AI · 18 October 2026 ·
Translated with AI. This article was translated by an AI model from an article by Twentynext in another language, and the translation was checked automatically against the original. Verify figures and sources before acting on them. See our disclaimer.
Suppose that the feature your Copilot pilot revolved around is called something else after an update, falls under a different licensing model or is no longer where the team had learned to find it. Whether, when and how often such changes occur is set out in Microsoft’s release notes; this article makes no statements about that and treats the situation as a scenario.
The question for you as a decision-maker: which criteria do you use to select a consultancy that puts in place an implementation able to absorb such a shift, if it occurs? Below you will find assessment criteria and a scorecard with a scale, weighting and decision threshold. One note in advance: we have not carried out an independent assessment of consultancies, and the scorecard is a tool of our own, not a validated instrument.
What matters most for your decision is that you want an answer in advance to the question: what do we do if a feature changes or disappears? That answer belongs in the plan before the first licence is assigned.
Your own environment does not stand still either. Processes, data and permissions change through internal decisions, legislation, integrations with other systems, and through suppliers and external administrators. Which part of that you control yourself, you know best.
Our starting point in projects is therefore: begin with a concrete bottleneck in a process and with the question of whether the information in that process is in order. Which features are new this month comes afterwards. That is a choice of approach, not a guarantee against product changes.
One note on sources. This article does not link to Microsoft documentation. How Microsoft 365 Copilot handles user permissions, which authorisations an agent receives and how licences and administration settings work are things you check in Microsoft’s own current product documentation and release notes. Record the date of consultation when you do so; supplier texts, including ours, are no substitute.
In conversations with providers, “Copilot” is often treated as one thing. In the supplier texts we consulted (6 September 2026), at least three terms appear that you will want to keep apart. We only reproduce how providers themselves use those terms.
The first term is Microsoft 365 Copilot. One provider writes that rolling it out at scale brings new considerations around governance, security, licensing structure and the design of workflows (Centric Consulting). That is that provider’s own characterisation.
The second term is “agent”. One provider describes its service as identifying agent use cases and designing secure multi-agent systems (HSO); another speaks of “working agents” in the customer’s tenant (Copilot Expert). Which actions such an agent performs itself and which a human confirms does not emerge from these texts. Ask about that explicitly, and check it against the product documentation before you let an agent touch a process step.
The third term is the consumption model. HSO also mentions guidance on “the transition to consumption-based Copilot Credits” (HSO). What that model entails and who it applies to, you can read at Microsoft. The lesson for you: in the words of providers themselves, the licensing model is also a moving part.
Four characteristics we look for in projects. They are principles from our own practice, not measured success factors.
Start with the question of which action in which process currently costs time or frequently goes wrong. An assistant that supports a concrete bottleneck keeps its reason for existing even if the underlying feature is given a different name. Put yourself to the test: if the demonstration feature changes tomorrow, can we still explain why this project exists?
Our starting point, as we also phrase it on our services page: Copilot sees what the user is allowed to see. If permissions and data classification are not in order, that becomes visible with the first query, and that is why cleaning up permissions is the first step with us (Twentynext). How exactly Microsoft sets this up technically is something you verify in the product documentation and in your own tenant.
If an assistant surfaces information that someone is formally allowed to read but in practice should not, have it assessed within your privacy and incident process. Weigh up for your situation what cleaning up in advance costs against investigating afterwards. How much clean-up work is involved, you only know after a scan of the chosen process.
Who may build agents? Which data sources may be connected? Who reviews output for decisions with consequences for citizens or customers? Those agreements should exist independently of the current feature set. Which legal frameworks apply in this respect, you have checked by your privacy officer or legal adviser.
We advise against using the number of licences assigned as a measure of results. What you want to know is whether the chosen process runs better: use within that process, quality of the output, lead time, risks and costs. Agree in advance which measures you track, whether you carry out a baseline measurement and at what point you take stock. That way you avoid a discussion afterwards about what “results” means.
What follows is based on providers’ self-descriptions and on comparison lists drawn up by consultancies themselves (consulted 6 September 2026). These are commercial texts; they say something about how a provider wants to present itself, not about the quality delivered. The three groups do not form a complete or representative classification of the market; they serve only to structure your conversation.
A first group positions itself around governance, security, adoption, productivity and measurable return, and refers to partner status with Microsoft (Centric Consulting). A list drawn up by a consultancy mentions a “Copilot Ready Tier” designation for the same party (Copilot Experts). Whether such statuses still apply at the time of reading, you verify with Microsoft, not in the consultancy’s text.
A second group focuses on agents: from identifying use cases to designing multi-agent systems (HSO), or “from strategy to working agents” in the customer’s tenant, adding that it works independently (Copilot Expert). That “independent” is a self-description; question 4 in the scorecard tests what it means.
A third emphasis is measurement after roll-out: a comparison list names adoption analyses, productivity benchmarks and iterative optimisation as a distinguishing characteristic of one of the consultancies discussed (SingleStone).
Which positioning suits you depends on your phase: still determining whether and where Copilot fits, supporting a clearly defined process, or keeping a broad roll-out manageable. The scorecard below applies to all groups.
Six questions, each with what distinguishes a substantive answer from a signal to probe further. Each question also states what the criterion is based on: our own preference, or providers’ self-descriptions. Give a score per question and compare consultancies on the same points.
Score per question: 0 (no answer or an evasive one), 1 (a general answer with no connection to your situation), 2 (a concrete answer that connects to your process and environment).
Weighting: questions 1, 3 and 4 count double, because in our view they determine whether the implementation survives a product change and whether the advice is independent. Questions 2, 5 and 6 count once. That comes to a maximum of 18 points (3 × 2 × 2 + 3 × 2).
As a starting point we propose a threshold of 12 points for a second conversation, and a 0 on question 1 or 4 as grounds for exclusion. That threshold is our own choice to structure the conversation; we are not aware of any research showing that 12 points predicts a good project. Adjust the weighting if your situation differs, but record the choice before the first conversation.
1. Does the consultancy start with your data and permissions? (weighting 2; basis: our own preference, see our services page)
Substantive answer: the consultancy wants to see your information management first and names permissions, governance and licensing structure as part of the roll-out. Signal: the first conversation is about licence numbers.
2. Does the consultancy measure after the roll-out? (weighting 1; basis: self-descriptions in comparison lists, plus our own preference)
Substantive answer: the consultancy describes adoption analyses, benchmarks and iterative optimisation as a fixed component, as a comparison list names this as distinguishing for one consultancy (SingleStone). Signal: measuring is left for “later” or left to you.
3. Does the consultancy have an account of what happens when a feature changes? (weighting 2; basis: our own preference)
Substantive answer: the consultancy explains how it links the implementation to a process rather than to a specific feature. Signal: the question is brushed aside.
4. How do advice and licence supply relate to each other? (weighting 2; basis: our own preference)
Substantive answer: the consultancy is transparent about whether it earns from licences and how that influences its advice on scale and timing. Our own choice is that you buy licences from Microsoft and we do the implementation, configuration and guidance (Twentynext). Signal: the question goes unanswered.
5. Does the consultancy know your context? (weighting 1; basis: our own preference)
Check which information management requirements apply to your organisation besides privacy, and have that reviewed by your privacy officer or legal adviser. Substantive answer: the consultancy explains how that review is built into the project. Signal: “the tool takes care of that.”
6. Is knowledge transferred? (weighting 1; basis: our own preference)
We advise appointing internal owners: someone for functional administration, a data owner and someone who safeguards governance. Substantive answer: the consultancy describes how it builds up those roles within your organisation. Signal: the consultancy remains indispensable.
On lead time: it depends on your scope and configuration. Have the consultancy substantiate the lead time separately for each scope, for example for “activating an assistant in the existing environment” and for “building an agent with integrations and authorisations”. How big the difference is in your case will emerge from an initial scan. Be suspicious of a standard figure quoted before that scan.
On roles: who in your organisation decides whether an assistant is used in day-to-day work, and who checks whether permissions and integrations are correct, differs from organisation to organisation. Make sure both perspectives are at the table from the start when choosing and defining one or two processes.
On explainability: decide before the roll-out in which process you will track use and outcomes. If no process has been chosen, who can explain afterwards what the investment has delivered?
Start with an internal hour before you invite a supplier. Bring three people together: a process owner who suffers daily from repetitive information work, the administrator of your Microsoft 365 environment and the person responsible for information security or privacy.
Answer two questions together. Which process demonstrably costs time now through searching, summarising or retyping? And are we certain that the permissions on the documents in that process are correct?
With those answers you have a different conversation with a consultancy. The question shifts from “what can Copilot do?” to “help us support this process in a way that can absorb the next product change”. Consultancies that reach your pre-defined threshold on the scorecard and do not score 0 on questions 1 and 4, you invite for a second conversation. How such a conversation goes with us is described at AI consultancy from Twentynext.
All sources below are commercial texts from providers or comparison lists drawn up by consultancies, consulted on 6 September 2026. They are used here only to show how providers describe themselves, not as an independent assessment and not as a source for product claims about Microsoft.
Sixteen questions, seven minutes, and an instant spider chart showing your strongest and weakest dimension. No e-mail address needed to see the result.
AI · 20 October 2026
A model that performs well in testing can deliver less than expected in practice. Learn why trust drives AI value in government and how to measure it.
Read the article →
AI · 18 October 2026
An honest checklist: six questions that determine whether your organisation is ready for AI, and what the next step is if the answer is no.
Read the article →
AI · 18 October 2026
Almost every organisation that gets serious about data faces the same question: who is actually going to do this? Build, hire or outsource?
Read the article →
Work with us
The people who build it also run it afterwards. Eindhoven, since 2014.
We use Google Tag Manager to measure visits and Leadinfo to recognise which company is visiting. Neither loads unless you agree. If you choose essential only, the site works as normal and we measure nothing. Cookie statement · Privacy statement
