Ashwin Yadav
All work

Policy 19Healthcare & financial services; in-houseAI & Automation

Microsoft 365 Copilot readiness, integration and governance

Policy path. Signal: Copilot licences ready to assign. Decision: Permission review before rollout. Controls: Require Overshared access fixed first; Grant Pilot group enabled; Require Sensitivity labels and DLP. Outcome: Copilot on a reviewed permission baseline.

If The challenge

Copilot can surface anything a user already has access to. Overshared SharePoint sites and unclear usage rules risked exposing sensitive information once licences were assigned.

Then The solution

Reviewed permissions before rollout using the SharePoint permission crawler, integrated Copilot with SharePoint and Teams for contextual assistance and summarisation, rolled out to a pilot group first, and set usage guidance and governance controls with sensitivity labels and DLP.

Result Outcomes

  • Copilot enabled on a reviewed permission baseline
  • Contextual assistance in SharePoint and Teams
  • Documented adoption and governance approach

Why Key decision

Fixed access boundaries before assigning licences, not after, because Copilot makes existing oversharing easy to find.

Related evidence

All work

Policy 04Financial services

Identity governance and audit logging

If
Legacy authentication, inconsistent MFA, permanent administrative privileges and insufficient audit visibility limited…
Then
Implemented staged identity security improvements, role-based Conditional Access, stronger MFA, a role structure ready…
Result
Reduced legacy authentication exposure
  • Microsoft Entra ID
  • Conditional Access
  • MFA
  • Privileged Identity Management

Policy 05Financial advisory & asset management

OAuth application and cross-tenant access governance

If
Third-party integrations, external application permissions, partner access boundaries and audit visibility required…
Then
Reviewed application integrations, established administrative consent governance, removed unauthorised or dormant…
Result
Brought application consent under administrative governance
  • Microsoft Entra ID
  • OAuth consent governance
  • Cross-tenant access
  • Audit logging

Policy 06Healthcare RCM (in-house)

ISO 27001:2022 certification renewal

Renewed ISO 27001:2022 certification

If
Security control remediation, evidence collection and compliance coordination were required to support certification…
Then
Drove security remediation, strengthened information security controls, and coordinated audit evidence and compliance…
Result
Coordinated audit evidence and compliance activities
  • ISO 27001:2022
  • Information security governance
  • Security remediation
  • Audit evidence

Contact

Let's talk about secure Microsoft cloud work.

Email meLinkedInResume (PDF)

↑↓ to move · Enter to open · Esc to close