Clear the Runway. Then Cross the Gap.

Warm cartoon office scene with a person at a desk facing a blank document and a colleague cheerfully narrowing a messy whiteboard of sticky notes into three simple cards

I have a habit when someone tells me they are stuck. A client, a mate, a team member staring at a half-finished brief. My first instinct is almost always the same: strip friction out of the process. Make the first step smaller. Hand them a simple framework. Cut a few steps so starting feels less heavy.

That instinct is usually right. Most creative stuckness is external. Too many options. No clear place to put the work. A blank page that asks for a masterpiece before it will accept a rough sentence. In Microsoft 365 we spend a lot of time removing exactly that kind of friction, and we should.

Tools that clear the runway

Copilot in Word is a clean example. The blank document used to be the whole problem. Now you can point Copilot at a previous proposal, a Teams thread, or a SharePoint folder and ask for a first pass. The page is no longer empty. Outlook is similar — a reply draft appears before you have argued with the empty compose window for ten minutes.

Teams and Planner do the framework job. Instead of “we should write something,” you get a channel, a few checklist cards, and an owner. Power Automate cuts the busywork between systems so the human only shows up for the judgement call. SharePoint stops the scavenger hunt for last quarter’s file. External friction falls away. People move.

I have watched this pattern work again and again. Clear the runway and most people take off.

When the gap is inside

Sometimes they don’t. They know exactly what to write. They want to write it. The brief is sitting in SharePoint, the Word outline is already there, Copilot even offered a draft — and still nothing happens. The gap is not between them and the tool. It is between wanting and starting.

That is internal friction, and no amount of Microsoft 365 polish removes it on its own. You can have Copilot ready in Outlook, a Planner board tidy enough to make a project manager smile, and a Power Automate flow that files the finished piece. The document still stays closed.

People invent odd personal tricks for this. A side quest before the real work. A particular playlist. Opening the file and typing one deliberately bad sentence so the page is no longer sacred. Rewriting the same bullet three times in Teams before pasting it into Word. From the outside it looks inefficient. From the inside it is charm and coping mechanism mixed together — a private on-ramp the process diagram never shows.

Make it worth wanting

Here is the part I used to resist. If it is not fun, or at least interesting, it often will not get done. Sometimes the answer is not to make the work easier. Sometimes you make a small part harder on purpose, because that hardness makes you want to engage.

I will pick a fancier Word template than I need. I will draft the hard paragraph by hand first and only then ask Copilot in Word to tidy the rest. I will turn a dull status update into a short story for the Teams channel, even though a bullet list would have been faster. The extra friction is the point. It pulls me over the start line.

So when someone is stuck, I still reach for the external fixes first. Copilot, Planner, Power Automate, a cleaner SharePoint path — clear the runway. Then I ask a quieter question: are they blocked by the process, or by the private gap between wanting and starting? Tools handle the first. The second needs a personal tactic, and occasionally a little deliberate difficulty, so the work feels worth beginning.

Don’t Just Automate the Process. Build the Factory.

Cartoon of people organising matching binders on a workshop line with tidy shelves behind them

I still catch myself doing the clever version of the wrong thing. Someone shows me a pain point — a weekly report, a client onboarding checklist, a pile of the same Outlook replies — and the itch is to automate that path. One Power Automate flow. One Copilot prompt saved in a notebook. One private script that only I know how to run.

It works. Once. Then the process changes, the person who owned it leaves, or a second team needs the same outcome, and you’re back to heroic effort. You didn’t build a factory. You built a one-off machine in a corner of the shed.

A process is a recipe. A factory is how you ship.

When I say factory, I don’t mean a heavy program or a six-month transformation. I mean the boring layer that lets the same kind of work repeat without you reinventing it: where the inputs live, what “good” looks like, who can trigger it, and how Copilot or automation reaches the same materials every time.

In Microsoft 365 that usually looks unglamorous. A SharePoint library with a real structure instead of a dumping ground. A Teams channel where the working files and decisions actually sit. A Word or Loop template that already carries the sections you always need. Then Copilot in Word, Outlook, or Teams has something solid to work against — not a blank chat window and a hope that someone remembers the steps.

Automating a messy process just makes the mess faster. Building the factory means you fix the shape of the work first, then put Copilot and Power Automate on top of something stable.

What I watch people skip

The skip is almost always the same. They open Copilot Chat, describe the job in a long prompt, get a decent draft, and feel productive. Next week they write a slightly different long prompt. The week after, a junior asks how they did it, and the answer is a shrug and a screenshot.

Compare that to a factory move: the standard brief lives in SharePoint. The output template is a Word doc everyone can find. Power Automate drops a Planner task or a Teams message when a new request lands. Copilot is pointed at those artefacts — “draft from this template using the intake form in this library” — not at thin air.

I’ve seen MSP teams do the first version for client reporting and burn a Saturday. The ones who get time back are the ones who turned the second and third report into a product line: same intake, same store of evidence, same review checklist, Copilot filling the skeleton so humans only judge the exceptions.

Build once, run many

The test I use on myself is simple. If only I can run it, it isn’t a factory yet. If the knowledge is trapped in my chat history, it isn’t a factory yet. If swapping one person breaks the chain, we automated a habit, not a system.

So when someone asks me to “just automate this,” I try to answer with a smaller, harder question: where will the inputs live next month, and can Copilot find them without me? Until that answer is clear in SharePoint, Teams, or a shared template, I hold off on the clever flow.

Don’t just smooth one process. Build the factory for the thing — the place, the pattern, and the Copilot-ready materials — so the next ten times cost a fraction of the first.

New scripts: Headless SharePoint and Exchange Online connections on Linux, built for agents

Cartoon of a relaxed IT professional with a coffee while a laptop and small server work on their own

I’ve just added two new scripts to my Office365 repository on GitHub. One connects PowerShell to SharePoint Online using PnP PowerShell. The other connects to Exchange Online. Both run on Linux, and both use certificate-based, app-only authentication. There’s no browser, no typed password and no MFA prompt at connection time.

Why bother building Linux versions? Mostly because of agents.

Built for machines that nobody is sitting at

More and more of my admin work now gets done by autonomous agents like Grok Bot, running on a Linux computer that no person is logged into. An agent like that can write and run PowerShell happily enough. Where it gets stuck is sign-in. A pop-up browser window, a device code that someone has to type in, or an MFA approval on a phone all stop it in its tracks. Automation that needs a human to tap “approve” isn’t really automation.

Certificate-based app-only authentication fixes that. You register an app in Entra, upload the public half of a certificate, keep the private key on the machine, and the script connects as the app. I’ve covered the Windows side before in Certificate-Based Authentication for SharePoint Online: The Bit Everyone Avoids and A Cleaner Way to Connect PowerShell to Exchange Online. These new scripts are the Linux counterparts, built so an agent’s computer can connect and get on with the job unattended.

What the scripts do

Both scripts work the same way and have two main modes:

  • -GenerateLocalCertificate creates an RSA-2048/SHA256 certificate, a public .cer file and an encrypted .pfx using .NET, so you don’t need OpenSSL.
  • -UseCertificateAuth connects with the encrypted PFX: PnP.PowerShell for SharePoint, ExchangeOnlineManagement for Exchange.
  • -ProvisionEntraApp (optional) creates or reuses an Entra app, uploads the public certificate, grants the required permissions and saves a connection profile. This setup step uses a one-off device-code sign-in by an administrator.

For true headless runs, use -noprompt (alias -Headless). Supply the PFX password through a SecureString parameter, or name an environment variable with -CertificatePasswordEnvironmentVariable. The scripts never print or save that password. Saved profiles mean that, once set up, an agent can connect with little more than -UseCertificateAuth -ProfileName Contoso -Headless.

You’ll need Linux and PowerShell 7.4 or later (7.4.6+ for the PnP script), plus PnP.PowerShell 3.0.0+ or ExchangeOnlineManagement 3.5.0+. Missing modules install for the current user, with no sudo needed. Use -noupdate to skip update checks.

A word on security

Unattended access is powerful, so treat it with respect. The SharePoint provisioning grants Sites.FullControl.All, which means full control of every site. The Exchange provisioning grants Exchange.ManageAsApp and adds the app to Organization Management, which means full Exchange administration. The scripts keep certificates and profiles in dedicated folders locked to mode 700, with files at mode 600, and they refuse symbolic links there. Even so, that .pfx is effectively an admin key. Guard it, keep its password in a vault or a protected environment variable, and only put it on machines you trust. If your scenario needs less, trim the app’s permissions.

Get the scripts

To me, this is where Microsoft 365 administration is heading. More of the routine work will be done by agents on machines that nobody watches, and the bottleneck is getting them connected securely without a human in the loop. Take the scripts, try them in a test tenant, and let me know how you go.

The mystery of personal SharePoint skills

Screenshot 2026-09-25 075006

You can ask Copilot in SharePoint to create a personal skill as you see above. When you do so it is store in your OneDrive for Business.

Screenshot 2026-09-25 075244

Specifically in:

My files > Documents > Copilot > Agent Assets > Skills > <Skill name>

Interestingly, I can’t find this documented anywhere officially. All I can find is information about SharePoint site skills here (i.e. saved into a SharePoint site):

Extend Copilot in SharePoint with skills

and mentions nothing about personal SharePoint skills, just site skills per:

Skills are stored as Markdown (.md) files in the Agent Assets library on the site, under /Agent Assets/Skills/<skill-name>/SKILL.md

Such as the follow site skill in my SharePoint site:

Screenshot 2026-09-25 080629

Note – “on the SITE” and there no mention in the article of ‘personal SharePoint skills’. However, as you see in my screen shots, you can definitely ask SharePoint to create a personal skill and it ends up in your OneDrive for Business.

So, the best advice is that personal skills in SharePoint are currently an ‘undocumented’ feature and should be used with caution because they may not be supported going forward. Hopefully, we’ll see official documentation on SharePoint personal skills shortly.

Need to Know podcast–Episode 370

In this episode I ask the question about whether privacy is becoming and optional and take a deep dive into creating better data structures in places like SharePoint and Teams that help users and AI generate better results. There is also the usual look at recent cloud news from Microsoft and thoughts on how even all this is become about AI. Love your feedback.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-370-structure/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog

Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron

CIAOPS AI Dojo

CIAOPS weekly news update – CIA Brief – CIAOPS

CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS

Get your M365 questions answered via email

Join my email list

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com

Updates

Take control of your EWSAllowedAppIDs list before EWS access changes

Microsoft is changing how Exchange Web Services (EWS) access is managed. Organizations should review and manage their EWSAllowedAppIDs list now to ensure approved applications retain access and to avoid disruptions when the new controls take effect.

Link: https://techcommunity.microsoft.com/blog/exchange/take-control-of-your-ewsallowedappids-list-before-ews-access-changes/4553534

Understanding the new 100 GB mailbox entitlement for Microsoft 365 Business suites

Microsoft explains the introduction of 100 GB mailbox storage for eligible Microsoft 365 Business plans, outlining entitlement requirements and how organizations can benefit from increased mailbox capacity.

Link: https://techcommunity.microsoft.com/blog/exchange/understanding-the-new-100-gb-mailbox-entitlement-for-microsoft-365-business-suit/4548243

AI

Available today: OpenAI GPT-6 Astra in Microsoft Copilot

Microsoft has added OpenAI’s GPT-6 Astra model to Copilot, giving users access to an advanced foundation model designed to improve reasoning, content generation, and productivity experiences across Microsoft 365.

Link: https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/available-today-openai-gpt-6-astra-in-microsoft-copilot/4552808

Available today: Anthropic Claude Fable 5.1 in Microsoft Copilot

Anthropic’s Claude Fable 5.1 model is now available in Microsoft Copilot, expanding the range of AI models users can leverage for research, analysis, content creation, and complex business tasks.

Link: https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/available-today-anthropic-claude-fable-5-1-in-microsoft-copilot/4551974

Expanding model choice in Copilot with Grok

Access to Grok models is rolling out through the Microsoft Frontier Program in Microsoft Word, Excel, and PowerPoint. We are starting with a focused release to gather customer feedback and learn how customers use the model across common productivity scenarios.

https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/expanding-model-choice-in-copilot-with-grok/4555749

What’s New in Microsoft Copilot | August 2026

A monthly roundup of new Copilot capabilities, including model updates, workflow enhancements, productivity improvements, and new AI-powered features designed to help users work more effectively.

Link: https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/what%25E2%2580%2599s-new-in-microsoft-copilot–august-2026/4551960

Security

What’s new in Microsoft Security: August 2026

Microsoft’s monthly security update covering new capabilities across Defender, Sentinel, Entra, Security Copilot, and other security products, along with recent security announcements and enhancements.

Link: https://www.microsoft.com/en-us/security/blog/2026/08/27/whats-new-in-microsoft-security-august-2026/

Passkey-themed social engineering leads to identity and cloud compromise

Microsoft details a campaign where attackers used passkey-related social engineering techniques to trick users into compromising credentials and cloud identities, while also providing mitigation guidance.

Link: https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/

Protecting organizations from AI-assisted executive impersonation and invoice fraud

This security guidance examines how attackers are using AI to impersonate executives and conduct invoice fraud, alongside recommendations to help organizations detect and prevent these attacks.

Link: https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft analyzes how attackers impersonate IT support staff to gain remote access and expand their foothold within organizations, highlighting attack techniques and defensive measures.

Link: https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/

From CIAOPS

Image Model Comparison

A practical comparison of image generation models, reviewing differences in output quality, style, and effectiveness to help users evaluate which AI image generation model best suits their needs.

Link: https://directorcia.github.io/Office365/image-comparison.html

September webinar – local AI

https://blog.ciaops.com/2026/09/10/ciaops-need-to-know-microsoft-365-webinar-september-5/

Better Is a Direction, Not a Starting Point

image

I have made plenty of decisions that looked sensible at the time and less impressive a year later. Usually, I was working with the experience, evidence and tools I had then. The real test is not whether I got everything right on day one. The test is what I changed after new information arrived.

That distinction matters because hindsight can become a very comfortable hiding place. I can criticise an old process without doing anything differently today. Reflection only becomes useful when it alters the next action.

Progress needs some humility

In technology, yesterday’s good practice can become today’s unnecessary friction. A workflow built around emailed spreadsheets may once have been the most practical answer. Later, a shared file in SharePoint may remove version confusion. Then a well-designed process using Teams, Planner or Power Automate may make the work clearer again.

I do not think that means every earlier choice was a failure. It means the environment changed, the team learned and better options became available.

This is where humility matters. I need enough confidence to make a decision with incomplete information, but not so much confidence that I defend it forever. Experience should sharpen my judgement, not harden my position.

Copilot makes the learning visible

Microsoft 365 Copilot gives me a practical way to shorten this learning loop.

Imagine I have been preparing a weekly client update by opening several emails, reviewing Teams messages and rebuilding the same summary in Word. I may have done that for months because it worked. It was familiar and reliable.

Then I try a different approach. I ask Copilot in Outlook to summarise the relevant thread. I use Copilot in Teams to identify decisions and unresolved actions from a meeting. I bring the material into Word and ask for a first draft organised around progress, risks and next steps. I still review every line, because responsibility remains with me, but I have changed the process based on what I now know.

The first prompt may be average. The summary may miss context. My instructions may be too vague. That is not evidence that the whole idea is useless. It is feedback. I can refine the prompt, provide a better reference file, correct the structure and save the improved version for next week.

Getting value from Copilot is rarely one brilliant prompt. It is repeated adjustment inside real work.

Improvement is a behaviour

I often see businesses delay change because they are waiting for certainty. They want the perfect governance model, the perfect use case and the perfect training plan before anyone begins. I understand the caution, especially where client data, security and accuracy are involved. Some boundaries must be established first.

But perfection can also become an excuse. A small, governed trial with a real workflow can teach more than another month of abstract discussion. Use a low-risk task. Check the output. Note what failed. Update the instructions. Share the lesson in Teams. Repeat.

It is about creating a culture where changing your method after learning something new is considered sound judgement, not an admission of weakness.

I cannot demand flawless foresight from my earlier self, my team or my clients. I can demand honesty about what the evidence now shows. I can keep what still works, replace what does not and document why the change was made.

That is how useful progress happens. Not through shame about the past, and not through blind loyalty to it. I act responsibly with what I understand today, then make tomorrow’s work better when experience gives me a clearer view.

How SharePoint environments can be improved for Copilot results

image

The short answer is this:

Copilot results are only as good as the SharePoint environment underneath them. If your SharePoint is messy, overshared, full of duplicate files, stale content, and inconsistent naming, Copilot will surface messy, duplicate, stale content. If SharePoint is well-structured, governed, and maintained, Copilot becomes dramatically more useful.

From everything I’ve seen in SMB environments, improving SharePoint for Copilot usually delivers a bigger productivity gain than buying additional AI licences.

1. Fix permissions and oversharing first

This is the most important step.

Copilot doesn’t magically know what information is important. It relies on Microsoft Graph and existing permissions. If users can access content they shouldn’t, Copilot can discover and surface that content.

Common problems

  • Everyone has access to everything

  • Legacy project sites never cleaned up

  • Anonymous sharing links still active

  • “Everyone except external users” permissions

  • Former employees still own sites

What to do

  • Review site permissions

  • Remove unnecessary access

  • Review sharing links

  • Remove broad access groups

  • Identify inactive sites

  • Implement site lifecycle management

SharePoint Advanced Management and Data Access Governance reports were specifically highlighted as ways to identify oversharing risks before Copilot rollout.


2. Create a proper information architecture

Many organisations have:

Documents
├── New Folder
├── Old Stuff
├── Final
├── Final V2
├── Copy of Final
└── Misc

Copilot struggles because the business itself has no structure.

Instead build:

Finance Hub
├── Budget Planning
├── Forecasting
├── Reporting
└── Policies

Sales Hub
├── Proposals
├── Customers
├── Pricing
└── Marketing

The clearer the structure, the easier it is for:

  • SharePoint Search

  • Microsoft Search

  • Copilot Chat

  • SharePoint Agents

  • Copilot Agents

to locate relevant content.


3. Improve file naming standards

Copilot does read document content, but filenames still matter.

Bad:

Proposal.docx
Proposal New.docx
Proposal Final.docx
Proposal Final Final.docx

Good:

CustomerName-Proposal-2026-07.docx
CustomerName-SOW-v1.docx
CustomerName-SOW-Approved.docx

In one of your SharePoint discussions, naming conventions were specifically called out as something that should be standardised across the site.


4. Use metadata instead of folders where possible

Metadata is one of the biggest Copilot improvements available.

Rather than:

Projects
 ├── Sydney
 ├── Melbourne
 ├── Brisbane

Use columns such as:

Column
Value

Client
ABC

Region
Sydney

Project Type
Migration

Status
Active

This gives Copilot richer context when searching and grounding answers.

Instead of finding a file based only on its location, Copilot can reason over:

  • client

  • project type

  • status

  • department

  • business owner


5. Remove stale content

One major challenge is outdated content appearing in search results.

Microsoft now provides features that recommend:

  • demoting inactive pages

  • identifying content gaps

  • fixing broken links

to improve discoverability and Copilot relevance.

Ask yourself:

  • Is this document still current?

  • Is there a newer version?

  • Does anyone own it?

  • Should it be archived?

A common issue is Copilot finding a policy from 2019 while a better one exists from 2026.


6. Identify authoritative sources

One of the newest improvements is the ability to mark SharePoint sites as authoritative.

Examples:

  • HR

  • Finance

  • Legal

  • Corporate Communications

Content from these sites can be prioritised in Copilot Search and Copilot Chat results.

For example:

Site
Why make it authoritative?

HR
Official policies

Finance
Budgets and governance

Legal
Contracts

Company Communications
Executive announcements

This helps reduce contradictory responses.


7. Apply sensitivity labels

Copilot respects sensitivity labels and information protection controls.

Typical labels:

  • Public

  • Internal

  • Confidential

  • Highly Confidential

Benefits include:

  • Better governance

  • Controlled sharing

  • AI visibility controls

  • Better compliance outcomes


8. Improve search quality

Copilot depends heavily on Microsoft Search.

Poor search equals poor Copilot.

Things that help:

Create quality pages

Instead of storing everything in Word documents:

  • Create SharePoint pages

  • Add summaries

  • Add FAQs

  • Add ownership information
Add page owners

Every key page should have:

  • business owner

  • review date

  • contact person
Use meaningful titles

Bad:

Welcome
General Information
Policies

Good:

Employee Leave Policy
Expense Claim Procedure
Remote Work Guidelines


9. Build hub sites

Hub sites create logical business groupings.

Example:

Corporate Hub
 ├── HR
 ├── Finance
 ├── Operations
 └── IT

Customer Hub
 ├── Sales
 ├── Marketing
 └── Service

Hub sites improve navigation, search context and content relevance for Copilot.


10. Create SharePoint agents for specialised knowledge

Where a user only needs answers from a particular area, create a SharePoint Agent.

Examples:

  • HR Agent

  • Policy Agent

  • Finance Agent

  • Project Agent

These agents ground themselves on specific SharePoint locations and often produce more accurate answers than tenant-wide searches.


11. Add more organisational context

Copilot works best when content explains:

  • who owns it

  • what it is for

  • where it applies

  • when it was reviewed

Bad document:

Procedure.docx

Good document:

Financial Approval Process
Owner: Finance
Review Date: July 2026
Applies To: Australia Operations

The extra context significantly improves grounding quality.


12. Measure and improve continuously

The best Copilot environments are not set-and-forget.

Establish a quarterly process:

Review
  • Oversharing

  • Inactive sites

  • Broken links

  • Orphaned content
Clean up
  • Duplicate files

  • Old projects

  • Stale policies
Improve
  • Metadata

  • Authority sites

  • Labels

  • Search experience

Data Access Governance reports and Content Management assessments are specifically designed for this ongoing process.

My practical SMB recommendation

If I were preparing a tenant for Copilot today, I’d prioritise:

  1. Permission cleanup

  2. Oversharing remediation

  3. Sensitivity labels

  4. Review inactive sites

  5. Standard naming conventions

  6. Create hub sites

  7. Add metadata

  8. Designate authoritative sites

  9. Build targeted SharePoint agents

  10. Quarterly governance review

In most SMB tenants, doing just those ten things improves Copilot results more than any prompt engineering or user training because you’re improving the quality of the information Copilot can see and trust.