What Copilot can actually reach in Microsoft 365
Copilot does not break permissions. It obeys them — which is exactly the problem, because most tenants have no idea what their permissions currently allow.
Guides
Microsoft 365 security guides
What we have learned building this, written to be useful on its own — for admins, and for providers running the same checks across many tenants. No gates, no forms in the middle, no email required to read the good part.
Getting to DMARC enforcement without breaking your mail
Many domains that publish DMARC never get past p=none, which monitors and blocks nothing. The reason is not ignorance — it is that enforcing without an inventory is genuinely dangerous.
Evidence auditors accept, and evidence they merely tolerate
A screenshot proves a setting was correct on the day somebody remembered to take it. Most compliance evidence is exactly that, and everyone involved knows it.
Try any of it on your own environment
Sign up and connect a tenant when you are ready, or start with the free domain check, which reads only what your DNS already publishes.