For your IT provider

AI setup checklist for Pendray Voss Custom Homes Ltd.

Your client is planning to start using AI and asked us to share these setup steps. The account and access steps line up with the Canadian Centre for Cyber Security's baseline controls. The order is ours: accounts first, then sensitive data, then the AI tool. You approve the accounts and connections.

Email to IT

Email and files (their answer): Microsoft 365
Two-step sign-in today (their answer): Some people
Data sensitivity (from their answers): Some sensitive data

1Accounts first

Two-step sign-in (MFA) for every account: security defaults in Microsoft Entra (Entra ID > Overview > Properties), or Conditional Access with Entra ID P1 or P2. Security defaults block older sign-in methods, so check copier scan-to-email and old mail apps first.
Strong, unique passwords, kept in a password manager.
A short phishing refresher for everyone before AI connects to email.

2Know what's sensitive and where it lives

Tidy who can open what in SharePoint and OneDrive, including old sharing links. Microsoft says Copilot only shows each person what they can already open, so permissions decide what it sees.
The company will give you a short list of what AI must never see, such as staff records and bank or card numbers. Keep those where AI connections don't reach, and test it with a quick search.
Give restricted files their own SharePoint site with tight membership. Where licensed, Restricted Content Discovery limits what Copilot surfaces from that site; membership is still the lock.

3Then the AI tool

A business AI plan or workspace the company owns, with people signed in on work accounts. Microsoft, Google, OpenAI and Anthropic each say business data isn't used to train their AI models by default. On any personal plan, turn training off. Move work out of personal AI accounts into it.
Admin approval before anyone connects an AI app to email or files: in Microsoft Entra, Enterprise apps > Consent and permissions > User consent settings, choose "Do not allow user consent" and turn on admin consent requests. Apps already connected stay connected, so review them under Enterprise apps > All applications and remove AI apps nobody approved.
Send and edit permissions off to start, where the tool allows it. AI prepares drafts and a person sends. Confirm the connection itself has no send or edit permission; telling the AI not to send is not enough.
Check where each AI tool stores and processes data, for the exact plan, in the vendor's own terms. Microsoft storage follows the tenant's data location, set at sign-up (admin center > Settings > Org settings > Organization profile > Data location). Microsoft says Copilot queries can be processed in other regions.
Add AI accounts and connected apps to your offboarding steps, so access ends the day someone leaves.

Microsoft settings checked against Microsoft's admin documentation, October 2026.

Email to IT