AI readiness, as Bayport delivers it, is a scanning-and-controls engagement on Microsoft 365 that inventories SharePoint and OneDrive repositories, identifies likely sensitive content with Microsoft Purview, configures automatable controls on priority repositories, and tests what connected AI and search can surface. It is platform-agnostic as to the AI tool the client adopts.
Copilot and Claude see what your permissions allow. Most permissions allow too much.
Twenty years of SharePoint sites, anonymous sharing links that never expired, HR folders with department-wide access, and a research library nobody classified. Connect an AI assistant to that and the first bad answer surfaces a document the user was never meant to see. The exposure already exists. AI makes it searchable in plain English.
How the readiness sprint runs
Step A: Inventory and risk mapping
Export the site and library inventory, identify owners, map priority business areas, flag external sharing and high-risk repositories, and evaluate the Purview and admin tooling available on your licensing.
Step B: Discovery and sampling
Use Purview and agreed search patterns to find likely PHI, PII, financial, clinical, regulatory, legal, and IP content. Sample libraries with owner review. Owners make the classification call, not us.
Step C: Crown jewels first, then remaining priorities
Lock down or exclude HR, Finance, and Legal from AI-accessible scope. Classify research as internal only. Configure tenant-level OneDrive controls: anonymous links off, guest-link expiration, default labels by policy, sharing restrictions, DLP for high-confidence patterns. Prepare the readiness acknowledgment so Legal can review while work continues.
Step D: Validation and handoff
Test AI and search exposure against agreed scenarios. Run user acceptance testing. Deliver the governance handoff: periodic control review and a new-site process so the posture holds after we leave.
The crown-jewels posture lands first, in the opening weeks, so Legal review runs in parallel with the remaining control work. Elapsed time depends on owner availability and classification approvals.
What you get
- Inventory workbook with owner mapping and risk triage
- Sampling plan, candidate classification map, and exceptions list
- Configured controls and protection settings in your tenant
- Permissions findings and audit configuration summary
- Validation report for AI and search exposure
- Tenant-level OneDrive control configuration summary
- Governance handoff document with owner training notes
- AI Data Connection Readiness Acknowledgment, populated with technical inputs for Legal and Compliance signature
- Prioritized backlog of findings outside the sprint
What this is not
This is scanning plus automatable controls. It is not a file-by-file labeling program, not enterprise-wide data classification, and not a legal review of file contents. Those are separate gated phases if you want them. Microsoft 365 controls reduce risk. They do not guarantee that content cannot surface through connected AI where permissions allow, and Microsoft changes feature behavior over time. We document the control state at deployment and say so in writing.
Life sciences, public company
Priority repositories across HR, Finance, Legal, clinical, regulatory, research, and investor relations, a crown-jewels-first sequence, tenant-level OneDrive controls, and a signed readiness acknowledgment that gated the later connection of Claude to company data. Delivered under a capped scope with weekly written status.
Who this is for
- Companies planning a Copilot or Claude rollout that will connect to SharePoint
- Public companies with material non-public information in finance and IR folders
- Regulated firms (HIPAA, CCPA, GxP-adjacent) that must show a control posture to auditors and insurers
- Anyone who has already turned on an AI assistant and is unsure what it can see
Frequently Asked Questions
Inventory, discovery and sampling, automatable controls on priority repositories, validation testing, a governance handoff, and a readiness acknowledgment for Legal and Compliance.