Copilot readiness
Copilot can only show people what they already have access to, and in most tenants that is far more than anyone intended. Before it is switched on we check SharePoint and OneDrive sharing, stale guest access, sensitivity labels, Purview retention and the sites nobody owns any more. You get a short report of what Copilot would surface today, the fixes in order, and a pilot group plan. If you have already switched it on, we check what it can see and tighten it.
What we automate
| Workflow | What it does |
|---|---|
| Joiners | Account, licence, groups, device enrolment and a welcome note from one form or one HR row, the same way every time. |
| Leavers | Sign out everywhere, mailbox converted, files handed over, licence freed, devices wiped or retired, all within the hour of the request. |
| Licence cleanup | Unused and duplicate licences found every month and reported with the cost, or removed on approval. |
| Drift and compliance checks | Conditional Access, Intune and Defender settings compared with the baseline and the differences posted to a Teams channel. |
| Monthly reports | Device compliance, patch status, MFA coverage and Secure Score pulled automatically into a report a director can read. |
| Ticket enrichment | New requests tagged, enriched with the user's device and sign in state, and routed, so the first reply is the useful one. |
How it is built
Power Automate and Logic Apps for the flows, the Microsoft Graph API and PowerShell for the heavy lifting, Azure Automation where something has to run on a schedule. Everything runs inside your tenant under an app registration with the least permission that works, so every action lands in your own audit log and nothing depends on us staying around. Each workflow is documented, tested on a pilot group and handed over with a runbook your team owns.
What it costs
Each workflow is scoped and quoted as a fixed price before work starts, with the outcome, the price and the date in writing. Copilot readiness is quoted the same way. Workflows built by EndKeep are maintained inside Managed Intune at no extra charge.
What it is not
We do not build chatbots, custom models or anything that needs your data to leave your tenant. If a tool outside Microsoft 365 is the right answer we will say so and stay out of the way.