Category: Microsoft 365

From tribal knowledge to Copilot skills: seven patterns every MSP should write down

image

Every MSP I’ve worked with has a playbook. Some of it is written down. Most of it lives in the head of the engineer who’s been there longest. When that engineer is sick, on leave, or finally takes the holiday they’ve been promising themselves for two years, the playbook walks out the door with them.

That’s the gap I’ve been thinking about lately. We’ve built systems that handle tickets, monitor endpoints, and bill clients. We have not done a great job of capturing the judgement — the way a senior engineer triages a queue at 7am, the questions they ask before onboarding a new client, the tone they take when a CEO’s mailbox is broken on a Monday morning.

Microsoft 365 Copilot, with the right scaffolding, finally gives us somewhere to put that judgement. Not as a chatbot. As a set of repeatable skills your team can run consistently every time.

Why bother turning workflows into skills

A skill, in this context, is a short markdown file that tells Copilot how to handle a specific kind of work. It’s the difference between asking your assistant a vague “help me with this client” and handing it a defined process — what to ask, what to gather, what to produce, where the guardrails sit.

The payoff isn’t raw speed. It’s consistency. Every new starter at every client gets onboarded the same way. Every QBR pack tells the same story in the same shape. Every outage update lands in your house voice, at the right interval, instead of being workshopped at 9pm by a tired engineer.

I’ve drafted seven of these as examples to show what’s possible. Walk through them with me.

The client-facing rhythm

Four of the skills cover the moments that define your client relationship.

Client onboarding is the first. The new MSA is signed, and somewhere between sales and service delivery, things get dropped. The skill gathers the structured client profile — domains, contacts, service tier, compliance obligations — and produces three artefacts every time: a welcome email, an internal Teams announcement to the delivery team, and a technical checklist for the engineer. Wire it into the tenant via Graph so domain checks and the initial license inventory happen up front. Schedule the day-7, day-30, day-90 touchpoints into Outlook before the engineer even picks up the work.

Employee onboarding is the same idea at the user level. New starter, Monday start, the client manager has asked for “the usual setup.” With a skill driving it, the usual becomes auditable: identity provisioned, license assigned from a role template (not copied from a colleague — that’s how entitlement drift starts), Intune enrolment, mailbox memberships, a manager briefing, and a quick-reference card the new hire actually opens on day one. Surface every drafted communication for review. Never auto-send.

QBR preparation is where most MSPs leave money on the table. The data is already there — tickets in the PSA, patch status in the RMM, Secure Score and license utilisation in the tenant. Pulling it together into a story takes hours. A skill turns it into a repeatable build: scorecard, security posture, license rightsizing, projects, roadmap. Compute every percentage with code, never by eye — a wrong MFA percentage in a QBR undermines the whole pack. Use the pptx generation to produce the deck and a Word leave-behind for the people who want detail. The trick is to lead with theme and support with data, not the other way around.

Incident communications is the one nobody wants to think about until it’s needed. When Exchange Online wobbles on a Tuesday morning, your engineers should be fixing the problem, not workshopping the wording of the customer email. The skill drafts the four stages — initial notification, progress update, all-clear, post-incident review — using only confirmed facts from Microsoft’s Service Health dashboard or your own monitoring. Never speculate about root cause in a customer-facing message. Promise an update time, not a fix ETA. Send via the channel you started on; don’t fragment.

The operational backbone

The other three skills run quietly in the background and pay you back every week.

Ticket triage applies a real Impact × Urgency matrix to your inbound queue. Most MSPs let priority drift to whatever the user typed in the subject line. With a skill driving it, every ticket gets classified the same way, security signals automatically bypass the matrix, and the engineer gets a drafted first response they can paste straight into the PSA. You’ll find it catches the “third password reset this week” pattern and quietly suggests a root-cause review — the kind of thing a good Tier 2 engineer does naturally and a stretched team often misses.

License rightsizing is the easiest commercial conversation you’ll have all year. Almost every tenant carries 10–25% waste — disabled accounts still licensed, E5 users who haven’t opened a Power BI report in a year, shared mailboxes nobody downgraded after the staff member left. The skill pulls full license inventory and sign-in history through Graph, applies a rule set, and produces a numbered list of decisions for the client with a dollar value next to each. Run it before every renewal. Run it again three months later.

Security baseline check is the one I’d implement first if I were starting fresh. Pick a standard — Essential Eight, CIS Microsoft 365 Foundations, or your own house baseline — and let the skill walk through every control. Conditional Access posture, MFA coverage, DMARC, Intune compliance, backup test recency. Each control gets a Pass, Partial, or Fail with cited evidence. The deliverable isn’t a Secure Score screenshot. It’s a 90-day remediation plan with named owners and real dates. That’s what survives an audit.

How to actually roll this out

Don’t try to deploy all seven at once. That’s how good initiatives die in busy MSPs.

Pick the one that hurts most this month. For most teams, that’s either ticket triage or QBR prep. Run it manually for a fortnight — meaning, your senior engineer literally walks through it for every relevant case and notes the spots where the prompt needs more local detail. Add your tier names, your SLA wording, your house security baseline, the SKUs you actually sell, the language your clients respond to.

Store the skill files where your team can edit them. Treat them like internal documentation — versioned, reviewed, owned by a named person. A skill nobody updates is a skill that quietly stops matching how the business actually works, and then it starts producing confidently wrong output, which is worse than no skill at all.

Keep a human in the loop on every customer-facing or change-making step. None of these skills should send a client email, remove a license, or modify a Conditional Access policy without explicit review. The aim is to make the engineer faster and more consistent — not to remove the engineer from the decision.

And track the saves. The first time the QBR skill cuts your prep from six hours to two, write that number down. The first time the rightsizing skill finds $4,000 a year of waste in a client’s tenant, write that down too. Those numbers are what you’ll show your team when you ask them to maintain the next skill, and what you’ll show your accountant when they ask why the Copilot licenses were worth it.

7 example skills MSPs could drop into their own setup. Each one targets a real, recurring pain point. They are located in my Github repo here – https://github.com/directorcia/Office365/tree/master/Cowork-Skills

client-onboarding.md – Standardizes the first 30 days of a new MSA — kickoff pack, technical checklist, recurring touchpoints

qbr-prep.md – Builds a defensible Quarterly Business Review pack — service scorecard, security posture, license optimization, roadmap

ticket-triage.md – Applies a consistent Impact × Urgency framework to the support queue, drafts first responses

incident-comms.md – Drafts every stage of outage comms — initial notification, hourly updates, all-clear, post-incident review

license-rightsizing.md – Finds unused, oversized, and duplicated M365 licenses and quantifies the savings

security-baseline-check.md – Runs an Essential Eight / CIS / house-baseline gap analysis and stages remediation

employee-onboarding.md – Provisions a new starter end-to-end — identity, licenses, devices, Day-1 experience

Each follows the same SKILL.md structure (frontmatter + when-to-use, inputs, workflow, guardrails, done-when), so they should slot straight into a personal skills folder. They’re all in your output folder ready to download. See this post:

https://blog.ciaops.com/2026/04/23/creating-custom-copilot-cowork-skills-that-actually-matter-for-smbs/

for more information about implementing Microsoft 365 Copilot Cowork skills in your own environment.

What’s available natively in Microsoft 365

The skills can pull directly from:

  • Microsoft 365 via Graph — mailboxes, calendar, Teams chats, SharePoint/OneDrive files, people directory, sign-in activity, license assignments, Conditional Access policies, Secure Score

  • Web search — vendor status pages, public DNS lookups, pricing references

  • Files the user uploads — exports from other systems dropped into the workspace

  • Ask User Question — anything the user can answer

Mapped per skill

client-onboarding – New client details, tenant info User input + Graph for tenant/domain verification. Mostly user-driven.

qbr-prep – Tickets, patch %, backup status, licenses, Secure Score

Mixed — Secure Score and licenses come from Graph; tickets, patch, backup need exports from your PSA/RMM/backup tools because there’s no MCP connector for ConnectWise/Halo/NinjaOne/Datto today.

ticket-triage – A list of open tickets. Currently the user pastes them in or drops a CSV export. No live PSA integration.

incident-comms – Outage facts, vendor status. User input for the facts; web search for vendor status pages.

license-rightsizing – License inventory, last sign-in, mailbox state. Almost entirely Graph API — this one works end-to-end with what’s available.

security-baseline-check – CA policies, MFA stats, DMARC, Intune compliance, Secure Score .Mostly Graph — CA, MFA, Secure Score, Intune all reachable. DMARC needs a DNS lookup (web search workaround).

employee-onboarding – Role template, manager, license SKU. User input + Graph to actually create the user, assign groups, license.

The honest gap

The MSP-specific data sources — PSA, RMM, EDR consoles, third-party backup, documentation platforms (IT Glue / Hudu) — don’t have native connectors here. Skills that need them currently fall back to:

  1. The user pasting an export

  2. Dropping a CSV/XLSX into the workspace

  3. The skill explicitly flagging “data not available, please provide”

Two practical paths forward if you want these to be more autonomous:

  • Short term: each skill assumes a standard export format (e.g., “drop your PSA ticket CSV with these columns”) and works from that.

  • Longer term: a custom MCP connector for the PSA/RMM in your stack — that’s where it becomes genuinely hands-off.

What to do next

The hard part of running an MSP has never been the technology. It’s been keeping a team of busy people doing the right thing the same way every time. Codified Copilot skills are the closest thing I’ve seen to a real answer to that — and they finally put the data already sitting in your clients’ tenants to work.

Pick one. Write it down. Run it for a week. See what changes.

Why Copilot works differently now (and why that’s a good thing)

image

If you’ve noticed that Microsoft Copilot feels different lately—especially inside Word, Excel, PowerPoint, or Outlook—you’re not imagining it.

Nothing is “broken”.
What’s changed is how Copilot is positioned, licensed, and governed.

And while change can be frustrating, this shift is actually a step forward for security, reliability, and trust.

Here’s what’s going on—in plain English.

The short version

Copilot is no longer a “free helper everywhere”.
It’s now treated as a proper business system, with clear rules around:

  • Who can use it

  • What data it can see

  • Where it’s guaranteed to work

  • How it’s secured and audited

That’s good news for organisations that care about their data.

What Copilot was doing before

In late 2025, Microsoft made Copilot Chat broadly available across Microsoft 365.
For many organisations, this meant:

  • Copilot appeared inside Office apps

  • Users experimented freely

  • Expectations rose quickly

While this was great for awareness, it also created problems:

  • People assumed Copilot was “free forever”

  • Capabilities varied by tenant size and workload

  • Security and governance were often misunderstood

  • Businesses struggled to tell the difference between trial and production use

What changed (and why)

Microsoft has now drawn a clear line between:

✅ Copilot Chat (Basic)
  • General AI chat

  • Limited guarantees

  • Not deeply integrated with your business data

  • Useful for exploration and light assistance
✅ Microsoft 365 Copilot (Premium)
  • Fully integrated into Word, Excel, Outlook, Teams, etc.

  • Grounded in your organisation’s data (emails, files, meetings)

  • Governed by your security, compliance, and access controls

  • Licensed per user, with predictable behaviour

This separation wasn’t about removing features—it was about making responsibilities clear.

Why this is a good thing for your business

1️ Consistency beats surprises

When Copilot is licensed properly, its behaviour is predictable.

  • It works where you expect it to work

  • It respects your data boundaries consistently

  • Users stop asking “why did it work yesterday but not today?”

That’s what businesses need.

2️ Security becomes visible (not optional)

Copilot doesn’t invent access to information.

It uses:

  • Your permissions

  • Your sensitivity labels

  • Your data loss prevention rules

If something looks risky now, it was already risky—Copilot just made it obvious.

That’s a feature, not a flaw.

3️ Responsibility stays with people

Copilot assists.
It does not replace judgment.

The new model reinforces that:

  • People remain accountable for decisions

  • AI output must be reviewed

  • Policies still apply

This protects both the business and the staff using it.

4️ AI is treated like any other system

No business runs email, accounting, or security tools without governance.

Copilot is now treated the same way:

  • Licensed intentionally

  • Enabled where it adds value

  • Governed like a business system—not a novelty

That’s how AI becomes sustainable.

What hasn’t changed

It’s important to be clear about this:

  • Copilot still doesn’t bypass permissions
  • Copilot doesn’t share data externally
  • Copilot doesn’t “learn” from your data for other customers
  • Copilot respects your Microsoft 365 security model

The fundamentals are the same.
The clarity is new.

What this means for your organisation

This is a good moment to pause and ask:

  • Who actually benefits from Copilot day‑to‑day?

  • Is our data organised well enough to support AI?

  • Do we understand what Copilot can and can’t see?

  • Are expectations set correctly with staff?

Answering those questions now avoids frustration later.

The bottom line

Copilot didn’t get worse.
It got more honest.

Microsoft has moved Copilot from:

“Try it everywhere”
to
“Use it properly”

That shift improves:

  • Security

  • Trust

  • Reliability

  • Long‑term value

And that’s exactly what businesses should expect from AI that works with their data.

Exactly How SMBs Should Measure ROI from a Microsoft 365 Copilot Investment

image

Most SMBs “measure” Copilot ROI the wrong way.

They count prompts.
They quote vendor stats.
They say “people feel more productive”.

That’s not ROI. That’s vibes.

If you want to justify Microsoft 365 Copilot to an SMB owner, you need numbers that connect cost → behaviour → business outcome. Here’s exactly how to do that, step by step.

Step 1: Lock in the true cost (don’t wing this)

Before measuring return, be honest about investment.

For an SMB, Copilot cost is typically:

  • Copilot licence per user per month

  • Time spent on onboarding and training

  • Light data clean‑up (because Copilot will surface your mess)

Write this down as a monthly cost per user. That’s your baseline. No magic. No “later we’ll optimise”.

If you can’t clearly say “this is what Copilot costs us per user per month”, stop here.

Step 2: Pick only three measurable activities (not everything)

SMBs fail when they try to measure Copilot “everywhere”.

Don’t.

Pick three everyday activities where Copilot realistically shows up:

  1. Email handling (Outlook)

  2. Meetings (Teams)

  3. Document creation (Word / PowerPoint)

Microsoft already collects behavioural data for these via Viva Insights and Copilot Analytics. You don’t need custom tooling or surveys. [learn.microsoft.com]

Step 3: Capture a before baseline (this is non‑negotiable)

You must capture a baseline before rollout or you’ll be guessing forever.

Do this for a pilot group (10–20 users is fine):

  • Average daily email time per user

  • Average meeting hours per week

  • Time to create a “standard” document (proposal, report, policy)

These numbers already exist in Viva Insights for email and meetings. For documents, do a simple timing exercise with 3–5 users. [petri.com]

Write them down. Freeze them. This is your “before” state.

Step 4: Measure the delta after 30 and 60 days

Now roll out Copilot properly (licences and training) and re‑measure at:

  • 30 days

  • 60 days

Look only for deltas, not absolute values:

  • Reduction in email time per day

  • Reduction in meeting time or improved meeting outputs (summaries used instead of re‑watching)

  • Faster first‑draft document creation

Ignore:

  • Prompt counts

  • “Active users”

  • Dashboard vanity metrics

Usage is not value.

Step 5: Convert time saved into capacity, not dollars

This is where most ROI models fall apart.

Do not say:

“We saved 5 hours per week, therefore we saved $X.”

Instead ask:

  • Did sales respond to leads faster?

  • Did projects finish earlier?

  • Did client work backlog reduce?

  • Did staff stop working unpaid overtime?

Example:

A 15‑person professional services SMB reduces document creation time by 30 minutes per day per consultant. That doesn’t mean “money saved”. It means one extra billable task per week without hiring.

That’s capacity gain. Owners understand that instantly.

Step 6: Track one business outcome per role

Different roles = different ROI.

  • Sales: speed to quote, proposal turnaround

  • Admin: email backlog, meeting follow‑up time

  • Management: decision latency (time from question to answer)

Pick one outcome per role, not ten. If Copilot isn’t moving the needle there, it’s not paying for itself.

Step 7: Do a simple sanity check at 90 days

At 90 days, ask three brutal questions:

  1. Are fewer hours being wasted on low‑value work?

  2. Are decisions and deliverables happening faster?

  3. Would removing Copilot cause disruption?

If the answer is “no” across the board, the problem isn’t Copilot. It’s adoption, data hygiene, or training—not licensing.

Final reality check

Copilot ROI is not magic and it’s not automatic.

But when SMBs measure behaviour change first, then tie that to capacity and outcomes, Copilot becomes defensible, repeatable, and scalable—exactly how an SMB expects technology to behave.

If your ROI story can’t survive a sceptical business owner, it’s not finished yet.

Microsoft Fabric: Turning Your Business Data into Decisions (Without the Headaches)

image

Most small and medium businesses already have plenty of data.

It lives in your accounting system, your CRM, Microsoft 365, spreadsheets, and half a dozen other apps you rely on every day. The problem isn’t a lack of data — it’s that turning that data into clear, trusted answers is still harder than it should be.

That’s where Microsoft Fabric comes in.

Despite the grand name, Fabric isn’t about “big data” or enterprise complexity. It’s Microsoft’s attempt to fix a very real, very common SMB problem: why is it still so hard to get reliable answers from our own business systems?

The real problem Fabric is trying to solve

In most SMBs, reporting looks like this:

  • Sales has their numbers

  • Finance has a different set of numbers

  • Operations has spreadsheets that “mostly” line up

  • Meetings start with arguing over which report is correct

Even when Power BI is in use, it’s often built on fragile spreadsheets, duplicated datasets, or one‑off solutions held together by good intentions and caffeine.

The issue isn’t the tools — it’s the lack of a single source of truth.

What Microsoft Fabric actually is (in simple terms)

Microsoft Fabric is a single platform that brings together:

  • Data from all your systems

  • Secure storage for that data

  • Reporting and dashboards (via Power BI)

  • Analytics and forecasting

  • AI‑assisted insights

Instead of bolting tools together, Fabric gives you one shared data foundation that everything else plugs into.

Think of it as the difference between:

  • Twenty shared spreadsheets passed around by email
    and

  • One trusted set of numbers everyone agrees to use

Why this matters for SMBs (not just big enterprises)

Fabric isn’t about doing more reporting. It’s about doing less work for better answers.

For SMBs, the benefits are very practical:

1. Everyone works from the same numbers

Sales, finance, and leadership stop arguing about whose report is right, because they’re all looking at the same underlying data.

2. Better use of Power BI

Power BI becomes a decision‑making tool, not just a chart generator built on shaky spreadsheets.

3. Faster answers to real business questions

Questions like:

  • Are we actually profitable by customer?

  • Which products are quietly costing us money?

  • Where are we growing — and where are we stalling?

become easier to answer without weeks of manual effort.

4. AI that’s useful, not gimmicky

Fabric includes AI features that help explain trends and surface insights — not replace your judgement, but support it.

What Fabric is not

Let’s be clear about expectations.

Microsoft Fabric is:

  • ❌ Not a magic fix for messy data

  • ❌ Not “set and forget”

  • ❌ Not something every small business needs on day one

Fabric makes sense when your business:

  • Relies on multiple systems

  • Is growing or changing

  • Needs better visibility to make confident decisions

If Excel still works for you, that’s fine. Fabric is for when Excel no longer does.

The bigger picture

For years, businesses have collected more and more data while decision‑making hasn’t actually improved. Fabric is Microsoft’s attempt to close that gap — by simplifying how data is stored, shared, and analysed.

Used properly, it helps turn reporting from:

“What happened last month?”

into:

“What should we do next?”

And that’s where real business value lives.

Need to Know podcast–Episode 363

I reflect on the significance of the day before diving into the week’s major developments, including the arrival of the Microsoft AI Tour in Sydney. The episode covers both partner and public events, with a focus on enterprise-level AI advancements and networking opportunities.

The podcast features a comprehensive weekly news roundup:

  • The general availability of Copilot Agent capabilities in Microsoft 365 apps.

  • New data security tools for AI in Microsoft Purview.

  • Innovations in identity resilience and backup with Microsoft Entra.

  • Microsoft’s $25 billion investment in Australian AI infrastructure and training.

  • Practical security playbooks for tenant protection and device analytics.

  • Updates on decluttering promotional mail with Microsoft Defender.

  • Guidance on preventing oversharing in Copilot, deploying Defender, and enforcing data security with Purview.

I also share my workflow for automating podcast production using Copilot Cowork, including narration scripts and link management. I discuss experimenting with AI-driven voice narration and invites listener feedback on pacing and voice options.

The episode concludes with reflections on the Microsoft AI Tour’s enterprise focus, the importance of networking, and the challenges SMBs face in accessing relevant content. Listeners are encouraged to reach out with questions or feedback and to stay tuned for upcoming events like Microsoft Build and Ignite.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-363-hello-cowork/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog – CIAOPS – Information about SharePoint, Microsoft 365, Azure, Mobility and Productivity from the Computer Information Agency

Join my Teams shared channel – Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron – CIAOPS Patron

CIAOPS Brief – CIA Brief – CIAOPS

CIAOPS Labs – CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS – Support CIAOPS

Get your M365 questions answered via email

Join the CIAOPS Email list – Please fill out this form

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com

Show notes

Microsoft 365 Insider Round-Up — April 2026

Declutter and Defend: Reducing Promotional Mail Noise with Microsoft Defender

Prevent Oversharing in Microsoft 365 Copilot

Microsoft Defender Deployment Tool

From Oversharing to Enforcement: A Practical Guide to AI Data Security with Microsoft Purview

Investing in Australia’s AI Future

Copilot’s Agentic Capabilities in Word, Excel and PowerPoint Are Generally Available

Predictive Shielding: Just-in-Time Tamper Protection

Threat Hunting Agent in Advanced Hunting

Bringing Transparency to AI-Generated Content with Watermarks in Microsoft 365

Microsoft 365 Copilot Readiness and Resiliency with SharePoint and Microsoft 365 Backup

Introducing the Microsoft Sentinel Training Lab

A Practical Look at Device Analytics and Risk Signals with Microsoft Intune

Innovations in OneDrive for Collaboration, Intelligence and Control

Strengthening Identity Resilience: A Deep Dive Into Microsoft Entra Backup and Recovery

Detection Strategies for Cloud Identities Against Infiltrating IT Workers (Jasper Sleet)

Safeguarding Sensitive Data in Microsoft 365 Copilot Interactions: DLP for Microsoft 365 Copilot

Detecting Plain-Text Password Exposure Using Custom Regex in Microsoft Purview

Cross-Tenant Helpdesk Impersonation to Data Exfiltration: A Human-Operated Intrusion Playbook

Step-by-step: Find deleted file logs for a SharePoint site

image

Option 1: Use the Microsoft Purview audit portal

This is the easiest method for most admins.

  1. Sign in to Microsoft 365

  2. Open Audit

    • In the left menu, go to Solutions > Audit.

    • If prompted, enable auditing if it isn’t already on.

  3. Start a new search

    • Select New Search.

  4. Set the date range

    • Choose the period when you think the file was deleted.

    • Be aware that audit retention depends on licensing:

      • Many non-E5 tenants keep audit data for 180 days
      • E5 and some add-on licenses can retain some audit data for 1 year by default citehttps://learn.microsoft.com/purview/audit-search#before-you-search-the-audit-log

  5. Choose activities

    • In the activity filter, look for SharePoint file deletion-related actions such as:

      • Deleted file (FileDeleted)

      • Recycled a file (FileRecycled)

      • Deleted file from recycle bin (FileDeletedFirstStageRecycleBin)

      • Deleted file from second-stage recycle bin (FileDeletedSecondStageRecycleBin) citehttps://learn.microsoft.com/purview/audit-log-activities#file-and-page-activities

  6. Filter by site, file, or user

    • Use available filters to narrow results:

      • Site URL
      • File name
      • User
    • If you know the person who deleted the file, filtering by user makes results much easier to review.

  7. Run the search

    • Click Search.

  8. Review the results

    • Open matching events to see details such as:

      • who performed the action

      • when it happened

      • the file involved

      • the site URL

      • the operation type

  9. Check the event sequence

    • A typical deletion trail may look like this:

      • FileRecycled = file moved to recycle bin

      • FileDeletedFirstStageRecycleBin = removed from first-stage recycle bin

      • FileDeletedSecondStageRecycleBin = permanently removed from second-stage recycle bin citehttps://learn.microsoft.com/purview/audit-log-activities#file-and-page-activities

What the log entries mean

For SharePoint deleted files, these are the most useful audit events:

  • FileDeleted
    A user deleted a document from a site. citehttps://learn.microsoft.com/purview/audit-log-activities#file-and-page-activities

  • FileRecycled
    A user moved a file into the SharePoint recycle bin. citehttps://learn.microsoft.com/purview/audit-log-activities#file-and-page-activities

  • FileDeletedFirstStageRecycleBin
    A user deleted a file from the site’s recycle bin. citehttps://learn.microsoft.com/purview/audit-log-activities#file-and-page-activities

  • FileDeletedSecondStageRecycleBin
    A user deleted a file from the second-stage recycle bin. citehttps://learn.microsoft.com/purview/audit-log-activities#file-and-page-activities

That sequence helps you determine whether the file is still recoverable or has been permanently removed.

Practical tip for small businesses

If you are only trying to answer:

  • Who deleted the file?
  • When was it deleted?
  • Was it permanently deleted or just moved to the recycle bin?

Then the audit search with the filters:

  • date range

  • user

  • file name

  • SharePoint activities

is usually enough.

If you are trying to restore the file as well, you should also check:

  • the site recycle bin
  • the second-stage recycle bin

because the audit log tells you what happened, but recovery depends on whether the file is still retained in one of those recycle bins.

Option 2: Use PowerShell for more detailed searches

If you prefer scripting or want to export results, Microsoft also supports using the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell to search and export audit records. citehttps://learn.microsoft.com/purview/audit-log-export-records#use-powershell-to-search-and-export-audit-log-records

High-level process:

  1. Connect to Exchange Online PowerShell.

  2. Run Search-UnifiedAuditLog for the date range.

  3. Search SharePoint-related audit records.

  4. Export the results to CSV for filtering and reporting. citehttps://learn.microsoft.com/purview/audit-log-export-records#use-powershell-to-search-and-export-audit-log-records

This is especially useful if:

  • you need a report,

  • you want to search a large range of data,

  • or you want to automate the process.

Things to check if you can’t find the log

If no results appear, check these common causes:

  1. Wrong date range

    • Expand the time window.

  2. Audit retention expired

    • Older events may no longer be available depending on license. citehttps://learn.microsoft.com/purview/audit-search#before-you-search-the-audit-log

  3. Wrong activity selected

    • Try both:

      • deleted

      • recycled

      • recycle bin deletion events

  4. Auditing not enabled

    • In most tenants this is on, but if it was disabled previously, older activity may not exist. Microsoft notes audit log ingestion can be turned on or off. citehttps://learn.microsoft.com/purview/audit-search#before-you-search-the-audit-log

  5. Looking in SharePoint site settings instead of Purview

    • File deletion history is generally tracked in the Microsoft 365 unified audit log, not as a simple “deletion report” inside the SharePoint site itself.

Simple example

If a user says, “The file Budget.xlsx disappeared from the Finance SharePoint site,” you would:

  1. Open Purview Audit
  2. Search the last 7–30 days

  3. Filter activities to:

    • FileDeleted

    • FileRecycled

    • FileDeletedFirstStageRecycleBin

    • FileDeletedSecondStageRecycleBin
  4. Filter by:

    • Site URL = Finance site

    • File name = Budget.xlsx
  5. Review who deleted it and whether it is still recoverable

CIA Brief 20260425

image

Microsoft 365 Copilot & AI Productivity

Security – Defender & Threat Protection

Data Protection & Purview

Identity (Entra)

Devices & Endpoint Management

Collaboration & OneDrive

Industry & Regional

After hours

Coyote vs ACME  – https://www.youtube.com/watch?v=H-43VeYGiPM

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

3 Ready‑to‑Use Copilot Cowork SKILL.md Examples for MSPs

3 Ready-to-Use Copilot Cowork SKILL.md Examples for MSPs

image


Below are three practical, production‑ready Copilot Cowork custom skills designed specifically for MSP use cases.
Each skill follows Microsoft’s supported structure:
YAML frontmatter (name, description) followed by Markdown instructions,
and is intended to live in:

/Documents/Cowork/Skills/<skill-name>/SKILL.md


Copilot Cowork automatically discovers these skills at the start of each conversation.
Each one targets repeatable, high‑value MSP workflows rather than one‑off prompts.

1) MSP Client Monthly Executive Summary (QBR‑lite)

Folder: /Documents/Cowork/Skills/msp-client-exec-summary/
File: SKILL.md

---
name: MSP Client Executive Summary
description: Creates a monthly executive summary for an MSP client using M365 activity evidence (emails, meetings, files) and a consistent MSP-friendly format.
---

## Purpose
Produce a client-ready monthly executive summary (QBR-lite) that is consistent, factual, and easy for non-technical stakeholders to read.

## Inputs to request (ask if missing)
1. Client name (exact)
2. Reporting period (e.g., "March 2026")
3. Where client artefacts live (SharePoint site / Teams name / OneDrive folder path)
4. Any key initiatives/projects to include (list)
5. Any sensitive exclusions (e.g., "do not mention incident details")

## Data gathering rules
- Prefer evidence from Microsoft 365 content: emails, meeting notes, and files in OneDrive/SharePoint.
- Use only artefacts the user has access to.
- If you can’t find evidence for an item, mark it as “No supporting evidence found in M365 sources provided”.

## Output format (Word document)
Create a Word document titled:
"Executive Summary - <Client> - <Reporting Period>"

Use these sections and headings exactly:

1. Headline Summary (5 bullets max)
   - Outcomes delivered (business language)
   - Risks/issues (non-alarmist)
   - Decisions needed from client (if any)

2. Service Health Snapshot
   - Identity & access notes
   - Device management posture
   - Security themes at a high level

3. Work Completed (Outcomes, not tasks)
   - Outcome
   - Evidence reference
   - Business value

4. Open Items & Blockers
   - What’s stuck
   - Who owns it
   - Next trigger/date

5. Recommendations for Next Month
   - 3–5 pragmatic recommendations
   - Include effort (S/M/L) and impact (Low/Med/High)

6. Appendix: Evidence List
   - Files, meetings, and email subjects used

## Tone & constraints
- Australian English.
- No vendor hype.
- Client-safe wording only.

2) MSP Incident Communications Pack

Folder: /Documents/Cowork/Skills/msp-incident-comms-pack/
File: SKILL.md

---
name: MSP Incident Comms Pack
description: Drafts an MSP incident communications pack (client update + internal summary + next-steps checklist) with approval-safe wording.
---

## Purpose
Create consistent, calm, defensible communications during an incident.

## Inputs to request (ask if missing)
1. Client name
2. Incident label (short)
3. Timeline of events
4. Confirmed facts vs suspected items
5. Client audience
6. Desired update cadence

## Data gathering rules
- Use M365 artefacts only (emails, meetings, Teams messages, files).
- Do not invent technical detail.
- Ask for clarification where facts are missing.

## Outputs
### A) Client Update Email (Outlook draft)
Subject:
"Update: <Client> - <Incident> - <Date>"

Include:
- What we know
- What we’re doing
- What we need from the client
- Next update timing

### B) Internal Technician Summary (Teams)
- Incident label + severity
- Current status
- Owner and next actions
- Links to evidence

### C) Next-Steps Checklist (Word)
Include:
1. Containment
2. Investigation
3. Recovery
4. Communications
5. Post-incident follow-up

## Tone & constraints
- Calm, factual, non-alarmist.
- Australian English.
- No blame, no absolutes.

3) MSP Onboarding Kickstart Pack (SMB‑friendly)

Folder: /Documents/Cowork/Skills/msp-onboarding-kickstart-pack/
File: SKILL.md

---
name: MSP Onboarding Kickstart Pack
description: Creates an MSP onboarding pack including welcome email, onboarding schedule, folder structure, and checklists.
---

## Purpose
Deliver a consistent, professional first-30-days onboarding experience for SMB clients.

## Inputs to request (ask if missing)
1. Client name and primary contact
2. Services in scope
3. Target go-live date
4. Preferred meeting times
5. Tenant state (new or existing)

## Outputs
### A) Welcome Email (Outlook draft)
Include:
- Week 1 expectations
- Required client inputs
- Communication model
- Links to onboarding artefacts

### B) Onboarding Plan (Word)
Title:
"Onboarding Plan - <Client> - First 30 Days"

Break down by week:
- Meetings
- Deliverables
- Dependencies

### C) Folder Structure
Create or propose:
- 01 - Commercial & Contacts
- 02 - Tenant Baseline
- 03 - Security & Compliance
- 04 - Devices & Intune
- 05 - Documentation & SOPs
- 06 - Projects
- 07 - Reports

### D) Onboarding Checklist (Word)
Include:
- Identity baseline
- Device enrolment
- Security configuration
- Documentation completion
- Client sign-off points

## Rules
- Step-by-step.
- SMB-realistic (no enterprise bloat).
- Australian English.


Implementation reminder:
Each skill must live in its own folder under /Documents/Cowork/Skills/,
must be named SKILL.md, and should have a specific description so Cowork knows when to load it.

“