M365 Copilot - Solution Assessments Program

16.If your organization is using Microsoft Teams, do you allow meeting recordings
and transcripts? *

Yes, we allow recordings and transcripts.

We allow meeting transcripts only.

We do not allow recordings or transcripts.

We do not use Microsoft Teams.

17.Does your organization have any requirements relating to data residency or
data processing? *

My organization has no known requirements.

My organization requires that all data remains within my organization’s tenant region(s).

My organization requires that all data remains in my organization's tenant(s).

My organization requires that all data remains with my organization’s country.

18.Does your organization have processes in place to govern how information stored in OneDrive or SharePoint is shared inside and outside the organization? *

No.

Yes, we ask that users manually review what they have shared and to whom.

Yes, we have centralized processes to identify potentially overshared content and notify data owners to individually remediate.

Yes, we have automated processes to identify potentially overshared content and take automated actions to remediate.

19.Does your organization have processes in place to control business-critical data hosted in Microsoft 365? *

No.

Yes, we have processes in place to manually identify and block downloads of data stored in business-critical locations.

Yes, we have processes in place to dynamically protect sensitive or business-critical information from being shared beyond its intended audience.

20.How does your organization manage the sharing of content in Microsoft 365? *

We have not evaluated any sharing controls.

We have implemented organizational sharing controls (e.g. default sharing link, link expiration, site owner sharing approvals).

We have implemented sharing controls and enforce them using centralized policies.

21.Does your organization have tools in place to limit the sharing of sensitive
information? *

Yes, we leverage a data loss protection tool, such as Microsoft Purview DLP, for cloud based content.

Yes, we leverage a data loss protection tool, such as Microsoft Purview Endpoint DLP, for endpoints and browsers.

Yes, both a) and b)

No, we have not deployed a data loss protection solution.

22.Does your organization have tools and processes in place to classify sensitive information and identify it when being used by people or automated processes? *

Yes, we use data classification tools, such as Microsoft Purview Information Protection, to allow users to manually label emails and documents.

Yes, we use data classification tools, such as Microsoft Purview Information Protection to automatically label data based on its content.

No, we do not have data classification tools or processes.

23.Does your organization use classification tools to identify and restrict access based on the location of documents? *

Yes, we use classification tools, such as Microsoft Purview Information Protection to set default sensitivity labels on document storage locations.

No, we do not label document repositories.

24.Does your organization have a process to identify stale or inactive document repositories? *

No.

Yes, and we rely on data and repository owners to manage.

Yes, we have implemented automatic lifecycle policies, such as SharePoint inactive site policies.

Yes, we have implemented automatic lifecycle policies and have defined processes to regularly audit the results.

25.Does your organization have a process to regularly audit and act on stale or inactive data to meet organizational or regulatory requirements? *

Yes, we have published, policies but do not have tools or processes in place to automate.

Yes, we have processes that automatically remove or retain information using time-based criteria.

Yes, we have processes to automatically remove or retain information based on document content or properties.

No, we do not have any processes to manage stale data.

26.Does your organization have processes in place to gain visibility into how users are interacting with sensitive Microsoft 365 hosted data? *

No

Yes, we leverage log search tools, such as Microsoft Purview Audit to manually search for how users are interacting with data in the organization.

Yes, we leverage data search tools, such as Microsoft Purview eDiscovery to identify sensitive data that is involved in AI based interactions.

Yes, we leverage user behavior analysis tools, such as Microsoft Purview Communication Compliance, to automatically detect sensitive or non-compliant interactions across email, data, and instant messaging.

Microsoft 365 Copilot Optimization Assessment

Get to know Microsoft 365 Copilot.

Data Security and Governance