Copilot readiness assessment — know what Copilot will see.
Copilot inherits every permission your users already have. SafeScan maps that exposure across your tenant, scores how ready you are out of 100, and hands your admin the exact PowerShell to close each gap — read-only, in under five minutes.
Read-only Graph scopes · no file contents read · revoke access any time
Copilot does not create exposure. It reveals it.
Every file a colleague could already open becomes something Copilot can quote. The risk was always there — Copilot just makes it trivially easy to find.
Permissions you set years ago
A folder shared with Everyone during a project in 2021, a site whose inheritance was broken to unblock one person, an anonymous link nobody revoked. Copilot reads all of it the moment you turn it on.
Reports without priorities
Generic compliance tools hand you a few hundred findings in no useful order. Knowing something is wrong is not the same as knowing what to fix first — and your admin loses a week deciding.
Scan, score, then actually fix it
SafeScan ranks every finding by severity, gives leadership one number to track, and generates the remediation script for each failing check. The loop closes in the same tool.
Twenty-three checks, grouped the way admins think
Each returns pass, warning or fail with a score, and each domain rolls up into the readiness number.
Exposure
SharePoint and OneDrive oversharing, anonymous links, external sharing and sites whose permission inheritance has been broken.
Identity
MFA coverage, dormant and stale admin accounts, guest access and gaps in Conditional Access.
Compliance
DLP policy coverage, audit logging, sensitivity label usage and retention configuration.
Teams
External access settings, anonymous meeting joins, app governance and team sprawl.
Licensing
Unused licences, inactive users and SKU assignments worth revisiting before renewal.
Copilot readiness
The composite score, the oversharing Copilot would inherit, and the governance posture behind it.
Scan, fix, rescan
The loop closes in the same tool — including the proof that the fix landed.
- 1
Connect
Sign in with Microsoft and approve read-only Graph consent. No agent to deploy, no app registration to build, no firewall change.
- 2
Scan
SafeScan runs all 23 checks across your tenant and scores each domain. Under five minutes for most estates — close the tab if you like.
- 3
Fix, then prove it
Work down the ranked findings using the admin steps or the generated scripts, then rescan to show the readiness score moving.
It reads. It never writes.
SafeScan asks for the minimum it needs to answer the question, and nothing beyond it.
Read-only by design
Only read scopes are requested, so there is no code path that could create, change or delete anything. The consent screen shows every permission before you approve it.
No file contents
Permissions and metadata only — who can reach what. The text inside documents, emails and Teams messages is never read.
Revoke in one click
Remove access from Microsoft Entra whenever you like. It ends immediately, and nothing is kept afterwards.
What teams found on their first scan
Security leads, CTOs and managed service providers on what changed after running SafeScan.
“We found 47 files shared with Everyone before our Copilot rollout. SafeScan saved us from a major data incident.”
“The Copilot Readiness Score gave our board a single number they could track month on month. It changed how we report on security posture.”
“As an MSP we manage 30+ Microsoft 365 tenants. The multi-tenant dashboard is exactly what we needed — one view, every client.”
Asked before every first scan
Four of the questions we hear most — the full set is on the SafeScan FAQ page.
What does Copilot SafeScan actually check?
Twenty-three automated checks grouped into six domains — Exposure, Identity, Compliance, Teams, Licensing and Copilot. Each returns a pass, warning or fail with a numeric score, so you can see at a glance which part of the tenant is dragging your readiness down.
How long does a scan take?
Under five minutes for a tenant of up to a thousand users; larger estates can take about fifteen. It runs in the background, so you can close the tab and come back to the finished result.
What permissions does it need?
Read-only Microsoft Graph scopes — Sites.Read.All, User.Read.All, Policy.Read.All and AuditLog.Read.All. There is no write scope anywhere in the consent, so the app physically cannot alter your tenant. The OAuth screen lists every permission before you approve it.
Does it read the contents of our files?
No. SafeScan looks at permissions and metadata — who can reach what. The text inside your documents, emails and Teams messages is never read and never leaves your tenant.
Copilot readiness & oversharing insights
Have you heard of Kali365, the threat targeting your Microsoft 365 tenant?
Kali365 is not a Microsoft 365 vulnerability and no patch is coming. It is a subscription phishing kit that takes the token your own sign-in just approved.
Twelve things a solicitor can ask Copilot before the kettle boils
Practical Microsoft 365 Copilot prompts for legal work — chronologies, deadlines, bundle prep, contract comparison and handover notes — plus the four requests that do not work, and why.
Is your Microsoft 365 tenant protected against Kali365?
A six-step check on your tenant: audit device code use, block the flow in Conditional Access, harden what MFA cannot, hunt the sign-in logs, and revoke properly if you find one.
Buy it straight from Microsoft.
Prefer to buy through Microsoft? Get Copilot SafeScan on the Microsoft and Azure Marketplace — billed through your existing Microsoft agreement, with the procurement your finance team already trusts.
See what Copilot would find in your tenant
Run a free scan and get your Copilot Readiness Score, ranked findings and the scripts to fix them. No card, no agents, nothing written to your tenant.
Read-only Graph scopes · no file contents read · revoke access any time
More on Copilot SafeScan
Every page of the SafeScan sub-site, and the way back to the rest of LogiSam.