

1. Run the external sharing risk scanner and look at the number of “anyone” links.
2. List the spreadsheets that hold an operation together, and who maintains each one.
3. Ask who has a Copilot licence today, and what they’ve used it for.

If those answers are uncomfortable, The SharePoint Audit is the first step. We’ll tell you honestly what we find and what we’d do first.