Skip to content

AI Foundation · Copilot, Claude, Purview

AI that only sees what it is allowed to see. With evidence.

Your tenant is ready for Microsoft 365 Copilot and Claude Enterprise or Claude Team, with evidence for auditors and regulators. We clean up permissions, secure sign-ins through Entra ID, classify sensitive data with Purview and log AI use.

Book an introductory call How it works

Example: asked about the board minutes, the AI replies that it cannot find any documents the person asking has access to. Permissions are cleaned up, the Confidential label applies, and the request is logged in the audit log.

For
Companies with 50 or more employees before Copilot or Claude
Scope
Permissions, Entra ID, Purview, audit log, Global Secure Access
Approach
Assessment, clean-up, pilot, rollout in waves
Result
Enabled only after review, evidence pack for auditors
Price
from €3,900 excl. VAT, fixed price for the assessment

Sound familiar?

Who is AI Foundation for?

Copilot or Claude rollout planned

Before AI reads your documents, you want to know what it finds.

Free AI tools already in use

Company data ends up in services without contract or logging.

Auditors or works council ask

They want evidence of how AI usage is controlled.

Permissions

Why do permissions decide what AI sees?

Copilot uses the rights of the person asking. A forgotten share today is an answer tomorrow. Switch the view to see what the clean-up changes.

Choose a state
  • Team wiki Shared: all staff Shared: all staff
  • Project plan Shared: project Shared: project
  • Salary list Shared: Everyone Shared: HR
  • Board minutes Link for anyone Confidential label

1 Identity

Any account can ask, even without MFA Only with MFA and a compliant device

2 Permissions

Sharing with “Everyone” stays in place Broad sharing removed

3 Classification

No labels, no DLP Confidential label keeps files out of AI

4 AI sees

  • Team wiki
  • Project plan
  • Salary list open to everyone
  • Board minutes not labelled
  • No documents

5 Logging

Audit log exists, but nobody reviews it Prompt, response and sources in the unified audit log, analysed with DSPM for AI

Four documents pass three checks: identity, permissions, classification. Before the clean-up all four reach the AI, including the salary list that is open to everyone and the unlabelled board minutes. After the clean-up the salary list stops at permissions and the board minutes at the Confidential label; the AI only sees the team wiki and the project plan, and every request is recorded in the unified audit log.

What is part of AI Foundation?

Clean up oversharing

Find broad sharing, keep sensitive sites out of Copilot.

Secure identity

MFA, Conditional Access and cleaned-up guest accounts, for Claude too.

Classify data

Purview labels and DLP keep confidential files out of Copilot.

Log usage

Copilot interactions in the unified audit log, evaluated with DSPM for AI, the Purview view of AI usage.

Control AI tools

Make unapproved AI tools (shadow AI) visible, block them once an approved alternative exists.

Set up Claude Enterprise or Team

Domain verified, sign-in only via SSO with Entra ID, on Enterprise users provisioned via SCIM from Entra groups.

Control AI tools

Which AI may see company data?

Approved services run through Entra ID and are logged. Unapproved services become visible and are blocked where needed.

  • Copilot and Claude Enterprise or Team via SSO
  • Block shadow AI only once the alternative is in place
Employees
  • Microsoft 365 Copilot In your tenant, in the audit log
  • Claude Enterprise or Team Sign-in only via SSO with Entra ID
  • Free AI app No contract, no logging Global Secure Access
Employee requests reach Microsoft 365 Copilot and Claude Enterprise or Team. The route to the free AI app ends at Global Secure Access.

How does the AI rollout work?

  1. Assessment

    Review permissions, identities and logging, prioritise findings.

  2. Clean-up

    Fix oversharing, introduce labels and DLP.

  3. Pilot

    Enable a small group, analyse the audit log.

  4. Rollout

    Release in waves, with training and a usage policy.

  5. Operations

    Repeat reviews regularly.

Where does your tenant stand before enablement?

The fixed-price gap assessment shows what is open before rollout.

Request the fixed-price Gap Assessment Book an introductory call

What you have in hand

Before

  • Unclear what Copilot would find
  • Sharing with the entire company
  • AI tools without logging
  • No answer for the auditor

After

  • Permissions report with prioritised measures
  • Labels, DLP and retention documented
  • Usage policy for works council and privacy
  • Evidence pack for auditors and supervisors

Further reading: Gap assessmentManaged SecurityBlog: AI adoption with Entra ID and PurviewBlog: Controlling AI tools

Frequently asked questions

How do I prepare a Microsoft tenant for a Copilot rollout?

Clean up SharePoint and OneDrive permissions, secure identities with MFA and Conditional Access, classify sensitive data with Purview. The pilot starts once the audit log is active.

Does Copilot see everything an employee can see?

Yes. Copilot does not extend permissions, but it makes existing sharing much faster to find. That is why permission clean-up comes first.

Claude Team or Claude Enterprise: which do you set up?

Both, each with sign-in only via SSO with Entra ID. Enterprise also creates and removes users via SCIM from Entra groups; on Team the account is created at first sign-in. Your data protection officer makes the legal assessment.

Which licences do I need for Purview and Copilot?

Copilot is an add-on to E3, E5 or Business Premium and included in E7. DLP for labelled files requires E5 or a Purview suite.

Planning Copilot or Claude?

Tenant, data and documentation stay with you.

Book an introductory call