Answers for security, IT and procurement.
The questions we are asked most during an evaluation — on permissions, privacy, scoring, remediation and price. If yours is not here, ask us.
Copilot SafeScan: your questions answered
What does Copilot SafeScan actually check?
Twenty-three automated checks grouped into six domains — Exposure, Identity, Compliance, Teams, Licensing and Copilot. Each returns a pass, warning or fail with a numeric score, so you can see at a glance which part of the tenant is dragging your readiness down.
How long does a scan take?
Under five minutes for a tenant of up to a thousand users; larger estates can take about fifteen. It runs in the background, so you can close the tab and come back to the finished result.
What permissions does it need?
Read-only Microsoft Graph scopes — Sites.Read.All, User.Read.All, Policy.Read.All and AuditLog.Read.All. There is no write scope anywhere in the consent, so the app physically cannot alter your tenant. The OAuth screen lists every permission before you approve it.
Does it read the contents of our files?
No. SafeScan looks at permissions and metadata — who can reach what. The text inside your documents, emails and Teams messages is never read and never leaves your tenant.
Can we remove its access later?
Yes, in one click from Microsoft Entra. Access ends immediately and nothing is retained afterwards.
What is the Copilot Readiness Score?
A single figure out of 100, broken down per domain, summarising how exposed your tenant would be the day Copilot is switched on. It gives a board or steering group one number to track month on month instead of a spreadsheet of findings.
Do the PowerShell scripts change anything by themselves?
No. SafeScan generates them; you review and run them in your own admin terminal. They are commented and log their output, so the change is auditable afterwards — and you rescan to confirm the fix landed.
What does it cost?
There is a free tier that runs a real scan of a real tenant, and paid plans for single-tenant, multi-tenant and MSP use, each with a seven-day trial. See SafeScan pricing.
Can we buy through Microsoft?
Yes. Copilot SafeScan is listed on the Microsoft Marketplace and Azure Marketplace, so it can be billed through your existing Microsoft agreement.
Is it the same thing as a Copilot readiness assessment?
It is the technical half of one, automated. Our AI governance & readiness service wraps the scan in the parts software cannot do: agreeing remediation with data owners, persona use cases, training and a phased roll-out plan.
Can one dashboard cover several client tenants?
Yes. The Enterprise plan covers five tenants and the MSP plan is unlimited, both with a multi-tenant dashboard — built for managed service providers and groups running several estates.
Can we prove a fix worked?
Rescan. The readiness score and the per-domain breakdown move, the closed findings drop out, and the history keeps a record of posture over time you can show a board.
Still deciding?
The free tier scans a real tenant and gives you a real readiness score — the fastest way to settle whether this is worth your team's time.
More on Copilot SafeScan
Every page of the SafeScan sub-site, and the way back to the rest of LogiSam.