SharePoint search readiness checklist for Copilot and AI assistants

Copilot and other AI assistants answer from the content your people can already access. If permissions are too broad or content is out of date, the answers will show it.

Microsoft states that Copilot does not return data a user has no access to (source: Microsoft Purview). The real risk is access granted too widely over the years, plus stale or duplicate content that crowds out the right answer.

This checklist covers SharePoint, ServiceNow knowledge and the search layer that ties them together. Fill it in with your Microsoft 365 admins, your intranet owners and your knowledge managers.

How to score it

• Give each item 2 points if it is done, 1 point if it is in progress and 0 if nobody has started it.
• Add up your points and divide the total by the maximum (2 points times the number of items).
• A score above 75% means you can schedule the work. Between 40% and 75%, close the gaps this quarter. Under 40%, start with an assessment before you commit to a date.

Permissions and oversharing

• Find sites, libraries and files shared with Everyone except external users or through organization-wide links.
• Review the owners of every site and make sure each site has at least two active owners.
• Restore permission inheritance where a one-off exception is no longer needed.
• Turn on Restricted Content Discovery for high-risk sites while you review them (Microsoft Learn).
• Check guest and external access on sites that hold HR, finance or legal content.

Content hygiene

• Archive or delete content nobody has edited within a set period, such as two years.
• Remove duplicate versions of policies and procedures, and mark one official copy.
• Give key pages and documents clear titles and descriptions.
• Assign a review owner and a review date to every policy and knowledge article.

Sensitivity labels

• Publish your sensitivity labels and turn them on for SharePoint and OneDrive.
• Label your most sensitive libraries first, with default labels or auto-labeling.
• Check that encrypted content gives the right people both the VIEW and EXTRACT rights, which AI apps need to return it.

Connectors: ServiceNow and other sources

• List the systems outside Microsoft 365 where people look for answers: ServiceNow, your CMS, file shares.
• For ServiceNow knowledge, confirm REST API access and read ACLs before you deploy the Copilot connector (Microsoft Learn).
• Choose the Advanced user criteria flow if your knowledge bases use script-based user criteria.
• Test results with accounts from different departments to confirm each person sees only what they should.

Search analytics

• Export top queries and zero-result queries from your intranet search.
• Fix the 20 most common failed queries with better content, titles or synonyms.
• Set up a monthly review of search and Copilot usage with a named owner.

Get a second opinion

Scored under 75%, or not sure which sites to fix first? Our intranet search assessment reviews your SharePoint, ServiceNow and search setup before you roll out Copilot.

Sources

1. Restrict discovery of SharePoint sites and content (Microsoft Learn)
   learn.microsoft.com
2. Deploy the ServiceNow Knowledge Microsoft 365 Copilot connector (Microsoft Learn)
   learn.microsoft.com
3. Microsoft Purview protections for Microsoft 365 Copilot (Microsoft Learn)
   learn.microsoft.com