Pressing Record in Australia: Who Needs to Say Yes?

Cartoon of colleagues around a meeting table smiling and agreeing, with a closed laptop and a simple microphone on the table

The short version

Recording a meeting is useful. Minutes, a replay for whoever was on leave and an AI summary are all real benefits. But in most of Australia you can’t just press record, or let an AI note-taker into the room, without everyone’s consent. The rules differ by state and territory, and the penalties for getting it wrong can be serious. Even where the law lets a participant record, trust is the thing that gets damaged.

My recommendation is simple. Have one official recording, run by the organiser, with consent built into the booking or invite and announced at the start. No personal or third-party recorders, AI bots or wearables unless the organiser has agreed. Sample wording is further down.

This is general information, not legal advice. I’m not a lawyer. If it matters, get advice for your situation.

Why this is everyone’s problem now

AI note-takers have made recording effortless. Microsoft 365 Copilot in Teams, Otter, Fireflies, Zoom recording, phone voice memos and even AI wearables will happily capture a whole conversation and ship it off to a cloud service. In an MSP or small business that covers internal meetings, client calls and the awkward conversations about incidents and mistakes. If someone discovers a bot or a phone quietly recording, that trust goes.

What the law says, state by state

There’s no single national recording law. It’s mostly state and territory surveillance-device legislation, plus Commonwealth rules on telecommunications. Broadly, Victoria, Queensland and the NT let a participant record a private conversation without the others’ consent. SA and WA generally require everyone’s consent. NSW, Tasmania and the ACT generally require consent too, with a narrow exception for recording for your own personal use that isn’t shared. Consent can be express or implied.

JurisdictionStatuteCan a participant record without others’ consent?Key exceptionPenalty (where verified)
NSWSurveillance Devices Act 2007 (s7)Generally noPersonal use only (not communicated or published to non-parties), or reasonably necessary to protect lawful interestsUp to 100 penalty units or 5 years (individual); 500 penalty units (company)
VicSurveillance Devices Act 1999 (s6)Yes – participant recording isn’t caught by s6Communicating or publishing a private conversation is regulated separately (s11)Not verified for publication
QldInvasion of Privacy Act 1971 (s43)Yes – s43(2)(a) exempts a partyPublication is regulated separately (ss44-45)40 penalty units or 2 years (using a device on a conversation you’re not part of)
SASurveillance Devices Act 2016 (s4)No – all principal parties must consent, expressly or impliedlyReasonably necessary to protect lawful interests; public interestUp to $15,000 or 3 years (individual); $75,000 (body corporate)
WASurveillance Devices Act 1998 (s5)NoLawful interests and similar exceptionsUp to $5,000 or 12 months (individual); $50,000 (body corporate)
TasListening Devices Act 1991 (s5)Generally no (NSW-style)Personal use only / lawful interests40 penalty units or 2 years (secondary source, not verified)
ACTListening Devices Act 1992 (s4)Generally no (NSW-style)Personal use only / lawful interests50 penalty units (secondary source, not verified)
NTSurveillance Devices Act 2007 (s11)Yes – offence only applies if you’re not a partyPublication is regulated separately (s15)250 penalty units or 2 years (non-party recording)
CthTelecommunications (Interception and Access) Act 1979 (ss6-7)Not an issue for a party recording at their own end, generallyInterception of a live communication over a telecoms system without the knowledge of the person making it is prohibitedUp to 2 years

Check these before relying on them. Section numbers and penalties come from secondary sources that summarise the statutes. The Tasmanian and ACT penalties are unverified, and so are the Victorian, Queensland and NT penalties for publishing a recording. Check the current legislation before you rely on any of it.

Two more traps:

  • Publishing is a separate issue. Even where you can lawfully record, communicating or publishing the recording to others can be an offence or need consent. Sharing a recording or transcript on LinkedIn, in a Teams chat or with an AI vendor can be the real problem.
  • Mixed locations. If you’re in Victoria, someone’s in Perth and someone’s in Sydney, it’s not clear which law applies. The safest approach is to assume the strictest one applies, which means getting everyone’s consent.

In person, online and ‘private conversation’

The surveillance device laws are about ‘private conversations’. Broadly, a conversation isn’t private if all the parties ought reasonably to expect it might be overheard by someone else. A large open session might arguably fall on that side. A small team meeting or a client call almost certainly doesn’t. I wouldn’t rely on that argument. A court looks at the circumstances, and it’s untested for meetings like yours.

The rules apply equally to a phone on the table, a wearable and a bot that joins your Teams call. The device is a ‘listening device’ whatever it looks like.

Commonwealth: the TIA Act and the Privacy Act

  • TIA Act: it prohibits intercepting a live communication passing over a telecommunications system without the knowledge of the person making it. A participant recording at their own end isn’t usually treated as interception. Whether a bot that joins a call as a participant is different hasn’t been tested, as far as I know.
  • Privacy Act: it applies to ‘APP entities’, which are generally businesses with turnover over $3 million (plus some smaller ones, such as health providers) and government agencies. The small business exemption is still in force as at October 2026 according to secondary sources, though reform has been proposed. Many MSPs are under the threshold, but many of their clients and some vendors aren’t.
  • OAIC guidance: it says meeting recordings and AI transcripts are personal information. Collect only what’s reasonably necessary, tell people, consider opt-outs, and destroy or de-identify what wasn’t needed, such as a personal chat or confidential client details.
  • Statutory privacy tort: since 10 June 2025 there’s a tort for serious invasions of privacy. I haven’t verified how it applies to small operators or to recordings.

The AI note-taker problem

The recording is only half of it. An AI tool adds questions that an old-fashioned voice memo never did:

  • Third-party storage: your colleagues’ and clients’ words now sit on a vendor’s servers.
  • Training: does the vendor use the audio or transcripts to train its models? Some do, so check the terms.
  • Cross-border: the data is probably processed outside Australia.
  • Confidentiality: people discuss client names, incidents and commercial details, which may breach NDAs or client contracts.
  • Voiceprints: some tools build speaker profiles, which is biometric-style data.
  • Sharing: some tools email a summary to every attendee, or publish a link, automatically.

This is already in the courts overseas. In re Otter.AI Privacy Litigation in the US alleges Otter’s Notetaker recorded meetings without all participants’ consent and used the data for training. In August 2026 a federal court held Otter could plausibly be treated as a third-party eavesdropper because it keeps and uses recordings for its own purposes. That’s US law, not ours, but it shows the risk.

There are workplace consequences too. The Fair Work Commission has accepted covert recording as a valid reason for dismissal (Schwenke v Silcar [2013] FWC 4513). NSW also needs 14 days’ written notice for camera, computer or tracking surveillance of employees, and the ACT has a notice and consultation regime. If you run staff meetings through an AI recorder, check them.

A simple approach for MSPs and small business

The cleanest fix is to separate the organiser’s official recording from everyone else’s. The organiser decides, tells everyone, gets consent and controls where the recording lives and who sees it. An individual’s own recorder or bot has a separate vendor, separate retention and nobody else’s consent. In SA, WA and (mostly) NSW, Tasmania and the ACT that’s where someone can get into trouble, even if they only meant it as private notes.

  1. Write a short recording policy. Plain English (sample below).
  2. Get consent in the invite or booking. Say the meeting will be recorded, why, who sees it and how to opt out.
  3. Announce it at the start. Silence after a clear announcement may amount to implied consent, but express consent, such as a ticked box or a Teams consent prompt, is better.
  4. Make it visible and offer opt-outs. Use the recording indicator, say it out loud, and let people keep their camera off or ask in chat.
  5. One official recording. The organiser shares the transcript or summary afterwards, so nobody needs their own recorder.
  6. Set retention, deletion and access. Where it’s stored, how long it’s kept, who can view it, and how someone asks for deletion.
  7. Control who joins. See the Teams notes below. Zoom shows participants a consent prompt when recording starts.
  8. If you find an unauthorised recording, stay calm. Politely ask for it to be stopped, ask what’s been captured and where it’s stored, and ask for deletion and no sharing. Don’t confront anyone publicly or take their device. If it’s serious or has been shared, get advice.

What Microsoft 365 gives you in Teams

If you manage the tenant, two Teams meeting policy settings are worth knowing. Both are admin-level policies, not per-meeting switches, and both match Microsoft Learn.

  • Manage external bots and their access to meetings. Teams detects external bots such as note-takers and holds them in the lobby until the organiser explicitly admits them. “When detected, require approval before joining” is the default. Microsoft says some bots may not be detected, so it doesn’t replace a policy. It also suggests letting only organisers and co-organisers admit people from the lobby.
  • Require participant agreement for recording and transcription. It’s off by default. Switch it on and, once recording or transcription starts, everyone else is muted with camera and sharing off until they answer Yes or No. A No means a view-only experience. The person who starts the recording is treated as having consented, and the choices appear in the attendance report. It’s the closest thing Teams has to a tick-the-box consent.

Sample wording

(a) Invite or booking notice

This meeting will be recorded (audio, video and chat) by the organiser so that people who can’t attend can catch up and so we can produce notes and an AI-generated summary. The recording is stored in [location], kept for [90 days], and available only to [who]. If you’d prefer not to be recorded, email [organiser] before the meeting and we’ll make arrangements, such as keeping your camera off or asking questions in chat. Please don’t use your own recording tools, AI note-takers or bots without the organiser’s agreement. By attending after reading this notice, you agree to be recorded.

(b) Start-of-meeting script

Before we start: this session is being recorded by us, the organisers, for notes and an AI summary that we’ll share afterwards. If you don’t want to be recorded, please say so now or message [organiser] in chat, and we’ll sort it out. Please don’t run your own recorder or AI note-taker. We’ll share the official transcript and summary. If anyone is uncomfortable at any point, we can pause the recording. Is everyone happy to proceed?

(c) Short recording policy

  • Only the organiser makes the official recording of a meeting.
  • Attendees must not record audio or video by any means (phone, laptop, wearable, AI note-taker or bot) without the organiser’s agreement and the consent of everyone present.
  • Attendees are told about the recording in the invite and at the start of the meeting, and can opt out.
  • The organiser shares the transcript or summary with attendees. It isn’t shared outside the meeting without the consent of the people in it.
  • Recordings are stored in [location], kept for [period], and deleted on request where practical.
  • Unapproved bots will be removed. If an unauthorised recording is found, the organiser will ask for it to be stopped and deleted.

What I haven’t verified

  • Section numbers and penalties come from secondary sources, not the statutes themselves.
  • The Tasmanian and ACT penalties are unverified.
  • The Victorian, Queensland and NT penalties for publishing a recording are unverified.
  • Whether a bot that joins a call counts as ‘interception’ under the TIA Act is untested, as far as I know.
  • I haven’t verified how the statutory privacy tort applies to small operators or to recordings.

Sources

General information only, not legal advice. Laws change and details vary by situation, so check the current legislation or get advice before relying on this.

CIA Brief 20261031

image

Security

  • AI supercharges cyberattacks on Australia, with superannuation savings in the firing line
    The ASD’s annual threat assessment says frontier AI is helping attackers find and exploit vulnerabilities faster. The ASD sent more than 4,400 notifications of possible malicious activity last year, up 80 per cent, and the average cost of an attack on a medium-sized business rose 45 per cent to $141,300. The message for Australian SMBs is blunt: get legacy kit off the internet and put security ahead of availability, even if that means a short outage to patch.
    https://www.smh.com.au/politics/federal/ai-supercharges-cyberattacks-on-australia-with-superannuation-savings-in-the-firing-line-20261026-p618mz.html
  • From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
    Attackers posed as IT support in Teams and talked users into Quick Assist sessions. From there they abused misconfigured certificate templates (ESC1) or relayed NTLM to AD CS web enrollment (ESC8) to get certificates for privileged accounts and domain controllers. Good reminder that a password reset doesn’t revoke an issued certificate, so audit AD CS templates and web enrollment on any hybrid client, block external Teams chats you don’t need, and don’t leave privileged accounts out of automatic containment.
    https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/
  • Tracking AI adoption in North Korean threat actor tradecraft
    Microsoft says AI use among North Korean groups is now high. They’re using it to spin up front companies, generate dozens of tailored lures in minutes, trojanise source code repositories and run the ARTEX agentic pen-testing framework. The attacks are still human-directed and rely on social engineering and legitimate tools, so the defences haven’t changed, but expect fake job applicants and fake vendors to look a lot more convincing.
    https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/
  • Part 4: See, investigate, and measure email and collaboration attacks with Defender reporting
    Version 4 of the free Detections and Insights workbook for Sentinel and Power BI adds a Teams and Collaboration view, an impersonation and BEC tab, and 125 new or improved advanced hunting queries, including a Teams protection folder. There’s also a new Attack Simulation Training report that tracks who clicks, who reports and who keeps failing. Worth a look for MSPs, as the Sentinel workbook can combine several workspaces in one view, which makes multi-tenant reporting much easier.
    https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-4-see-investigate-and-measure-email-and-collaboration-attacks-with-defender/4562274
  • MAI Cyber 1.1 Flash: Sharper findings and fewer tokens inside MDASH
    Microsoft’s in-house security model for vulnerability discovery now costs 18 per cent less per scan with comparable results, and it already runs almost half of all MDASH scans. It’s only available to verified MDASH customers, so most SMBs won’t touch it directly. Still early, but it shows defenders getting the same AI-driven bug hunting that attackers are already using.
    https://microsoft.ai/news/mai-cyber-1-1-flash/

Microsoft 365 & Windows

  • What’s New in Microsoft Copilot | October 2026
    A big month: the Copilot app Home brings Chat and Cowork together, Projects and skills come to Copilot Chat in November, and Autopilot, an always-on personal agent with its own mailbox, files and remote computer, arrives for Frontier users in November. On the admin side, Purview can now retain Copilot memory and DLP is extending to Cowork in preview. Plenty of this is Frontier-only for now, so check what’s actually reaching each client tenant before you start training users, and have a governance plan ready before Autopilot lands.
    https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/what%E2%80%99s-new-in-microsoft-copilot–october-2026/4568528

Cloud & AI

Other

  • Partner Blog | Make each Microsoft 365 Business Premium opportunity a security conversation
    Microsoft’s SMB lead tells partners to treat every Business Premium deal as a security conversation, with the Defender and Purview Suites for Business Premium as the next step, and points to the FY27 SMB sales plays and Channel Partner Playbook. It’s sales guidance, not a new discount or incentive. Good reminder that the recurring revenue comes from managing posture after the sale, not from the licence itself.
    https://techcommunity.microsoft.com/blog/partnernews/partner-blog–make-each-microsoft-365-business-premium-opportunity-a-security-co/4568159
  • Microsoft Announces First Quarter Results (FY27 Q1)
    Revenue was $92.3 billion, up 19 per cent, and Microsoft Cloud revenue was $63.9 billion, with growth accelerating to 30 per cent. Nadella’s pitch is all about agent safety, security and letting customers “own their own intelligence”. Nothing groundbreaking for day-to-day operations, but it tells you where Microsoft’s investment, and its partner incentives, will keep flowing.
    https://www.microsoft.com/en-us/Investor/earnings/FY-2027-Q1/press-release-webcast

After hours

Will AI cause utopia or disaster? – https://www.youtube.com/watch?v=AoKo6EujpW8

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

Finally, AI That Just Gets Things Done

A relaxed business owner with a coffee watches several laptops quietly working around him

For years, when I talked to people about AI, I could see a gap between what they expected and what they got. They expected something that would just do the job. Tell it what you want, it goes away, and the work comes back done. What they actually got was a chat box. Clever, sometimes impressive, but you still did all the running around yourself. Copy this, paste that, open another app, reformat it, send it.

Over the last little while I’ve been using Grok Bot heavily across my own business, and for the first time it feels like that gap is closing. Not because the AI suddenly got smarter, although it has, but because it’s easy to set up so that it actually gets things done. That’s the shift I want to talk about, because I think it’s why it’s fast becoming a real option for a lot of businesses, and particularly for SMBs and the MSPs who look after them.

It works the way people always expected AI to work

Most people never cared which model they were using. They cared about outcomes. Did the email get answered? Did the report get written? Did the post go up on time? The industry spent a long time arguing about models and benchmarks while the average business owner just wanted someone, or something, to take a task off their plate.

What I notice with Grok Bot is that I rarely think about the model at all. I think about the job. I describe what I want in plain language, and the assistant works out the steps. It can reach the systems I’ve connected, use a computer and browser when there isn’t a connector, and come back to me with a result rather than a suggestion. That’s much closer to the mental picture most people have always had of an assistant.

I touched on this idea in a recent podcast, Need to Know podcast – Episode 372, where I talked about where AI is heading. The theme is the same: the model is becoming the engine, and what really matters is what it’s connected to and what it’s allowed to do.

What I actually use it for

Rather than talk in the abstract, here’s how I use it day to day. I don’t run one general assistant. I run a number of specialised ones, each set up for a particular job.

  • Blog writing and scheduling. One assistant drafts articles in my voice, creates a hero image, uploads it to WordPress, picks tags and schedules the post for the next free morning slot. The article you’re reading started there, and it waited as a draft until I approved it.
  • Social posting. Separate assistants turn blog posts into LinkedIn and X posts, so new content gets shared without me rewriting it each time.
  • Daily Microsoft 365 security checks. An assistant runs regular checks across my tenants and reports what changed or what looks wrong, so I start the day knowing where to look.
  • News briefs. Another pulls together the Microsoft and security news I care about into a regular brief.
  • Podcast preparation. One helps me research news and build outlines and scripts for episodes.
  • Teams, help desk and email list. Others watch and respond in Teams, help triage support questions and help look after my email list.

The common thread is that each assistant knows its job, knows my standards and knows which tools it can use. When I want to change how something works, I tell it in plain language and it updates how it goes about the task next time. There’s no project plan or developer involved.

None of these needed me to write code. Each one is mostly a set of plain-language instructions, a few connected services and, where it makes sense, a schedule.

Connectors are where the work happens

The thing that turns an AI from a talker into a doer is connections. In my case that means WordPress, Outlook, Teams, GitHub and others. Once an assistant can reach those, a request like “draft this, put it on the blog and schedule it” isn’t a lesson in copy and paste anymore. It’s a task that gets finished.

When there isn’t a connector, there’s a shared computer with a browser the assistants can use. That matters more than it sounds. Plenty of the systems SMBs rely on don’t have neat integrations. Being able to fall back to using a website the way a person would fills a lot of gaps.

Just as importantly, it asks before doing anything that can’t easily be undone or that other people will see. Sending messages, posting publicly, deleting things. That’s the right balance. I want it to do the legwork, but I still want to approve what goes out under my name.

Routines mean it works while I don’t

The other big piece is routines. I can set an assistant to run on a schedule, every morning, every week, or when something happens. My security checks and news briefs run without me asking. When I sit down, the work is already done and waiting for review.

This is the part I think many businesses will find most valuable. A lot of small business admin isn’t hard. It’s just relentless. Checking things, summarising things, chasing things. Handing that rhythm to an assistant frees up real time.

See it in action

If you’re an MSP wondering what this looks like in practice, I’ve recorded a video that shows it. In How I Use AI to Automate Microsoft 365 Administration, Security & Reporting I walk through how I’m using AI to handle the administration, security and reporting work across Microsoft 365 that used to eat my time. It’s the recording of my October Need to Know webinar on managing Microsoft 365 autonomously, so it’s practical rather than theoretical.

Watch it with your own customers in mind. Think about which of their routine checks and reports you could hand off in the same way.

Why this matters for SMBs and MSPs

Picture a ten-person business with no IT staff. They don’t want to evaluate models or build integrations. They want their quotes followed up, their inbox summarised and their social media kept alive. An assistant they can configure in plain English, connect to the tools they already use and put on a schedule is a very different proposition from a chatbot they have to babysit.

For MSPs, I see two opportunities. The first is internal. Your own team can hand off routine checks, reporting and documentation. The second is with customers. Someone still needs to design these assistants well, decide what they can touch, secure the connections and review the results. That’s advisory work, and it’s exactly where a good MSP adds value.

It also raises the same questions I’d ask of any AI tool. What data can it reach? Who approves the risky steps? How do you know what it did? Easy to configure doesn’t mean you skip the thinking. It means the thinking goes into the design rather than the plumbing.

A few lessons from my own setup

  • Specialise. Several focused assistants work better than one that tries to do everything.
  • Write down your standards. The more clearly I describe my voice, formatting and rules, the more consistent the results.
  • Start with drafts. Let it prepare, and you approve, until you trust it with more.
  • Automate the rhythm, not just the task. The real gains come when work runs on a schedule.

Getting things done is the point

I don’t think the next phase of AI for business will be won by whoever has the best model on a leaderboard. It will be won by whatever makes it easiest for ordinary businesses to get real work done, reliably and safely.

That’s why I’ve leaned into Grok Bot. Not because of what’s under the bonnet, but because it does what I always expected AI to do. I tell it what I need, and it gets on with it. For a lot of businesses, that’s the only measure that has ever really mattered.

Same Licence, Different Results

Cartoon of an experienced person in a casual wizard hat guiding a colleague who holds a plain stick, with a laptop on the desk

Picture two people in the same team asking Microsoft 365 Copilot to do the same job. Same licence, same tenant, same Monday morning. One ends up with something she can send to a customer. The other ends up with something he quietly deletes.

The tool is identical. Everything around it is not.

Where the difference shows up

The task is simple: a customer has sent a long Outlook thread about a delayed project, and the team needs a recovery update for a Teams meeting that afternoon.

The first person starts by thinking. She knows what the customer is worried about, and which commitments are real and which are wishful. She asks Copilot to summarise the thread, then to separate the decisions from the complaints. She opens the project plan in Planner, checks the dates against what Copilot said, and spots a milestone stated with far too much confidence. She corrects it, then asks for a draft in Word, matching the tone of an earlier update stored in SharePoint.

The second person types “write an update about the delay” and pastes the answer into a document. It reads fluently, is polite, and is wrong in two places. He doesn’t notice, because he never decided what a good answer looked like.

Same wand. The difference was framing the problem, checking the result, and knowing where the real data lives.

It goes beyond prompts

I’m wary of the idea that this is all about prompt wording. Prompts matter, but they’re the visible tip. Underneath sits judgement: knowing which Excel workbook is the trusted one and which is last year’s copy with a different name. Knowing that a SharePoint site full of duplicates gives Copilot a confused view of your business. Knowing when a sensible-sounding answer should make you suspicious rather than relaxed.

None of that arrives with a licence. It comes from experience, a healthy scepticism, and someone being willing to say “that doesn’t look right” out loud.

It changes how I think about buying decisions, too. A business that rolls Copilot out to everyone and calls it done has bought wands. A business that invests in tidy data, clear ownership and shared habits for checking AI output has started building wizards. I’d take the second approach with half the licences over the first with all of them. A skilled person with a plain tool beats a novice with a fancy one most days.

What I’d do on Monday

Pick one real task, such as a weekly report or a customer reply, and have your most careful person and your most enthusiastic person both do it with Copilot. Then compare more than the output. How did each of them get there? What did they ask first? What did they check? What did they ignore?

That comparison tells you more than any vendor demo ever will. It shows you what to teach, what to document and where your data needs attention.

If you buy services from an MSP or adviser, apply the same test to them. Ask less about which products they resell and more about which problems they’ve solved that look like yours. Ask who will actually work with you, and what they did the last time it went sideways.

Tools will keep changing every few months. Framing a problem, questioning an answer and understanding your own information will still be worth having when the next one arrives. That’s what I’d invest in first, and I suspect it quietly decides whether any of this pays off.

Give Them a Win Before Doubt Settles In

Warm cartoon of an advisor and client high-fiving beside a checklist of coloured shapes and a glowing green light

Clients do the same maths we do. They signed up, they started paying, and every week without a clear return a quiet voice starts asking questions. Was this the right call? Should we keep going? Would another provider move faster? That voice gets louder the longer the wait. I have seen good engagements lose air not because the work was wrong, but because nothing visible landed early enough to quiet the doubt.

When I bring Microsoft 365 Copilot into an MSP or SMB engagement, I do not open with a tour of every feature. I look for one concrete win the client can point at in the first fortnight — something their team feels in the tools they already open each morning.

Pick one snag and make it disappear

Most offices I walk into share a familiar tangle. Status lives in Teams. The brief lives in SharePoint. Tasks sit half-updated in Planner. Follow-ups hide in Outlook. Someone still chases the lot by hand. That chase is perfect early territory for Copilot, because the win is obvious: less hunting, clearer next steps, something finished instead of something promised.

Here is a pattern I like. We take a live project the client already cares about — not a demo tenant, the real one. In Teams, Copilot summarises the channel noise into what actually changed this week. That summary lands in SharePoint beside the project brief so nobody is guessing. From there we ask Copilot to draft Planner tasks that match the open items, with owners the client already named. Outlook gets a short update the account lead can send without rewriting from scratch. Power Automate closes the loop: when a Planner task flips to done, a note hits the Teams channel and a copy files into SharePoint. None of that is theatre. It is one pathway from noise to a checklist that moves.

The client does not need a strategy deck to understand it. They see a messy channel become a usable brief, a task list that matches reality, and an email that went out without another late night. That win makes the monthly fee feel like progress.

Make the win theirs, not yours

I am careful about who owns the story. If I am the only one who can run the Copilot prompts or touch the flow, I have built a dependency, not a win. So I sit with their people in Teams, walk the SharePoint library they already use, and let them trigger the Planner draft and the Outlook reply. Power Automate stays simple enough that their admin can explain it next week without calling me. When the green light moment happens — the first completed loop that did not need a chase email — they should be the ones celebrating it.

That shift matters more than any slide about AI maturity. Doubt fades when the client can say, “we got that done faster this week.” They stop staring at the invoice line and start asking what else we can tidy the same way.

Belief compounds faster than features

I still care about the deeper work — governance, licensing, the longer Copilot roadmap. That work only sticks when early belief is already in place. A visible win across Teams, SharePoint, Planner, Outlook, and a small Power Automate nudge does more for retention than another workshop that ends with “we’ll circle back.”

So my rule is simple. Find the snag they already complain about. Use Copilot on the surfaces they live in. Deliver something they can tick off before the quiet voice gets loud. Do that, and the engagement stops feeling like a bet and starts feeling like a partnership already paying its way.

Who Is Actually Good?

Cartoon of a small business owner sitting with a practitioner who is showing papers and a whiteboard of abstract shapes.

I get asked this a lot. An MSP owner, or a small-business leader, wants a coach, an advisor, or a specialist, and they cannot tell who is any good. There is no certificate that settles it. It is easy to look competent on Instagram. A tidy grid and a confident caption will get you a meeting. They will not get the business where you want it.

The test I use is plainer than the marketing. Has this person solved the problem you actually have? Did they get the result you want? Have they helped a fair number of people like you get there, rather than telling a polished story about one lucky result?

Write the problem down before you shop

Most owners start with a feeling. The week is full. Margin is thin. The team is tired of the same snag. A feeling is not a brief, and a vague brief attracts someone who is good at a problem you do not have.

Before I talk to anyone, I sit in Microsoft 365 and ask Copilot to draft the problem from what is already in the tenant. Recent Teams threads where the same argument keeps returning. SharePoint documents that were meant to be the process and clearly are not. Planner boards crowded with tasks that never quite close. Copilot earns its place because it can pull those threads onto one page: what keeps breaking, who it lands on, and what better would look like in the numbers you already track.

I read that page and I edit it. If Copilot has smoothed over a sore point, I put the sore point back in. I hand it to a candidate and say, this is the job. If they have not done that job, you hear it quickly. They talk about their method. They do not talk about your board, your clients, or the result.

Ask for the work, not the pose

A person worth hiring will show you work. Not a slide of logos. How they read a business that looked like yours. What they changed. What moved, and what did not. Papers on the table. A whiteboard. A walk through a real engagement. If the only evidence is a photo and a promise, I keep looking.

I want someone who has done it more than once. One success can be luck, or a very patient client. A run of similar businesses, under similar constraints, reaching similar results, is a pattern. That pattern is what you are paying for.

Watch what they do with your brief. Do they push back where it is wrong? Do they ask what you have already tried? Or do they skip straight to a package with their name on it? The person who stays with the problem is usually the one who has been in the room when it was hard.

What changes when they are on the team

Get this choice right and the business feels different. The work is more enjoyable, because you are not grinding the same stuck point every week. You help more of the people you set out to help. And you make more money, because time stops leaking into work that does not pay.

None of that shows up because someone posted well. It shows up because a person who has already walked the path is now walking it with you, against the problem you wrote down, not the problem they prefer to sell.

I still do not know a certificate that replaces that test. I do know that if you write the real problem first, and you only sit down with people who have solved it for others like you, the choice gets a lot less foggy.

Your Clients Aren’t Asking for More. They’re Asking Where To.

Cartoon of a small group of people hiking a trail, one slightly ahead pointing the way

I keep hearing the same two complaints from MSP owners. Clients feel restless. Prospects who used to answer have gone quiet. The reflex is to add a service, cut the price, or send a longer newsletter. That rarely fixes it. You are asking the market to follow you, and the market is still asking where to.

More product does not create loyalty. A destination does.

Name the ridge, then start up it

Most MSPs I speak with have a catalogue, not a heading. Security, backup, licensing, a Copilot chat if someone asks. None of that is wrong. None of it answers the question an owner actually has: where are you taking my organisation over the next eighteen months?

Pick one serious goal. Not a homepage slogan. Something you can point at on a Tuesday. Every client we look after will have a written path from the tenant they have today to a Microsoft 365 setup their staff actually use, with Copilot where it earns its keep and nowhere else. That is a ridge worth climbing. You can say, out loud, that you have started.

I am not talking about a vision deck. I mean a SharePoint page the client can open without calling you, and a Planner board with the next three moves, names and dates included. The goal is the ridge. The agreed work is the track. If you cannot show both, you do not have a direction. You have a brochure.

Report where you are, not only what you sold

A quiet pipeline is often just confusion. They liked the first meeting. Months later the only message was a renewal or a ticket number. Nobody said whether the journey had moved.

This is ordinary Microsoft 365 work, done on purpose. Keep the roadmap on a SharePoint site they already use. Break the quarter into Planner tasks, not a slide that dies in an inbox. Once a month, post a short note in the shared Teams channel. What moved. What stalled. What is next. Ask them to reply. That is an invitation onto the track, not a speech.

Copilot earns a place here as a drafter, not a mascot. I open the month’s tickets and the Planner board, then ask Copilot in Word, or in Teams, to draft the client note in plain language. I still edit it. I still own the judgement. What I stop doing is staring at a blank page until the update never leaves the building. The owner who ignores Teams should get the same story in Outlook. Same heading, two doors.

Power Automate can nudge you when a Planner date slips, so the note is not an act of memory. This is not a product tour. It is how an MSP shows it has a heading and is still on the track.

Point, then let them choose

People follow someone who names the destination and reports the distance covered. They do not follow a vendor stuffing the pack. There is a plain gap between “we also do Copilot readiness” and “here is the ridge, here is where we stood this month, and you are welcome to walk it with us.”

If clients are fidgeting and prospects have gone quiet, do not add another offer. Stand a little ahead. Point. Say where you are going and where you intend to take them. Keep saying it, inside their tenant, in language they can read before the first coffee.

The ones who want a leader will come. The ones who only wanted a cheaper licence will not. That silence, once you can tell the difference, is useful.