The Quiet Value of AI as a Watchdog

Cartoon of a person at a desk with a watchdog dog watching over documents

Most of the AI talk I hear is about speed. Draft faster. Summarise faster. Clear the backlog faster. Fair enough — I use that side of it every day. What I talk about less, and what I think is underrated, is the other job AI is quietly good at: sitting beside the work and barking when something looks off.

A watchdog doesn’t write the proposal for you. It notices the clause that drifted from your standard, the share link that went wider than it should, the meeting decision that never made it into the record. In a Microsoft 365 world, that kind of attention is where a lot of real risk and rework lives.

Speed without a second set of eyes

I’ve sat with founders and MSP leads who are thrilled that Copilot in Word or Outlook gets them to a first draft in minutes. Then I ask what catches the miss — the wrong customer name left in a template, the permission that opened a SharePoint library to “everyone”, the Teams reply that promised something Finance never agreed to.

Often the answer is still “me, later, if I have time.” That’s not a process. That’s hope with a calendar invite.

Copilot can help you produce more. Without a watchdog habit, you also produce more chances to ship a quiet mistake.

What “watchdog” looks like in the flow of work

I’m not talking about a sci-fi control room. I mean small, repeatable checks inside the tools people already open.

Before a sensitive Word doc leaves the building, ask Copilot to compare it against the last approved version or the policy page you keep in SharePoint — not for prose polish, for drift. Before you hit send in Outlook, have it flag attachments, recipients, or wording that doesn’t match how your organisation usually handles that kind of mail. In Teams, use meeting recap and action capture so “we decided X” doesn’t evaporate, then spot when the follow-up never landed in Planner or the channel.

On the governance side, Microsoft Purview and the sharing reports in SharePoint and OneDrive are the boring cousins of the same idea. AI that helps you see oversharing, odd access, or content that shouldn’t sit in a public Team is doing watchdog work — even when the interface looks like a report, not a chat.

The point isn’t to automate judgment away. It’s to put a consistent second pass in front of human judgment, every time, not only on the days when someone remembers.

The value shows up as fewer ugly surprises

The payoff is rarely a dramatic dashboard. It’s the near-miss you never have to explain to a client. It’s the junior who doesn’t learn the hard way because the check caught the loose link. It’s the founder who stops being the only person who “just knows” something felt wrong in a draft.

I’ve started treating Copilot less like a typist and more like a colleague whose job is to ask, “Are you sure about this bit?” That shift changes what I ask it to do. Fewer “write me a long email.” More “what in this draft conflicts with our standard terms?” More “summarise what we committed to in that Teams meeting and what still has no owner.”

If your AI stack only makes you faster, you’re using half of it. The quieter half — the watchdog — is what keeps the extra speed from multiplying the mess. Build that habit into Outlook, Word, Teams, and SharePoint, and you get something rarer than another productivity tip: confidence that someone, or something, is actually watching the work while it moves.

ConnectWise Breach: Proving What an App Did with Microsoft Graph Activity Logs

IT security analyst tracing activity across glowing monitors in a dark operations room

The ConnectWise supply-chain attack on Microsoft 365 tenants has raised a question I keep hearing from MSPs: if an attacker’s app signed in to a tenant, how do you prove what it did, or didn’t, do?

The honest answer is that Microsoft doesn’t publish one definitive list of “Graph activity that isn’t in the UAL”. What it does document is which log records what. Put those side by side and the gaps become clear. I’ll cover what each log tells you, where the blind spots are, how to switch on Microsoft Graph activity logs, and how to scope the blast radius if you didn’t have them on.

What GCIT showed

Credit to Elliot and the team at GCIT, whose write-up of the ConnectWise Cloud Backup compromise is a model of how to be open about an incident. Their tenant had one successful service principal sign-in from the Cloud Backup app (15 Oct, 144.172.64.128, Python user agent). They proved nothing was done with that token by matching its identifier against 13,682 requests in their Microsoft Graph activity logs. The UAL on its own could never have proved that. They also note that Graph activity logs need Entra ID P1 and have to be switched on before the event.

The three logs and what each one tells you

  • Sign-in logs (service principal and managed identity sign-ins are kept separately from interactive sign-ins) tell you that a token was issued, and from where. They don’t tell you what was done with it. One sign-in can mean hundreds of API calls, or none at all, as GCIT found. Retention is 7 days on Entra ID Free and 30 days on P1/P2, so export them. https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention
  • The unified audit log records audited actions in each workload. It isn’t a record of every API request. A good example is mail: MailItemsAccessed covers all protocols, including REST/Graph and EWS, but it’s only on by default for E3/E5 users. Check your mailbox audit configuration everywhere else. Bind accesses are also aggregated and de-duplicated. https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts
  • Microsoft Graph activity logs (MicrosoftGraphActivityLogs) record every HTTP request Graph processes for your tenant: app ID, service principal, IP, request URI, method, response size, and the token and sign-in identifiers. That’s what lets you join requests to sign-ins. They need Entra ID P1 or P2 and a diagnostic setting that sends them to Log Analytics, Storage or Event Hub. They aren’t retroactive, and delivery usually takes up to 30 minutes, occasionally 2 hours. https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

So where are the blind spots?

Anything read through Graph that the workload doesn’t audit as an action, such as directory and user reads, will only show up in Graph activity logs. And full_access_as_app over EWS isn’t Graph at all, so it won’t appear in Graph activity logs. It would only appear in mailbox auditing. If you don’t have Graph activity logs turned on, “sign-in but no UAL entries” doesn’t prove nothing happened. It means you can’t tell.

On audit retention: Audit Standard is 180 days. Audit Premium (E5) keeps Exchange, SharePoint, OneDrive and Entra records for one year, and up to 10 years with the add-on. https://learn.microsoft.com/en-us/purview/audit-log-retention-policies

What an attacker could do without Graph activity logs

The short answer is anything the app’s granted permissions allow. Without Graph activity logs, most read-only activity leaves no trace at all.

Likely to leave no trace (reads)

  • Directory reconnaissance: listing users, groups, admin role holders, devices, apps, Conditional Access policies and licences (Directory.Read.All, Policy.Read.All). Reads like these aren’t recorded in the UAL, which makes them perfect for mapping a tenant before a bigger attack.
  • Org intel: org charts, managers, phone numbers and email addresses, all useful for phishing and business email compromise.
  • Teams/chat and calendar reads, and some file reads, depending on permissions and audit coverage. SharePoint and OneDrive FileAccessed events usually do appear in the UAL, but bulk reads by an app can be patchy.

Probably visible, if auditing was on

  • Mail reads (Mail.Read): these show as MailItemsAccessed, but only if mailbox auditing records that action for the affected mailboxes. If it doesn’t, they’re invisible.
  • Writes and changes: sending mail, creating inbox rules, adding app credentials or owners, consenting to new apps, creating users or changing roles, and changing CA policies. These normally appear in the Entra audit log or the UAL, because they’re audited actions rather than reads.

What actually determines the blast radius

  1. The app’s application permissions. Check Enterprise applications > the app > Permissions. Something like Mail.Read or Files.Read.All is tenant-wide.
  2. The service principal sign-ins: times, IP addresses and how many tokens were issued.
  3. The Entra audit log: look for any new credentials, owners or consents on that or other apps, which would show persistence.

The honest bottom line is that without Graph activity logs, a sign-in followed by no UAL entries means you can’t prove what was read. Treat anything that app could read as potentially exposed, rotate its secrets, and remove or scope down its permissions. Then turn on Graph activity logs so next time you can prove it either way.

How to turn on Microsoft Graph activity logs

It takes about 10 minutes per tenant.

Before you start

  • Licensing: Microsoft Entra ID P1 or P2 in the tenant (Business Premium includes P1).
  • Role: Security Administrator is the least privileged Entra role Microsoft supports for creating diagnostic settings. You also need Azure rights on the destination.
  • An Azure subscription with a destination that already exists: a Log Analytics workspace (best for querying), a storage account (cheap long-term archive) or an Event Hub (to stream to a third-party SIEM).
  • Cost: P1 doesn’t cover the Azure side, so you pay for what you ingest and store. Microsoft’s rough guide is about 15 GiB a month into Log Analytics per 1,000 users, but it varies a lot with the apps in the tenant. Check the Azure Monitor pricing page and consider a workspace transformation or the Basic table plan to cut costs.
  • The logs are NOT retroactive. You only see activity from the moment you switch them on, so do it before you need them.

Step 1: Create a Log Analytics workspace

  1. In the Azure portal, go to Log Analytics workspaces > Create.
  2. Pick the subscription, a resource group, a name and a region, then Review + Create.

Step 2: Turn on the diagnostic setting (GUI)

  1. Sign in to the Microsoft Entra admin centre as at least a Security Administrator.
  2. Browse to Entra ID > Monitoring & health > Diagnostic settings.
  3. Select Add diagnostic setting and give it a name.
  4. Tick MicrosoftGraphActivityLogs. While you’re there, also tick ServicePrincipalSignInLogs, SignInLogs and AuditLogs, so you can correlate them.
  5. Tick Send to Log Analytics workspace and choose your subscription and workspace.
  6. Save.

Step 2 (alternative): PowerShell

There’s no dedicated Entra cmdlet for this. New-AzDiagnosticSetting targets Azure resources, not the tenant. Instead, you PUT to the Azure Resource Manager endpoint for microsoft.aadiam/diagnosticSettings with Invoke-AzRestMethod:

Connect-AzAccount
$ws = "/subscriptions/<SUB-ID>/resourceGroups/<RG>/providers/Microsoft.OperationalInsights/workspaces/<WORKSPACE>"
$body = @{
properties = @{
workspaceId = $ws
logs = @(
@{ category = "MicrosoftGraphActivityLogs"; enabled = $true },
@{ category = "ServicePrincipalSignInLogs"; enabled = $true }
)
}
} | ConvertTo-Json -Depth 5
Invoke-AzRestMethod -Method PUT -Payload $body `
-Uri "https://management.azure.com/providers/microsoft.aadiam/diagnosticSettings/GraphActivity?api-version=2017-04-01"

The Azure CLI equivalent is az rest --method put --url "<same URL>" --body @body.json.

Step 3: Check it’s working

Microsoft says delivery is usually within 30 minutes, but allow time for the table to first appear (Entra’s docs allow up to three days). Then run:

MicrosoftGraphActivityLogs
| where TimeGenerated > ago(1d)
| summarize Requests = count() by AppId, ServicePrincipalId
| sort by Requests desc

To tie Graph calls back to a service principal sign-in, which is exactly the GCIT approach:

MicrosoftGraphActivityLogs
| where TimeGenerated > ago(7d)
| join kind=leftouter (AADServicePrincipalSignInLogs | where TimeGenerated > ago(7d))
on $left.SignInActivityId == $right.UniqueTokenIdentifier
| project TimeGenerated, AppId, ServicePrincipalName, IPAddress, RequestMethod, RequestUri, ResponseStatusCode

Tips

  • Set retention on the workspace (or per table) to suit your incident response needs. If you need it for years, also archive to storage.
  • Do this per customer tenant. A Graph activity log only covers the resource tenant, so you won’t see a multitenant app’s activity in other tenants.
  • Diagnostic settings can’t filter Graph logs. Use a workspace transformation if volume is an issue.

References: Graph activity logs overview and Configure Entra diagnostic settings.

What I’d do today, with the tools we have

  1. Turn on Graph activity logs now in every tenant with P1 (Business Premium has it). It’s cheap insurance.
  2. Export sign-in logs, including service principal sign-ins, beyond 30 days.
  3. Confirm MailItemsAccessed is being audited on every mailbox.
  4. Cut app permissions down. Use Exchange RBAC for Applications and Sites.Selected instead of tenant-wide Mail.* and Sites.* grants. https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac
  5. Use Defender for Cloud Apps app governance where you have it, so you get alerts on unusual app behaviour. https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-manage-app-governance

Shared responsibility

This is the shared responsibility point again. The vendor protects its credential, Microsoft provides the logs, and we as MSPs own the decision to let that app in, which means having the logging on before we need it. My cw-skykick-exposure-check.ps1 script will help you with the exposure side. Graph activity logs are what answer “what did it actually touch?”

Why Your Next Sales Experience Should Feel Like an Open Home

image

Nobody wants to sit across a desk from a real estate agent for a private appointment.

The reason is obvious. You know what they want. They know you know what they want. Every question feels like it has a destination, and that destination is a contract.

Now compare that with an open home. Same agent. Same property. Same commercial objective. Completely different experience.

You can walk in without committing to anything. Other people are moving through the rooms. You can inspect the kitchen, look inside a cupboard, ask about the neighbourhood, or simply nod politely and leave. The buyer has control.

That difference matters well beyond real estate.

People resist pressure, not information

Many businesses still design customer engagement like a private sales appointment. Book a discovery call. Sit through a presentation. Explain your budget. Tell us who makes the decision. Agree to the next meeting before this one ends.

The business calls it a process. The customer experiences it as pressure.

Most buyers are not avoiding information. They are avoiding a situation in which every question becomes a buying signal. They want room to learn without being chased.

An open home works because participation can be light. Someone can be curious without declaring intent. They can observe other people asking questions. They can discover what matters to them while they are there. Most importantly, leaving is easy.

Low-friction exits create higher-confidence entrances.

Build the digital equivalent of an open home

I think this is a useful way to rethink how we use Microsoft 365 and Copilot with prospects and clients.

Instead of making every interested person book an appointment, create a place where they can explore. A well-structured Microsoft Teams webinar can let people listen, ask a question in chat, or remain quiet. A SharePoint site can hold practical guides, short demonstrations and answers to common concerns. A Copilot Studio agent can help visitors navigate approved information without forcing them into a sales conversation.

The point is not to remove people from the process. It is to let the customer decide when a person should enter it.

Imagine an MSP running a monthly Microsoft 365 security clinic. There is a short demonstration, a few common configuration mistakes, and an open question period. Attendees are not pushed into individual assessments. Afterward, the presentation and supporting material are available through SharePoint, and questions can be submitted through Teams.

Some people will ask something immediately. Some will return to the material a week later. Some will never make contact. That is fine. The environment still creates value, trust and familiarity.

Give people something to inspect

An open home is useful because there is something tangible to explore. You can test the doors, gauge the room size and notice details that no brochure would reveal.

Business content should work the same way.

Do not just tell people you understand Copilot adoption. Give them a readiness checklist. Show them an anonymised governance example. Let them ask Copilot to summarise a sample policy in Word, then explain what good source material looks like. Make the expertise visible before asking for a commitment.

This also changes the sales conversation. When someone eventually requests a private meeting, they arrive with context. They know how you think. They have already examined the cupboards.

The best customer experiences do not trap people in a funnel. They create a useful space, make exploration safe and allow curiosity to do some of the work.

That is what I would build: fewer forced appointments, more open doors.

New script: Check your Microsoft 365 tenants for ConnectWise SkyKick exposure

Security analyst reviewing a Microsoft 365 tenant exposure report in a dark operations room

I’ve just added a new script to my Office365 repository on GitHub: cw-skykick-exposure-check.ps1. It does a read-only check of Microsoft 365 and Entra tenants for signs of exposure to the ConnectWise Cloud Backup (formerly SkyKick) vendor-credential incident, and produces a report you can act on.

If you’re an MSP with ConnectWise or SkyKick apps consented in customer tenants, you want answers quickly and across every tenant, not one portal click at a time. That’s what this is for.

What happened

According to Huntress’s advisory, a Microsoft 365 credential belonging to ConnectWise Cloud Backup was compromised and used on 15 October 2026 (UTC) to obtain Microsoft Graph tokens in customer tenants. Huntress also reports that in at least one tenant a ConnectWise Cloud Management app granted itself Global Administrator and added new secrets to other applications to keep a foothold. ConnectWise has acknowledged the incident. Huntress’s guidance is to disable (not delete) the affected apps, review the credentials on all your applications, and check service principal sign-ins and audit logs.

That review is exactly what the script automates.

What the script checks

For each tenant it runs four checks, then gives a verdict:

  • ConnectWise/SkyKick service principals: matched by seven known app IDs, display name or the ConnectWise owner tenant, with enabled state, directory roles, OAuth2 grants and app role assignments. A match holding a highly privileged role is flagged.
  • Service principal sign-ins since 1 October 2026 for those apps and the published indicator IP addresses, flagging indicator IPs and Python or curl user agents. This needs Entra ID P1 or P2.
  • Directory audit events since 13 October 2026 (role additions, application updates and new service principal credentials), plus a scan of every app registration and service principal for secrets or certificates whose validity starts in that window.
  • Conditional Access exclusions that cover the ConnectWise apps.
  • Verdict: Suspicious, Present-no-activity, Not present, Unknown or Error, with recommended actions.

It is strictly read-only. Every Graph call goes through a wrapper that only issues GET requests, so it never creates, changes, disables or deletes anything. If a check can’t run because of licensing or permissions, it’s reported as Unavailable rather than crashing, and one tenant failing never stops the rest.

How to run it

You’ll need PowerShell 7.4 or later and the Microsoft.Graph.Authentication module, plus read permissions: Application.Read.All, Directory.Read.All, AuditLog.Read.All, RoleManagement.Read.Directory and Policy.Read.All. For a single tenant with an interactive sign-in:

./cw-skykick-exposure-check.ps1 -TenantId contoso.onmicrosoft.com -UseDeviceCode

For many tenants unattended, supply a CSV of TenantId, ClientId and a certificate thumbprint or PFX path, with the PFX password injected through an environment variable. It’s the same certificate-based, app-only approach I described in my recent post on headless connections.

./cw-skykick-exposure-check.ps1 -TenantCsv ./tenants.csv -OutputPath ./reports

Each run writes three reports: a CSV with one summary row per tenant, a detailed JSON file, and a readable HTML report with times in Sydney time.

Read the results carefully

This is an investigation aid, not a forensic verdict. Not present means the checks found none of the configured matches; it doesn’t prove a tenant was never touched. Graph doesn’t expose when a credential was actually created, only when it becomes valid, so confirm every flagged secret or certificate was added by your team. And review the indicators and date windows against the latest advisories before you rely on them.

Get the script

Run it against a test tenant first, then across your customers. If you find a bug, a missed indicator or a way to make it better, let me know. Feedback from people running it in the real world is what makes these scripts better for everyone.

Stop Explaining the Buttons. Start Shaping the Decision.

image

I keep seeing capable consultants publish solid instructional material and then wonder why the sales conversation still moves slowly. The content is accurate. The screenshots are clear. The steps work. Yet the reader takes the free lesson, solves one small problem and disappears.

I do not think the answer is to make another tutorial.

AI has made basic instruction abundant. A prospect can ask Copilot how to create a policy, summarise a document or draft an email and receive a usable starting point in seconds. That does not make expertise worthless. It changes where the value sits.

Information is no longer the scarce part

For years, practical instruction proved competence. If I could show someone exactly how to configure a setting or complete a process, I earned attention and trust. That still has value, particularly when the task is technical or the consequences of a mistake are serious.

But a large catalogue of instructions can also train a prospective client to see my work as a collection of tasks. Tasks are easy to compare. They invite questions about price, speed and whether the client can do it internally.

The more useful content now sits one level above the task. I need to help the reader recognise which problem deserves attention, what a better operating model looks like and why their current approach keeps producing the same result.

That is not withholding knowledge. It is applying judgement.

Show the destination before the directions

Imagine I am speaking with a business that has purchased Microsoft 365 Copilot but is seeing patchy adoption. I could publish another article explaining how to prompt Copilot in Outlook. The reader might try three prompts and move on.

A stronger article would show what changes when a leadership team stops treating Copilot as a writing shortcut and starts using it as part of its management rhythm. Before the Monday meeting, each leader asks Copilot in Outlook to identify commitments buried in email. During the meeting, the team tests those commitments against priorities. Afterwards, responsibilities are captured in Planner rather than left in somebody’s notes.

The valuable lesson is not which button to press. It is the picture of a business that follows through more reliably.

When readers can see that picture, they begin comparing it with their own week. They notice the repeated meetings, lost actions and expensive rework they had previously accepted as normal. I am not merely giving them information. I am helping them form a clearer standard for what good looks like.

Teach judgement, not dependency

There is a line here that matters. I do not want to manufacture anxiety or make people feel incapable without me. Good advisory content should create clarity, not pressure.

I can explain the trade-offs. I can show why a rushed Copilot deployment often becomes a licence exercise, why information quality matters, and why governance needs to sit beside adoption. I can give readers questions that expose gaps in their own approach. I can also be generous with practical guidance.

What I should not do is confuse generosity with publishing every keystroke I know.

My best content helps a buyer understand the decision they are really making. It gives them language for the outcome, a way to recognise risk and confidence that I have travelled this road before. By the time we speak, the conversation is no longer, “Can you show us how?” It is, “Can you help us get there properly?”

That is the shift I am making. AI can produce instructions. My job is to provide perspective, judgement and a destination worth pursuing.

Preparation Should Create Freedom, Not a Cage

image

I can usually tell within the first minute whether someone has done the work. They shuffle through slides, repeat the heading on the screen, and hope the audience will not notice that there is very little underneath it. It has the unmistakable feel of someone trying to explain a story they only skimmed on the way into the room.

The opposite problem is less obvious, but just as damaging. I have also watched capable people arrive with every sentence rehearsed, every possible question anticipated, and every transition locked down. Nothing can go wrong. Unfortunately, nothing particularly alive can happen either.

Good preparation is not about controlling the room. It is about being comfortable enough to respond to it.

Know the destination

When I prepare for a presentation, workshop, or client conversation, I start with the outcome. What should people understand, decide, or do when I finish? If I cannot answer that in one clear sentence, another hour polishing slides will not save me.

This matters even more now that Copilot can produce material so quickly. I can ask Copilot in PowerPoint to help build a first draft from a Word document. I can use Copilot in Outlook to pull the main concerns from an email thread before a client meeting. I can ask Copilot in Teams to summarise the discussion and identify unresolved questions.

That gives me useful raw material. It does not give me judgement.

My job is to decide what matters, what can be removed, and where the conversation needs room to move. The value is not in arriving with the largest pile of notes. The value is in knowing which three ideas must land.

Prepare for movement, not perfection

I prefer to build a presentation around a few strong anchors rather than a memorised script. I want a clear opening, several points I can explain without reading, one or two practical examples, and a firm ending. Between those anchors, I leave space.

That space is where the best work often happens. Someone asks an unexpected question. A client reveals the real concern behind the original brief. A workshop participant connects the idea to a process I have never seen. If I am busy protecting my script, I miss all of that.

A useful test is whether I can explain the core idea without the slides. If the projector fails, the Teams connection drops, or the meeting changes direction, can I still deliver something worthwhile? If the answer is no, I am not prepared. I am dependent on my props.

Use Copilot as a rehearsal partner

One of the better uses of Copilot is not creating more content. It is helping me reduce uncertainty.

I can paste my outline into Copilot in Word and ask it to identify assumptions, weak transitions, or questions a sceptical audience may raise. I can rehearse short answers to those questions. I can ask it to turn a dense paragraph into a cleaner explanation, then rewrite that explanation in my own words.

The aim is not to manufacture a flawless performance. It is to remove the avoidable friction before I walk into the room.

I want enough structure to stay on course and enough confidence to leave the path when the moment demands it. That balance takes discipline because adding one more slide always feels safer. Usually, it is not.

Preparation should make me lighter on my feet. If it makes me more rigid, I have gone too far. The real sign that I am ready is not that I can predict every moment. It is that I can handle the moments I did not predict.

The Best Use of Classroom Time Is Not More Talking

image

I have sat through plenty of training sessions where the instructor spends most of the day explaining concepts, clicking through slides and demonstrating a perfectly prepared example. Everyone nods. The questions are polite. The exercise looks straightforward.

Then people go back to their desks and try it for themselves.

That is when the real learning starts. It is also when the trouble starts.

The difficult part was never hearing the explanation. The difficult part was applying it to a messy situation, making a judgement call and recovering when the first attempt failed. Yet that is often the part we ask people to do alone.

Information Is Not the Scarce Part

The traditional training model made more sense when information was difficult to obtain. The instructor held the knowledge, so the classroom was used to transfer it. Practice came later.

That assumption no longer holds.

Today, I can give participants a short video, a reading, a worked example and a carefully designed Copilot prompt before the session. They can use Copilot in Word to explain an unfamiliar concept in plain language, generate questions from the material or turn their notes into a quick revision guide. They arrive with the basic vocabulary already forming.

That does not make the trainer less important. It makes the trainer available for the work that actually needs a trainer.

Use the Room for Friction

When I have people together, I want to use that time for the awkward bits. I want them comparing approaches, challenging assumptions and learning why an answer that looks convincing may still be wrong.

Imagine a Copilot workshop. Watching me summarise a document is useful, but it is not enough. The valuable exercise is giving participants a realistic SharePoint document set, asking them to produce an executive brief, then examining what Copilot missed, what the sources support and what needs human judgement.

That is where confidence is built. Not from seeing a clean demonstration, but from working through uncertainty with someone nearby who can ask, “What evidence do you have for that?”

The same applies to an MSP learning how to review a Microsoft 365 environment. Reading about Conditional Access can happen beforehand. Classroom time should be spent examining a scenario, spotting the operational risks, deciding what should change first and defending that decision to the group.

Practice should not be the lonely afterthought. It should be the centre of the session.

Copilot Makes the Flipped Model Stronger

Copilot can support both sides of this approach. Before the workshop, it can help participants digest the foundation material and identify where they are unsure. During the workshop, it can act as a working partner inside Teams, Word or Excel while the trainer observes how people frame requests, validate outputs and refine their thinking.

Afterwards, participants can use Copilot to capture what they learned, build a personal checklist and document the decisions made during the exercise. The technology carries the context forward, but it does not replace the shared struggle that made the lesson stick.

For me, this is the point of bringing people together. I do not want to spend valuable live time reading information at them that they could absorb beforehand. I want to be present when the task becomes ambiguous, uncomfortable or prone to error.

If the hardest part of the learning happens after everyone leaves, the session has been designed around the instructor rather than the learner.

Give people the foundations before they arrive. Then use the room for judgement, mistakes, discussion and recovery.

That is not less teaching. It is teaching where it matters most.

Make Your Business Easier to Buy

image

I keep seeing businesses respond to slower sales by adding more sales activity. More calls. Longer proposals. Extra discovery sessions. Another deck. Another sequence of follow-up emails.

I understand the instinct. If buyers are hesitating, surely the answer is to explain more.

I think the opposite is often true.

Many buyers now arrive after doing their own research. They have read your website, watched demonstrations, asked Copilot to compare approaches, checked comments and spoken with people they trust. By the time they contact you, they are not waiting for a grand presentation. They are removing the last few uncertainties before making a decision.

That changes the job.

Remove uncertainty, not autonomy

A capable buyer wants clarity around three practical questions. Does this solve the problem I have? What happens after I say yes? What financial commitment am I making?

Those questions sound simple, yet many businesses hide the answers behind vague promises, gated documents and compulsory sales calls. Pricing becomes “contact us”. Delivery becomes “our proven methodology”. The outcome is wrapped in language that could mean almost anything.

None of that makes the offer more valuable. It makes the decision harder.

I see the same pattern with Microsoft 365 Copilot services. A prospect may already understand what Copilot is. They do not need another tour of artificial intelligence. They need to know whether the engagement improves a specific workflow, what the implementation and adoption process looks like, and what the complete cost will be.

If I answer those points plainly, I am helping them decide. If I bury them under thirty slides, I am protecting my sales process rather than serving their buying process.

Let the buyer set the pace

Modern buyers expect to investigate without being chased. That does not mean they never want advice. It means advice should reduce friction, not create an obstacle.

Imagine an MSP offering a Copilot readiness assessment. A useful page would explain the business problems addressed, show the stages from tenant review to recommendations, state what the customer receives, and provide a clear price or credible range. A short video could show a sample deliverable. A booking link could serve anyone who wants discussion.

The buyer can choose the next step.

The same principle should continue after contact. If a prospect emails a question, I can use Copilot in Outlook to review the thread and draft a concise response addressing the missing information. The important part is not the drafting speed. It is resisting the temptation to turn a direct question into a fresh sales campaign.

Clarity should shorten the distance between interest and action.

Selling less requires better preparation

Making something easy to buy is not passive. It takes more work upstream.

I need a sharply defined offer. I need to know who it is for, what changes for them, how delivery works, what it costs and where the boundaries sit. I need useful proof and straightforward documentation. I also need the confidence to let an informed buyer decide without manufactured pressure.

This is where many traditional sales habits struggle. They assume the seller controls information and the buyer must be guided through a funnel. That balance has shifted. Buyers can educate themselves quickly, compare alternatives and test claims before speaking to anyone.

I call the better approach UnSelling. It is not the absence of selling. It is the removal of avoidable resistance.

My aim is simple: explain the value, reveal the path, state the cost and make the next step obvious. Then I stop filling the space.

The businesses that win will not always have the most persuasive salespeople. I believe they will respect informed buyers and make confidence easy to reach.