Copilot shelf

The Copilot Hardening Baseline

176 checks across the admin surface Copilot touches, each with the baseline to set and how to prove the current state in your own tenant.

Get it for $199

One-time. Corrections are re-delivered free.

$199 becomes $169.15

15% off until 31 December 2026

HARDEN26

Enter it at checkout, or open the checkout with it already applied.

The free, open-source Copilot prompt library that sits under this work was cited by Jared Spataro (Microsoft, AI at Work) in his 25 February 2026 note. He was citing that free repo when it held 300+ prompts. This is a separate, paid product and he did not review or endorse it.

The situation

Copilot is on, and the settings work that should have come with it did not. Somebody will eventually ask which controls are set, who owns each one, and how you know.

The admin surface is spread across consoles that do not agree with each other, and Microsoft publishes a default for some of it and nothing at all for the rest.

A screenshot of a settings page is not evidence, and a policy document nobody can trace to a tenant state is not a baseline.

What this is

A 307-page guide built as a register rather than a narrative: 176 checks across nine sections, every row carrying an Owner column and an Evidence column so the work can be assigned and proved rather than described.

Where Microsoft publishes a default, the check names it and cites the page it came from. Where Microsoft publishes none, the check says so. Since v1.2 every check is also mapped to the MITRE ATLAS mitigations and techniques that bear on it, to the OWASP Top 10 for LLM Applications 2025, and to the Copilot-relevant recommendations of the CIS Microsoft 365 Foundations Benchmark v7.0.0, with the relation recorded in the row.

It also names what it does not do. Page one lists three CIS v7.0.0 checks it does not yet cover (3.2.3, 3.3.1, 7.2.9), and 42 of the 176 rows have no console path because there is none to give.

What is inside

The 307-page guide: 176 checks across nine sections, each with the baseline to set and how to prove the current state
Foundation and tenant readiness, then the Copilot settings themselves
Agents across three chapters: inventory, tenant policy, and lifecycle
Data protection and oversharing, then consumption and billing controls
The EU chapter, and the durable layer of roles, decision rights and runbooks
The Baseline Advisor agent, and the framework crosswalk mapping every check to MITRE ATLAS, OWASP LLM Top 10 2025 and CIS M365 Foundations v7.0.0
Four policy templates you can put your own letterhead on

Who it is for

M365 administrators who own the tenant-side settings Copilot depends on
Security and risk owners asked which controls are set, by whom, and on what evidence
AI governance leads who need a register a committee can read, not a narrative
Anyone who has to hand an auditor something with an owner against every row

Who it is not for

Anyone who wants software. There is no dashboard, no connector and no automated scan
Anyone expecting a console path for every row. Forty-two of them have none, and the kit says which
Non-Microsoft stacks. This is the Microsoft 365 Copilot admin surface specifically
Legal, compliance or regulatory sign-off, and it is not a live assessment of your tenant

Not sure yet? Start free.

The Copilot Rollout Readiness Scorecard is free and covers the same ground at a smaller scale. If it is useful, this is the full version.

Get The Copilot Rollout Readiness Scorecard

Questions people actually ask

What does the licence actually cover?

One licence, organisation-wide: as many of your own people as you like, on your own Microsoft 365 tenants, with no seat count. It covers the legal entity that pays. A group of separate legal entities is not one organisation, so it does not reach a parent, subsidiaries or sister companies; write before you buy for a group. It does not cover work you do for somebody else: no resale, no delivering it as paid training or consulting outside your own organisation, and it does not reach client tenants you administer.

The settings move. What happens when they do?

The baseline is stamped August 2026 and the commitment is two refreshed editions a year at no additional cost for as long as the kit is on sale. Article 8 of the Terms is what binds that, not a sentence on a sales page. A refreshed edition re-reads the checks that RISKS.md marks volatile and re-stamps what moved; it is not a rewrite of the whole kit.

Does it cover everything in CIS?

No, and it says so on page one. Three CIS v7.0.0 checks are named as not yet covered: 3.2.3, 3.3.1 and 7.2.9. On 1 Sep 2026 this listing still promised a console path for all 176 checks while the register said 42 rows have none; that clause was cut the same day. Both corrections are in the public What Broke log.

Buying this with a company card?

Your receipt email carries a Generate link that opens an invoice generator: add your billing address, put your legal company name and any reference your finance team needs in the Additional notes box, and download the PDF. If you have an EU VAT number, enter it at checkout and no VAT is charged. Here is the approval email, so you do not have to write one.

Approval email

Subject: Approval request: The Copilot Hardening Baseline ($199, one-time)

Hi [Manager],

I would like to expense a one-time $199 purchase: The Copilot Hardening Baseline by Kesslernity.

What it is: 176 checks across the admin surface Copilot touches, each with the baseline to set and how to prove the current state in your own tenant.

What we get:
- The 307-page guide: 176 checks across nine sections, each with the baseline to set and how to prove the current state
- Foundation and tenant readiness, then the Copilot settings themselves
- Agents across three chapters: inventory, tenant policy, and lifecycle
- Data protection and oversharing, then consumption and billing controls

Why it is worth it: it is a one-time purchase with no subscription,
and it replaces work we would otherwise scope, build and maintain ourselves.
The author publishes the open-source Copilot prompt library that Microsoft's
CMO for AI at Work cited as "battle-tested in production environments".

A downloadable invoice is available from the purchase receipt for expenses.

[Your name]