Simon SkotheimsvikBy now, you’ve probably heard the standard Copilot-Ready preparation advice: lock down data, control access, and prevent oversharing. That’s all critical—but it’s only half the equation. Even with perfect data governance, if your device configuration isn’t up to par, Copilot won’t function as expected.
Microsoft has a long list of technical prerequisites for Copilot, many of which can be targeted by Microsoft Intune. Application distributions, device configurations, Windows update settings, licensing requirements—miss on these, and you could be dealing with broken functionality and grumpy end users. Yet, these crucial steps in the Copilot journey are rarely talked about.
This post is here to fix that. We’ll walk through the key settings you need to check, the policies you should have, and the best tools to streamline the process using Microsoft Intune. Plus, we’ll connect the dots with previous MSEndpointMGR resources so you have everything you need in one place.
Let’s make sure you’re truly Copilot-ready.
The Prerequisites for Microsoft 365 Copilot
Microsoft Learn provides a module that guides administrators through key steps for deploying and implementing Microsoft 365 Copilot. This module covers tasks like meeting prerequisites, preparing data, licensing, and extending copilot capabilities. It’s part of the “Prepare Security and Compliance to Support Microsoft 365 Copilot” and “Prepare Your Organization for Microsoft 365 Copilot” learning paths.
The first module, “Get Ready for Microsoft 365 Copilot,” lays out the technical must-haves—accounts, licenses, OS, and applications. As you can see, these are prerequisites before diving into data security, yet these requirements are most often overlooked.
This post will focus on these foundational prerequisites and how to configure them properly using Microsoft Entra ID and Microsoft Intune to ensure a seamless Microsoft 365 Copilot experience.
Microsoft Entra-based account
One fundamental prerequisite for Microsoft 365 Copilot is ensuring all users authenticate using a Microsoft Entra ID account. Legacy local accounts will heavily limit the Microsoft 365 functionality.
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management (IAM) service. It provides secure authentication, single sign-on, and conditional access to Microsoft 365, Azure, and thousands of other apps.
Cloud-Native or Hybrid Identity?
User identities in Entra ID can be cloud-native, meaning they are created and managed entirely in the cloud, or hybrid, where accounts are synced from an on-premises Active Directory using tools like Microsoft Entra Connect or Microsoft Entra Cloud Sync.
This hybrid approach allows organizations to maintain local identity control while enabling seamless cloud access and fulfilling the Microsoft 365 Copilt requirement of a Microsoft Entra ID-based account.
Consistent User Attributes in Entra ID
Microsoft 365 Copilot relies on accurate user attributes in Entra ID to provide relevant information. Large enterprises benefit from HR system integrations that maintain consistency, while smaller businesses often struggle with inconsistencies like multiple variations of department names (e.g., “Sales” vs. “Sales Dept.”).
Without standardized data, Copilot may return incomplete or inaccurate results. To fix this, businesses should establish naming conventions, automate data checks, and assign responsibility for maintaining data quality. I have earlier shared a solution for ensuring properties are correctly and uniformly filled per user to help tidy these things up.
Even a simple “poor man’s HR system” like the solution from my blog can improve accuracy, ensuring Copilot delivers precise, useful insights. For more details on implementing this, refer to my earlier blog post
Microsoft 365 Copilot License
One of the biggest concerns about Microsoft 365 Copilot is its licensing cost. At first glance, the price may seem steep, leading some organizations to hesitate. However, the equation looks very different when you consider what Copilot brings to daily workflows.
One common misconception about Microsoft 365 Copilot is that it is a standalone product. Copilot is an add-on license, meaning users must already have an eligible base license before using it.
Looking at the available eligible licenses, we see that many of these also include a license to use Microsoft Intune, which will be handy for managing many other prerequisites covered in this post.
Group-based Licensing in Microsoft Entra ID
Licensing is rarely a favorite topic among IT professionals, but we can’t ignore it—especially with models like Microsoft 365 Copilot requiring underlying products. Assigning the right mix of licenses to users can quickly become a complex task.
License management could previously be handled in the Azure AD and Entra ID portals, but Microsoft has now restricted this functionality to the Microsoft 365 Admin Center (aside from automation via Graph API).
I often see mistakes when assigning licenses, mainly when organizations use granular license assignments instead of Microsoft 365 SKUs that bundle the necessary services. This can lead to licensing inconsistencies, which disrupt access to critical services and introduce security risks due to missing licenses for specific users.
To simplify license management and avoid these issues, I strongly recommend group-based licensing in Microsoft Entra ID. This approach allows you to assign one or more product licenses to an Entra ID security group, ensuring all members receive the correct licenses automatically. New users inherit the required licenses upon joining the group, and when they leave, their licenses are revoked. This eliminates the need for manual adjustments or complex PowerShell automation to keep up with organizational changes, and it also allows for license assignments from the “real” management portals (Microsoft Entra ID and Azure AD) through group assignments.
Two Group Approaches
Multiple ways exist to structure security groups for license assignments in Microsoft Entra ID. You can use organization-based groups, where licenses are assigned based on a user’s position or role within the company, or product-specific security groups, which focus on individual Microsoft products.
Script Your License Groups Per SKU
For the latter approach, I have shared a simple PowerShell script that helps create Entra ID security groups for all available SKUs in your tenant.
<#
.SYNOPSIS
Script to create Azure AD License groups
.DESCRIPTION
Script to create Azure AD License groups for available SKUs used for assigning licenses to users in the tenant.
.EXAMPLE
.NOTES
Version: 1.1
Author: Simon Skotheimsvik
Contact:
Version history:
1.0 - (08.11.2022) Script released
1.1 - (07.07.2023) Adding users with existing licenses to the groups
1.2 - (13.02.2023) Convert to Microsoft Graph PowerShell SDK V2 module, Simon Skotheimsvik
#>
#region functions
function RenameDisplayName {
Param (
[Parameter(Mandatory = $true)]
[string]$DisplayName
)
foreach ($Translation in $DisplayNameTranslations.GetEnumerator()) {
$DisplayName = $DisplayName.Replace($Translation.Name, $Translation.Value)
}
$DisplayName
}# end function
#endregion functions
#region Variables
# Insert SKUs not manageable by groups: Get-MgBetaSubscribedSku | Where-Object { $_.SkuPartNumber -notin $SKUsNotToManage }
$SKUsNotToManage = @(
"WINDOWS_STORE"
"RMSBASIC"
"MICROSOFT_REMOTE_ASSIST"
"AAD_PREMIUM_P2_FACULTY"
"Dynamics_365_Guides_vTrial"
"FLOW_FREE"
"WIN10_ENT_A5_FAC"
"STREAM"
)
# Insert translations used to shorten group names
$DisplayNameTranslations = @{
"Azure Active Directory" = 'AAD'
"Microsoft 365" = 'M365'
"Office 365" = 'O365'
"Enterprise Mobility + Security" = 'EMS'
}
# Import Microsoft CSV file with friendly display name and SKU Partnumber
$licenseCsvURL = 'https://download.microsoft.com/download/e/3/e/e3e9faf2-f28b-490a-9ada-c6089a1fc5b0/Product%20names%20and%20service%20plan%20identifiers%20for%20licensing.csv'
$skuHashTable = @{}
(Invoke-WebRequest -Uri $licenseCsvURL).ToString() | ConvertFrom-Csv | ForEach-Object {
$skuHashTable[$_.String_Id] = @{
"SkuId" = $_.GUID
"SkuPartNumber" = $_.String_Id
"DisplayName" = $_.Product_Display_Name
}
}
#endregion Variables
#region connect
Connect-MgGraph -Scopes "Directory.Read.All", "Group.ReadWrite.All"
Import-Module Microsoft.Graph.Groups
#endregion connect
#region script
# Gather all SKUs in Tenant
$SKUsToManage = Get-MgBetaSubscribedSku | Where-Object { $_.SkuPartNumber -notin $SKUsNotToManage }
# Create groups for SKUs in Tenant
foreach ($SKU in $SKUsToManage) {
# Get friendly shortened GroupDisplayName
$SKUpartno = $SKU.SkuPartNumber
$GroupDisplayName = RenameDisplayName -DisplayName "AZ-LIC-$(($skuHashTable["$SKUpartno"]).DisplayName)"
# Finds group, create it if not existing
if ($Group = Get-MgBetaGroup -All | Where-Object { $_.DisplayName -like $GroupDisplayName }) {
Write-Output """$GroupDisplayName"" exists"
}
else {
Write-Output """$GroupDisplayName"" does not exist"
$Group = New-MgBetaGroup -DisplayName $GroupDisplayName -Description "This group is used to assign $(($skuHashTable["$SKUpartno"]).DisplayName) licenses." -MailEnabled:$false -SecurityEnabled -MailNickName ($GroupDisplayName).Replace(" ", "") #-IsAssignableToRole:$true
}
# Add license to group
$params = @{
AddLicenses = @(
@{
SkuId = $Sku.SkuId
}
)
RemoveLicenses = @(
)
}
Set-MgBetaGroupLicense -GroupId $Group.Id -BodyParameter $params
#Get all users with the specified license
Write-Output "Getting all users with the $(($skuHashTable["$SKUpartno"]).DisplayName) license"
$users = Get-MgUser -All | Where-Object { $_.AssignedLicenses.SkuId -contains $($Sku.SkuId) }
# Add users to the Azure security group
Write-Output "Adding $($users.count) users to the $($GroupDisplayName) group"
foreach ($user in $users) {
$params = @{
"@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/{$($user.Id)}"
}
New-MgBetaGroupMemberByRef -GroupId $Group.Id -BodyParameter $params
}
}
#endregion script The script includes a blacklist, allowing you to exclude specific SKUs from automatic group creation. The license friendly-names are downloaded, and a simple translator mechanism standardizes group names by converting standard abbreviations. For example, “Microsoft 365” in a license name becomes “M365”, “Office 365” becomes “O365”, and “Enterprise Mobility + Security” is shortened to “EMS.”
The script scans the tenant for available licenses and creates corresponding security groups if they don’t exist. Each group is given a consistent name and a clear description before the relevant license is assigned. Finally, the script identifies users who were manually assigned the license and adds them to the new group. However, it does not remove existing manual assignments—that step must be done separately if needed.
This approach ensures consistent, scalable, automated license management, reducing manual errors and improving administrative efficiency. By adopting group-based licensing, businesses can streamline their Copilot deployment, minimize administrative overhead, and maintain a more secure and compliant licensing structure. You can even perform license management through group assignments in your preferred Entra ID portal using the group-based licensing approach.
License Group Hygiene
As discussed earlier, a Microsoft 365 Copilot license cost is a common concern. While increased productivity can justify the investment, this only holds if users actively leverage Copilot’s capabilities. Tracking usage patterns and following up with underutilizing users can help ensure the license delivers real value.
Not every user will fully adopt Copilot’s features, and in such cases, it makes sense to reallocate the license to someone more engaged. My friend, MVP Alexander Holmeset, has developed and shared a solution to automatically unassign the license of inactive Copilot users. His routine can automatically remove users from the license group if their Copilot activity remains low over a set period. Additionally, the script can generate reports on inactive users, allowing organizations to encourage adoption before taking away the license.
This approach complements group-based licensing by ensuring that Copilot licenses are used efficiently, optimizing cost and productivity across the organization.
Microsoft Windows 11
While Windows 11 is not a strict requirement for Microsoft 365 Copilot, it is recommended as the optimal environment for a seamless Copilot experience. Microsoft has designed Windows 11 to work harmoniously with Microsoft 365 Copilot (or was it the other way around 🤔), offering features and enhancements that maximize its capabilities. Therefore, organizations should consider upgrading eligible devices to Windows 11 to unlock the full potential of Microsoft 365 Copilot.
It’s also important to note that Windows 10 will reach its end of life on October 14, 2025, making it essential for organizations to begin transitioning to the latest version of Windows well before then. With this deadline approaching, many organizations are prioritizing upgrades to Windows 11 as part of their IT roadmap.
Feature Updates
Microsoft Intune offers tools to help organizations manage and control Windows updates in the corporate environment. Being the feature update option, or Windows Autopilot, Intune ensures that devices are kept up to date with the latest Windows 11 features, while also maintaining security standards and providing the best experience for Microsoft 365 Copilot.
Before jumping to the feature updates, you should prepare and check your Windows 11 upgrade readiness. Your Windows 10 and 11 devices are producing upgrade experience indicators on a daily schedule. Locally on the device, you can check these indicators in the registry hive \HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TargetVersionUpgradeExperienceIndicators\.
Checking these indicators locally in the registry might not be a trivial task when managing a fleet of devices. Luckily, they are also uploaded to Microsoft Intune for you to consume in the Windows Feature Update Device Readiness Report.
This report will give you insights across your fleet from the data collected by Intune. It will give you an overview and some level of detail to help you decide on your feature update pace.
Some people look at these built-in versions and think, “Well, that’s… cute, but not quite what I had in mind.” That’s why MVP Maurice Daly, MVP Jan Ketil Skanke and MVP Sandy Zeng developed and released the Windows Update Compliance Dashboard from MSEndpointMgr – to give you the best insights possible, so you don’t go speeding into feature updates without knowing where you’re headed!
If you need a dashboard that provides a comprehensive breakdown of Windows patching across your environment—covering errors, issues with safehold, delivery optimization stats, and Windows 11 readiness—look no further. The Windows Update Compliance (Community Edition) workbook has got you covered. Check out the blog and get started today!
If your license level grants you access to Windows Autopatch, Microsoft’s managed service, I highly recommend checking it out. I’ve written a separate blog post about using Autopatch to upgrade your fleet to Windows 11.
The blog is packed with details on getting started, plus new tools and native reports to help you along the way. The post also includes some handy KQL queries for tracking your feature updates. Take a look and get yourself onboard with these new features!
Secure and Easy Autopilot Onboarding
In addition, Intune provides comprehensive management capabilities to ensure devices are secure and easily onboarded as Entra ID-joined using Windows Autopilot, which is essential for a smooth Microsoft 365 Copilot user experience. This setup allows employees to sign in with their Entra ID accounts. It provides secure single sign-on (SSO) access to Microsoft 365 services, including Microsoft 365 Copilot, ensuring both security and productivity are maintained.
We have several blogs helping you getting the most out of Windows Autopilot.
Check out these posts to get your Autopilot game on point— and remember, friends don’t let friends do hybrid autopilot! Let’s keep it smooth and streamlined! Read the amazing trilogy by MVP Ben Withmore and MVP Michael Mardahl to learn everything about Cloud Kerberors Trust and how you can access also on-premises resources from your Entra ID joined devices!
Also, check these valuable blog posts covering some great configurations for your cloud managed Windows 11 devices:
- Manage Windows Hello for Business (WHfB) with Intune to ensure users authenticate in a user-friendly and strong way in their day-to-day operations.
- Remove Built-in Windows 11 apps leveraging a Cloud-Sourced reference file to help you automatically remove different bloatware not suitable for an enterprise endpoint.
- Managing Windows 11 languages and region settings to support your multilanguage modern workforce.
- Automatically set Time Zone for devices provisioned using Windows Autopilot to ensure the local time on the device reflects its location worldwide.
- Delivery Optimization Configuration & Monitoring to save some network bandwidth on your modern managed fleet of devices.
Microsoft OneDrive for Business
With all devices updated to the latest Windows 11 feature update, onboarded as Entra ID-joined using Autopilot, and managed through Microsoft Intune, we’ve knocked out a few key prerequisites for Microsoft 365 Copilot.
Next up—let’s turn our attention to OneDrive for Business. Copilot integrates seamlessly with enterprise OneDrive accounts to collaborate on content, so we must ensure users have it ready, signed in, and properly configured on their freshly set up devices. Let’s get that synced and set for success!
Start Fresh with the Latest OneDrive Client
One of the first challenges you might encounter when setting up a new device or wiping a device via Autopilot is dealing with the OneDrive for Business client. More often than not, the client on the device is an outdated version, which can cause issues with configuration, login, and syncing.
Thankfully, MVP Nickolaj Andersen has shared a helpful Intune Platform script that addresses this.
The script available at MSEndpointMGR GitHub automatically downloads the latest version of the OneDrive setup, replaces the built-in executable, and initiates a per-machine install. This ensures that the latest version of OneDrive is always installed, allowing synchronization to begin immediately without any hiccups.
Ensure Secure and Smooth OneDrive Setup
Once the latest OneDrive client is installed on the device, the next step is ensuring users are correctly signed in and have the correct settings. We achieve this through Intune configurations, using a policy based on the Settings Catalog.
The first priority is ensuring that users are silently signed in to OneDrive using their Windows credentials—these are the Entra ID account established during the device’s Autopilot setup. This step streamlines the sign-in process, allowing users to start using OneDrive immediately without any manual intervention.
Next, we ensure that Windows Known Folders (such as Desktop, Documents, and Pictures) are automatically moved to OneDrive. This is configured to prevent tampering, ensure the folders remain synced and available across devices, and provide users with consistent access to their files.
To optimize storage and network usage, we enable Files On-Demand. With this setting, files are only downloaded when the user opens them, reducing bandwidth consumption, disk space usage, and time during initial setup. This helps speed up the device and avoid unnecessary downloads while still providing users with access to all their files when needed.
Additionally, we configure the OneDrive update ring, ensuring that the application stays updated with the latest features and security improvements.
We also set up sync-health reporting for the OneDrive app, allowing us to monitor its status and quickly address any issues that may arise. MVP Maurice Daly has a separate thorogh post covering this: The curious case of the missing OneDrive sync app health reports – MSEndpointMgr
By implementing these (and even some more) configurations, we create a seamless and efficient OneDrive experience for users, ensuring both ease of use and security while keeping systems optimized for Microsoft 365 Copilot.
Microsoft 365 Apps for Enterprise
When setting up new devices, users first look for the Microsoft 365 Apps for Enterprise—better known as the Office package. This suite includes essential productivity applications like Word, Excel, PowerPoint, and Outlook, which are crucial for daily tasks and, more importantly, a key prerequisite for Microsoft 365 Copilot.
To fully leverage Copilot’s capabilities, organizations must ensure that the latest cloud-connected enterprise versions of these apps are deployed to all employee devices. Keeping them up to date is just as important, as new features and AI enhancements are continuously rolled out. For example, Copilot in Word can suggest content edits in real time, making writing and editing significantly more efficient.
Deploying Microsoft 365 Apps for Enterprise: The Right Way
With Microsoft developing the Windows OS, Microsoft 365 Apps, and Intune, it would seem logical that the built-in application deployment method in Intune would be the best way to distribute Office to endpoints. That assumption, however, would be a mistake!
The Office CSP has caused many deployment failures over the years. Despite its name, “Microsoft 365 Apps for Windows 10 and later” in Intune is just a configuration policy, not an app deployment. It lacks key features like requirements, dependencies, and detection rules and simply instructs Windows to download the Office Deployment Toolkit (ODT) and run setup.exe with the specified configuration.
Thankfully, MVP Jan Ketil Skanke has designed a more efficient deployment method, detailed in a separate blog post: Installing M365 Apps as Win32 App in Intune. Later, MVP Sandy Zeng refined this solution even further, addressing challenges such as preinstalled OEM Office variations that often come with new devices, ensuring a smooth and reliable deployment, handling potential conflicts, and improving installation consistency.
By following these optimized deployment strategies, organizations can ensure a seamless, efficient, and problem-free installation of Microsoft 365 Apps for Enterprise—paving the way for a successful Microsoft 365 Copilot rollout.
Keep Microsoft 365 App for Enterprise Updated
The update channel is critical to enabling Microsoft 365 Copilot. Devices must be on the Current Channel or Monthly Enterprise Channel to access Copilot features. Running outdated or unsupported versions of Office could limit functionality and prevent users from fully utilizing Copilot.
The installation routine outlined earlier uses an XML configuration file that can define the update channel at installation time.
In addition, we create configuration profiles in Microsoft Intune to manage the update channel for Microsoft 365 Apps for Enterprise. If you are on the Windows Autopatch service, you will have a set of policies configured.
Ensure these settings are aligned with the requirements for Microsoft 365 Copilot. While you are at it, also ensure the Microsoft 365 Apps for Enterprise are configured and secured accordingly using the Settings catalog, just as we did at OneDrive for Business.
Monitoring your Microsoft 365 App for Enterprise Health
You should now monitor and keep an eye on your software update level for the Microsoft 365 App. This can be done both in the Microsoft 365 Admin Center and in the Microsoft 365 Apps admin center.
If you want deeper insights and the ability to search across all apps and devices in Intune, consider enhancing Intune inventory with a custom data collector. While Intune’s native logging continues to improve, there are still many scenarios where custom inventory provides valuable, additional insights.
Read up on this in our previous blog posts:
- Enhance Intune Inventory data with Proactive Remediations and Log Analytics
- Application Reliability Monitor with Log Analytics
Microsoft 365 Apps as Mandatory Install During Autopilot?
Few applications are as essential as Microsoft 365 Apps for Enterprise when setting up a new device. For many, it’s practically synonymous with starting the workday—because, let’s be honest, what’s a modern workplace without Teams, Word, Excel, Outlook, and PowerPoint?
We’ve already ensured seamless SSO for OneDrive as part of the setup, so why not go further and provide users with their core productivity apps from the start? With the refined deployment method we discussed earlier, this should now be a safe and reliable choice.
The key to making this happen? The Enrollment Status Page (ESP)!
By configuring ESP to wait for Microsoft 365 Apps during Autopilot, users get a Copilot-ready-to-work device right out of the box—no awkward delays, no waiting for Office to install after setup. Just sign in to the computer and get to work!
Microsoft Loop
Microsoft Copilot in Loop is apparently a big thing explicitly mentioned in the prerequisites for Microsoft 365 Copilot.
Microsoft Loop is a cool collaborative canvas that allows the entire team to edit and work on the same objects at the same time, supported by Microsoft 365 Copilot. Let’s, therefore, dive into ensuring this exciting prerequisite is satisfied!
Allow Access to Workspaces in the Microsoft Loop App
Fundamentally, we need to ensure that Microsoft Loop workspaces are available to all organization users. This setting is available from the Microsoft 365 admin center under Settings—Org Settings—Services—Microsoft Loop.
Press Save and enjoy! The loop component should eventually be available in your properly managed endpoints (have you read the previous parts?).
I’ve encountered cases where users were missing the new Loop features in their Microsoft 365 apps, even though everything worked fine in the online versions. The culprit? Their installed apps were on the wrong update channel!
This is a perfect example of why proper Intune configuration matters—it directly impacts end users’ day-to-day experience (and security). Nothing shatters the illusion of a “modern workplace” faster than outdated software that’s missing the latest tools they expect to have.
Bringing Loop to the Desktop – The Missing Piece
Microsoft Loop isn’t just a feature inside Microsoft 365 apps—it can also be a standalone app that deserves its own place on the desktop. To give users the full Loop experience, we must deploy the Microsoft Loop app from the new Microsoft Store using Intune.
With Microsoft Store apps now natively manageable in Intune, distributing Loop is easier than ever—there is no messy packaging, no manual updates, just seamless deployment. By pushing Loop as a dedicated app, we ensure users can access their shared workspaces and components effortlessly.
A modern workplace deserves modern tools, and Microsoft Loop is a key player in making that happen.
By adding a Settings Catalog configuration, we can now also ensure the Microsoft Loop app from the Microsoft Store app is updated.
Wrapping It Up – Getting Copilot-Ready with Intune
We’ve covered the steps needed to prepare your devices for Microsoft 365 Copilot using Microsoft Intune—from Windows 11 upgrades and Entra ID onboarding with Autopilt to deploying Microsoft 365 Apps, Loop, and OneDrive with the right configurations. We’ve also fine-tuned update channels, tackled smart licensing, and ensured efficient app distribution to create a seamless user experience.
A key part of this setup is ensuring users sign in with their licensed Entra ID accounts, enabling secure Single Sign-On (SSO) to Microsoft 365 services, including Copilot. This simplifies authentication and reinforces security by keeping everything within the Microsoft Cloud ecosystem.
Microsoft 365 Copilot is a game-changer—but only if your devices are ready to support it. A well-prepared environment ensures seamless AI integration, secure access to data, and a frustration-free user experience.
Now it’s time to review your Intune configurations, optimize deployments, and ensure your organization is truly Copilot-ready. Hopefully, your governance team has wrapped up their work, and the data side is all set… right?🤯
Recast Software
Ben Whitmore
Add comment