Charge a fixed fee by user count: about $1,800 to $2,800 for up to 25 users, $3,800 to $5,900 for 26 to 100, and $6,900 to $10,700 for 101 to 300. Include a licence and prerequisite check, a sampled permissions review, ranked findings and a go or no-go report. Quote remediation separately.
Those bands come from hours at a $150 rate, cross-checked against two published anchors: a $4,950 review from one partner and a $5,000 to $15,000 range in a vendor's MSP programme. Microsoft's documentation now calls Microsoft 365 Copilot simply Microsoft Copilot, and it ships a free readiness report. That report lists licences, update channels and usage, and says nothing about who can open the payroll folder, which is what clients pay an assessment to find out.
What Microsoft's free readiness report covers, and what it leaves out
Know the free report before you price anything, because the client will have seen it. In the Microsoft 365 admin center choose Reports, then Usage, then under Reports select Microsoft Copilot and Copilot. The Readiness tab opens first and the Usage tab holds adoption data. Microsoft says the report is available within 72 hours and its usage data can lag by up to 72 hours.
Over the past 28 days the Readiness tab counts total prerequisite licences, users on an eligible update channel (Current Channel or Monthly Enterprise Channel), assigned Copilot licences and available licences. Recommended-action cards suggest moving users to a monthly channel and assigning licences. The user table shows, per person, whether a licence is assigned, whether their devices are on an eligible channel, and whether they used Teams meetings, Teams chat, Outlook email or Office docs in the past 30 days. A "Suggested candidate for Copilot" column flags the top 25% of unlicensed users by app usage each week, and the table exports to CSV. User names are concealed by default; a Global Administrator can untick "Conceal user, group, and site names in all reports" under Settings, Org Settings, Reports.
What it leaves out is the work you sell. It does not examine permissions, sharing links, sensitivity labels, Conditional Access, meeting transcription settings, network allow-lists or mailbox types. Microsoft's requirements page asks for a Microsoft Entra account, an Exchange Online mailbox for mailbox-based features, supported Microsoft 365 apps, and network access to the whole cloud.microsoft domain with working WebSocket connections. It calls a secure and governed data foundation recommended rather than required. The gap between required and recommended is your product.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowFive deliverables, and the work you leave out of the fixed fee
A client should be able to point at what they bought. These five cover it:
- Licence and prerequisite table. One row per user group: base licence, Copilot eligibility, update channel, mailbox type, OneDrive provisioned, and which licences to buy first.
- Data-access findings. A ranked list of overshared sites and folders, each with evidence: a report row, a screenshot or a sampled prompt result.
- Identity, device and network gaps. Multi-factor coverage, Conditional Access holes, devices on the wrong update channel, blocked endpoints.
- Pilot and licence recommendation. Who gets licences first and why, with the licence family compared. The tutorial on Business versus Enterprise Copilot pricing covers that choice from the buyer's side.
- Readiness report. A go, conditional go or no-go view, a remediation estimate and a timeline.
The published examples agree on what stays out. IT Partner's listing at $4,950 for one to two weeks names a readiness report with an executive briefing, a risk-ranked findings inventory with evidence and limitations, a remediation and pilot-safeguard roadmap, a licensing and target-user recommendation, and a go or no-go view. Its exclusions are buying or assigning licences, deployment and adoption work, carrying out the remediation, full tenant-wide content classification, legal review, custom scripts and ongoing monitoring. It also says the review "does not read every file or guarantee a risk-free rollout". EPC Group's fixed-fee accelerator runs four weeks for a single tenant and six for multi-tenant or hybrid set-ups, publishes no price ("quoted after a 30-minute scoping call") and likewise excludes remediation and licence purchase.
Copy that honesty about sampling. A fixed fee covers a defined review, and the report should say what was sampled and what was not. The readiness checklist for small businesses is the client-side view of the same ground, and worth sending ahead of the kick-off call.
Scope tiers by user count, with the hours behind each price
User count is a blunt proxy for effort, but it is the one clients understand. The tiers stop at 300 because Copilot Business is sold to customers on Microsoft's Business plans, which cover up to 300 users; above that, scope it as a project after a discovery call. Each price is the base hours at $150 an hour plus 10% for contingency, rounded; the band runs from a tidy tenant (90% of base hours) to a messy one (140%).
| Tier | Users | Base hours | Price band | Point price |
|---|---|---|---|---|
| Small | Up to 25 | 13.5 | $1,800 to $2,800 | $2,250 |
| Mid | 26 to 100 | 28 | $3,800 to $5,900 | $4,600 |
| Large | 101 to 300 | 51 | $6,900 to $10,700 | $8,400 |
The mid tier sits beside the $4,950 published review and the top of the large tier sits inside the $5,000 to $15,000 range from a vendor's MSP programme. That programme page is marketing aimed at MSPs, and it does not say what the client price covers, so treat it as one data point. Now the hours by task:
| Task | Small | Mid | Large |
|---|---|---|---|
| Scoping call and access set-up | 1.5 | 2 | 3 |
| Licence and prerequisite review: readiness report, Entra accounts, mailboxes, update channels, Teams recording settings | 2 | 3 | 5 |
| Identity and device checks: multi-factor coverage, Conditional Access, device channels | 1.5 | 3 | 6 |
| Network and endpoint checks | 0.5 | 1 | 2 |
| Data-access and permissions review, including sampled prompts | 3 | 8 | 16 |
| Labels, data loss prevention and retention check | 0.5 | 2 | 4 |
| Use-case and licence-targeting workshop | 1.5 | 3 | 5 |
| Report and readout | 3 | 6 | 10 |
| Total | 13.5 | 28 | 51 |
Adjust the hours, not the logic, when the tenant is unusual. These are my planning figures, not Microsoft's: add about 3 hours for every 10 externally shared sites you must look at, 2 to 4 hours for hybrid identity, and 4 hours when the client has more than 100 SharePoint sites, because the sample has to grow with them. Subtract nothing for a client who says the tenant is tidy. A tidy tenant is the band's low end, and you only learn it is tidy by looking.
The permissions review: which reports to run and what to record
This is the biggest block of hours and the part clients cannot do themselves. Microsoft's SharePoint admin center has data access governance reports for it. Work through them in this order.
- Confirm your access. You need the SharePoint Administrator role, or the SharePoint Advanced Management Administrator role for the extra governance features. In the SharePoint admin center, expand Reports and look for Data access governance before you quote.
- Run "Site permissions across your organization". It is a snapshot of permissions across every SharePoint and OneDrive site, and Microsoft marks it as the recommended first report. Sort for the broadest access: thousands of users, external guests, "Everyone except external users".
- Run the special-groups report. The "Sites and files shared via special SharePoint groups" report names folders and files that are effectively public through "Everyone except external users" or "Everyone".
- Run the two activity reports. "Sharing links" and "Shared with 'Everyone except external users'" cover the last 28 days and show where sharing is growing.
- Add labels if the client has E5. The "Sensitivity label applied to files" report is listed as needing E5 or G5.
- Check Purview if it is licensed. Its data risk assessments include a default one that runs weekly for the top 100 SharePoint sites by usage, and Microsoft notes a four-day delay before the first results show. That detail comes from the classic DSPM for AI article, which Microsoft says a newer experience is replacing, so check the current portal.
- Sample prompts as a test user. Covered below.
The licensing wrinkle belongs in your quote. Microsoft's features page says these governance features come when at least one user in the organisation has a Copilot licence, or via the SharePoint Advanced Management Plan 1 add-on or Microsoft 365 E7, and it describes that for enterprise and business commercial customers. Its prerequisites page lists Office 365 E3, E5 and A5 and Microsoft 365 E1, E3, E5 and A5 as base subscriptions without naming the Business plans. Where two pages read differently, open the menu in the client's tenant first. If it is missing, a trial or a single licence assigned to the tester can switch the features on. Microsoft's partner announcements describe Copilot in 30, a 25-user, 30-day Copilot Business trial that resellers can set up for organisations with fewer than 300 employees, and Copilot Business's own one-month trial converts to a paid subscription automatically, so diarise the end date the day you start either.
Microsoft names the fixes you can then quote separately: restricted access control to limit a site to a security group, site access review to ask site owners to confirm permissions, restricted content discovery to keep chosen sites out of what Copilot can surface, and data loss prevention policies keyed to sensitivity labels. Each is remediation, not assessment, and the report should say so.
The sampled-prompt test is where an assessment stops being a report export. With the client's written agreement, sign in as an ordinary user with typical access, ask a short list of questions across departments, and log what surfaces. Copilot only returns what the signed-in user can already open, so any hit is an access problem rather than a Copilot problem. Record titles only; do not open or copy the content, and stop and tell the client if something sensitive appears. Illustrative log for a mid-sized client:
| Prompt | Area tested | Result | Rating |
|---|---|---|---|
| Summarise recent documents about staff pay reviews | HR | Returned the title of a file in a managers' folder shared with all internal users | High |
| Find contracts that mention exclusivity | Legal | Three contract titles from one site with broad internal access | High |
| What did the last board meeting decide? | Leadership | Nothing relevant returned | None |
| List supplier price lists from this year | Purchasing | Two price lists, as expected for a purchasing user | None |
A worked quote: a 68-user print shop
Take a print shop with 68 users, 14 SharePoint sites, three of them shared with outside suppliers, and a Microsoft 365 Business Premium tenant. It lands in the mid tier. The hours: scoping 2, licence review 3, identity and device checks 3, network 1, permissions review 9 (the base 8, plus one for the externally shared sites), labels and data loss prevention 2, workshop 3, report 6. That is 29 hours, so $4,350 at $150 an hour, or $4,785 with the 10% contingency. The quote goes out at a fixed $4,800.
The internal view matters too. At an illustrative $65 an hour of loaded technician cost, 29 hours costs $1,885, leaving $2,915 of margin (60.7%). Suppose an assistant trims the report from 6 hours to 3.5, a saving of 2.5 hours: cost falls to $1,722.50 and margin rises to $3,077.50 (64.1%). The client pays the same fixed fee either way, which is why the saving belongs in your margin and not in a discount.
The findings table is what the client actually reads. Illustrative rows from this assessment:
| ID | Rating | Evidence | Fix | Remediation estimate |
|---|---|---|---|---|
| F-01 | High | The finance archive site grants "Everyone except external users" read access; a sampled pay-review prompt returned a title from it | Replace the broad group with the finance group; owner to confirm | 1 hour |
| F-02 | Medium | Readiness tab: 21 of 68 users are not on an eligible update channel | Change the update channel by policy for those devices | 2 hours |
| F-03 | Medium | Teams meeting transcription is off, so recap features have nothing to work from after a meeting | Enable transcription for the pilot group | 0.5 hours |
| F-04 | Medium | Sharing-links report: three sites shared with outside suppliers have "Anyone" links created in the last 28 days | Replace with named-guest links and set expiry | 1.5 hours |
Notice that the remediation estimates total 5 hours, and none of them is in the $4,800. That is the second quote. For the clean-up work itself, the tutorial on cleaning up SharePoint permissions before Copilot shows the owner-facing version of F-01 and F-04.
Where AI earns time in an assessment, and what to guard
Four jobs suit an assistant: turning exported report rows into a ranked draft of findings, writing the plain-English version of each finding for the site owner, drafting the sampled-prompt list per department, and producing the first draft of the owner summary. The judgement stays with you: the rating of each finding, what the sample proves, and what you recommend. Here is an illustrative prompt for the summary, run on the four findings above.
You are helping an IT provider write a Copilot readiness summary for a client's owner. Write 110 to 130 words in plain English from the findings table below.
Rules: use only facts in the table; do not state a finding as certain if the evidence says "sampled"; give counts exactly as written; end with the actions to do first, ordered by rating.
[paste the four findings rows, with site names replaced by IDs]A usable reply says that one finance site can be read by every internal user and that a test question about pay reviews returned a file title from it; that 21 of 68 users are on an update channel Copilot does not support; that meeting transcription is off; and that three supplier-shared sites have open links created in the last 28 days. It ends by ordering the fixes: the finance site, then the supplier links, then the update channel, about five hours in total, quoted separately.
The first run needed two corrections. It wrote that "every employee can read payroll files", which overstated the evidence: the site is open to all internal users and one sampled prompt returned a title. The "sampled" rule fixed that. It also said "five sites" had open links, a number that appeared nowhere, so check every count against the table before the summary leaves your desk.
Three guard rails belong in the engagement terms. First, client data: site names and file titles can be sensitive, so agree which assistant you use, on a business plan, and what goes into it. Second, strip identities: the readiness export carries user principal names, so remove them and refer to sites by ID. Third, accountability: a named engineer reads the final report and signs it, whatever drafted it. If a buyer is comparing you with an AI-only consultant, the buyer's guide to hiring a Microsoft 365 partner shows the questions they will ask.
What to quote on top, and how to credit the fee
The assessment is the first of four lines. Remediation comes second, quoted from the findings table at your normal rate or as fixed packages per finding. Pilot support is third. Ongoing governance is fourth: Microsoft's guidance suggests running the snapshot reports quarterly and the activity reports monthly, which gives you a natural cadence for a recurring review, and the published listing above treats continuing governance as an optional extra-cost add-on.
A commercial tactic I would use: credit half the assessment fee against the remediation quote if the client signs within 45 days. It keeps the assessment priced honestly and rewards the clients who act on the findings. The credit is my suggestion, not a market norm.
If you resell the licences, say so in the proposal and read the current reseller terms. Microsoft's page lists Copilot Business at $21 per user per month on an annual subscription, with a first-year promotional price of $18 for annual commitments made between 1 July and 31 December 2026, and it warns that some advanced AI features are billed by usage on top of the licence. Two reseller changes are worth a line in your proposal. Microsoft's partner announcements have moved the date when usage-based billing switches on by default for new Copilot Business licences bought through resellers twice, from 2 November to 1 December 2026 and then to the January to March 2027 quarter, so read the latest Partner Center announcement before you quote. And from 1 December 2026, new Copilot Business offers no longer require a qualifying base subscription, which changes the first row of your licence table. Run the sum for the print shop: 68 users at $21 for twelve months is $17,136 a year, while a 12-seat pilot is $3,024. At the promotional $18 the same figures are $14,688 and $2,592 for the first year. The report's job is to make a pilot-sized first step safe, and to name the conditions for widening it. For how clients judge the return afterwards, see the guide to measuring whether Copilot pays for itself.
Hidden costs in the assessment, and how to cut them
| Hidden cost | Why it happens | How to cut it |
|---|---|---|
| Waiting for reports | The readiness report is available within 72 hours; the first default data risk assessment has a four-day delay; a custom assessment needs at least 48 hours; activity reports without the governance features need data collection switched on, then 24 hours | Start every clock on day one and book the workshop for the end of the first week |
| Access delays | The client has not assigned the SharePoint or compliance roles you need | Send a one-page access checklist five days before kick-off |
| Scope creep | Clients ask you to fix as you go | Write the exclusions into the order and offer the remediation menu at the readout |
| Report rework | Every report is written from a blank page | Keep a template and an assistant-drafted first pass, then edit |
| Trial that turns into a bill | A one-month trial licence used to switch on the reports converts to paid automatically | Diarise the end date the day you assign it |
A final check on the whole proposal: could the client explain, in one sentence, what they get for the fee and what it does not include? If not, the scope is still too loose to quote.
Questions MSPs ask when pricing a Copilot assessment
Should an MSP charge for a Copilot readiness assessment or give it free?
Charge for it, and credit the fee against remediation if the client signs within a set window. A free scan can open a conversation, but it trains clients to expect the sampled permissions review and written findings for nothing, and that review is where most of your hours go. Offer the free readiness report walkthrough as the sales call instead.
How long does a Copilot readiness assessment take?
The hours in the tiers above are 13.5, 28 and 51, but elapsed time is longer. Microsoft says the readiness report can take 72 hours to appear, and the first default data risk assessment has a four-day delay. One published listing quotes one to two weeks, another four weeks for a single tenant. Start the clocks on day one.
Do I need a Copilot licence in the tenant to run the permissions reports?
Usually yes. Microsoft says SharePoint Advanced Management features come when at least one user has a Copilot licence, or with the Plan 1 add-on or Microsoft 365 E7. Its prerequisites page also lists base subscriptions, so open the Data access governance menu in the client's tenant before you promise the reports.
Can I hand the client Microsoft's free readiness report instead?
It is a good first step, and clients will have seen it. But it covers licences, update channels and app usage only. It does not look at permissions, sharing links, labels, Conditional Access, meeting transcription or network access, which decide what Copilot can surface and whether it works at all.
What should the report say if the answer is not yet?
Say ready with conditions, then list each blocker with an owner, an hour estimate and a target date. A go or no-go with evidence beats a vague maybe, and the blocker list becomes your remediation quote. Keep the wording factual: this site is shared with every internal user, and a sampled prompt returned one of its file titles.
Further reads
- How MSPs Use AI to Write Quarterly Business Reviews — Present the findings and the follow-up work in a quarterly review.
- Copilot Chat vs Microsoft 365 Copilot: What Do You Get Free? — What clients already get free before they buy licences.
- How to Roll Out Microsoft 365 Copilot to a Small Team — The client-side rollout your assessment leads into.
- MSP Automation Ideas: Five AI Workflows and Their Set-Up Time — Other AI workflows an MSP can add alongside assessments.
- Does Microsoft 365 Copilot Keep Your Business Data Private? — Answers to the data-privacy questions clients raise first.
- AI Consultant vs Your IT Support Company: Who Should Handle AI? — How buyers decide between an MSP and an AI consultant.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: Microsoft Learn pages on the Copilot readiness report, Copilot requirements and licence options, SharePoint Advanced Management prerequisites, features and data access governance reports, and Purview DSPM for AI; published pages from IT Partner (listing), Cloudiway (MSP programme) and EPC Group; Microsoft's Copilot Business pricing page and Partner Center announcements for July, October and November 2026, read 4 November 2026.