Before you buy. One licence, organisation-wide: as many of your own people as you like, on your own Microsoft 365 tenants, no seat count. It covers the legal entity that pays, and a group of separate legal entities is not one organisation, so it does not reach your parent, your subsidiaries or your sister companies: write to mathieu@kesslernity.com before you buy for a group. What it does not cover is work you do for somebody else. You may not resell it, you may not deliver it as paid training or paid consulting outside your own organisation, and it does not reach client tenants you administer. The settings baseline is stamped August 2026, and the refresh commitment is two refreshed editions a year, at no additional cost, for as long as the kit is on sale: Article 8 of the Terms is what binds it, not this box. A refreshed edition re-reads the checks RISKS.md marks volatile and re-stamps what moved, and it is not a rewrite of the whole kit. Priced in US dollars. Not legal advice. Not affiliated with Microsoft. Full terms: kesslernity.com/license The Copilot Hardening Baseline 176 checks for the Microsoft 365 Copilot admin surface. Every one you assess names the baseline to set and how to prove the current state in your tenant. Where Microsoft publishes a default, the check names it and cites the page it came from. Where Microsoft publishes none, the check says so. $199 US dollars for one licence covering your whole organisation. Copilot and its agents reach whatever your tenant lets them reach. The settings that decide that are scattered across six consoles: the Microsoft 365 admin center, the Microsoft Entra admin center, the Microsoft Purview portal, the SharePoint admin center, the Power Platform admin center and Microsoft Copilot Studio. Microsoft documents them a page at a time and no page holds the list. So the licences go live, and some weeks later somebody asks who approved the agent answering HR questions, which sites it can read, and what it cost last month. Those answers sit in your own tenant. The fortnight of clicking goes on working out which settings hold them and which console each one lives in. This kit is that worked-out list: 176 checks in the order an administrator would run them, each one naming what to set and what to record. What is in it The guide, 282 pages. 8 sections, with the agents section split into 3 chapters. Foundation and tenant readiness. Copilot settings. Agents: inventory and discovery, tenant-level policy, then lifecycle, deployment and maker governance. Data protection and oversharing. Consumption and billing controls. The EU chapter. The durable layer of roles, decision rights and runbooks. It opens on the 12 checks where the wrong setting reaches every user in the tenant. The tracker, copilot-hardening-tracker.xlsx. The same 176 checks as rows, 18 columns. 167 of those rows are yours to assess, and the dashboard counts scope at that figure. The other 9 are the same control reached from a second section, flagged as duplicates and set to N/A so you never assess one twice. The baseline columns are locked so nobody edits the standard by accident, the columns you fill in are dropdowns, and two are computed: effective priority, and the signal the dashboard reads. 6 sheets, one of them the hidden list the dropdowns read from. The dashboard is live formulas for compliance by section and gaps by priority, and the decisions log is where a control you accept as a risk goes instead of staying an unexplained gap. That log is what makes the position defensible to an auditor, and a gap with no decision behind it is an integrity error the dashboard counts. RISKS.md, the volatility register. 148 of the checks are graded for how fast they go stale, each with what would have to change for it to be wrong and the Microsoft page to re-read. It ships to you rather than staying an internal file, which is the part most kits leave out. Four policy templates in Word and markdown: acceptable use, agent approval and lifecycle, data handling, consumption and spend. Placeholders for your organisation's name, and you edit them into your house style and publish them internally as your own. 38 screenshots of the admin surface as it renders today, each under Microsoft's published permission terms and carrying the attribution Microsoft requires. One check, shortened but not rewritten Check S2-18, priority P1, fix class Toggle. Everything after each bold label below is the row's own text, cut for length in places and edited nowhere. The first bullet is the row's own provenance note, printed here because a console reading with no date and no tenant behind it is worth nothing. How the readings were taken. TENANT-OBSERVED 2026-08-20, trial tenant, Copilot SKU NONE, the console was never opened before the read: the panel opens from the scenario list's own entry and nothing else. The setting. The scenario is titled Vision in Microsoft 365 Copilot; the control is Screen and camera sharing. Both names appear on the same documentation page. What the console did not print on 2026-08-20: the word Vision renders nowhere on the console. Not on the list entry, not on the panel heading, not on either control label. Where it lives. Microsoft 365 admin center > Copilot > Settings > Copilot actions > Screen and camera sharing. Copilot actions is how the documentation groups the scenarios and it is not a route. Use the View all pivot on this blade and find the scenario in the list. What Microsoft publishes. On. Microsoft states vision is on by default and no action is required to enable it. What the console rendered on 2026-08-20: that panel holds two controls and not one, Screens and Cameras, each offering All users, No users and Specific groups, and both ship on All users with Save rendered disabled. What one tenant settles and what it does not. One tenant reads a state and does not establish a Microsoft default, and here it does not have to: Microsoft publishes this one, and the reading corroborates it. The baseline to set. Turn Screens and Cameras off, then re-enable for a named group with a use case. Screens and Cameras are separate controls with separate values, so an admin who sets Screens to No users and stops has left the camera open, which is the limb that catches bystanders. Why it is graded P1. A user points a phone camera at a colleague's screen, a printed document or a whiteboard and the contents become prompt input. On a shared screen that can include another customer's data. How to prove the current state. Screenshot the Screen and camera sharing setting. Confirm on a test mobile account whether the camera option appears. Artifact: screenshot of both. Record two values, one per limb, and check Save is disabled before you write either down. One row of 176, and the shape every assessable row is written in. The distance between what Microsoft's page documents and what the blade renders is why this took a fortnight of clicking rather than an afternoon of reading. Where it is honest, which is the part that took the time Microsoft publishes no default value for 80 of the checks. Those rows say so instead of inventing one, and they tell you what to record when you read your own tenant. 15 places where Microsoft's own pages contradict each other are written up as numbered conflicts. 4 were settled by reading a live tenant, with the frame in the guide. The rest are recorded open, with both readings and what would settle them. Anything that could not be confirmed carries an UNVERIFIED flag in its own row, defined on the tracker's legend sheet. Who it is for. You hold tenant admin on Microsoft 365, Copilot is live or about to be, and somebody has asked you a question you cannot answer from one console. It suits the administrator, the IT manager signing off the rollout, and the governance or risk lead who needs the artifacts rather than the theory. Who it is not for. It is not user training, not a prompt library, and not a compliance certification. It does not audit your tenant for you: you run the checks and record what you find. If you harden Microsoft 365 for other organisations, this licence does not cover that work, and the terms below say so before you pay rather than after. The whole pre-purchase disclosure is below, and it is longer than most because it says what the licence does not cover. Before you buy, in full What you get. One licence, organisation-wide, $199 US dollars. There is no per-seat tier and there is no seat count: the organisation that pays may put this kit in front of as many of its own people as it likes, employees and contractors, working on that organisation's own Microsoft 365 tenants. Use it, adapt it, print it, put it on your intranet. What you may not do with it. You may not resell this kit, as it stands or edited, on any store, marketplace or public site. You may not deliver it as paid training, a paid workshop or a paid engagement to people outside your own organisation. And it does not reach your clients' tenants: if you harden Microsoft 365 for other organisations, whether as a consultancy, a managed service provider or an independent consultant, this licence does not cover that work. That is a breach rather than a grey area, and it is also a solved problem. A separate premium tier in the Terms covers selling paid training and client delivery built on a Kesslernity product. This kit is not sold under that tier today, so if client work is what you want it for, write to mathieu@kesslernity.com and ask before you buy this one. A group of separate legal entities is not one organisation. The licence covers the legal entity that pays, not its parent, its subsidiaries or its sister companies. The entity that pays is the entity covered, so buy in the name of the entity you want covered: if a parent company's card pays for a subsidiary's copy, the parent holds the licence and the subsidiary does not. If you are buying for a group and want it to reach them, write to mathieu@kesslernity.com first. It gets answered, asking costs you nothing, and it is a far better question to settle before you pay than after you have distributed it. The four policy templates are yours to rewrite. policies/ holds acceptable use, agent approval and lifecycle, data handling, and consumption and spend, each one in Word and in markdown. Edit them into your house style, put your own document control header and your own logo on them, renumber them, cut what does not apply, and publish the result on your intranet as your own internal policy. No Kesslernity credit is required on an internal policy document. What you may not do is hand an edited template to another organisation as a template. Refresh commitment. The settings baseline is stamped August 2026, and the Microsoft 365 admin surface moves, so the kit is refreshed on a clock: two refreshed editions a year, at no additional cost, for as long as the kit is on sale at store.kesslernity.com, one edition in the first half of the year and one in the second. Every edition published while it is on sale is yours. Each one is a new edition of the same product rather than a second purchase, and it is put on the download you already hold, so you re-download it from your library. If the kit is retired we say so on this page, and the commitment ends with the last edition published before that date. Article 8 of the Terms is what binds this, this block is the wording it binds, and the version of both in force on the day you buy is what governs your purchase. An email when an edition lands is a courtesy and not the commitment, because a buyer who opted out of product email cannot be reached. What a refreshed edition is, so the words above promise no more than they deliver. An edition re-reads every check RISKS.md marks volatile against the Microsoft page that check names, and re-stamps the dated layer and the tracker in the same pass. It is not a rewrite of the durable guidance, which carries no date, and it is not a new check for every Microsoft release. A refresh is also not support and not a review of your own tenant, and no edition of this kit promises that a setting named in it still exists. RISKS.md ships in the kit, so you can run that same re-read between editions rather than waiting for one. It is not legal advice. It names practices, tenant configurations and the artifacts an auditor or a DPO asks for. It does not tell you that a configuration is lawful, adequate or compliant, and it cannot: that judgment belongs to your own counsel and your own data protection officer, who know your processing and your regulator. Nothing in it supports using an assistant or an agent to authorise work. Permits to work, lockout and tagout, confined space entry, job safety analysis, incident classification and inspection sign-off stay with a named human who can explain the decision afterwards. An assistant prepares. A human decides. Microsoft's screens and Microsoft's names. The kit carries screenshots of Microsoft 365 admin surfaces. They appear under Microsoft's published permission terms for the use of their screen content, and each one carries the attribution Microsoft requires. Kesslernity Limited holds no rights over Microsoft's screen content and grants you none, so if you want to lift a frame out of this kit and put it in your own deck, you look Microsoft's terms up yourself. Kesslernity Limited is an independent publisher, not affiliated with, sponsored by or endorsed by Microsoft. Microsoft, Microsoft 365, Microsoft 365 Copilot, Microsoft Purview and Microsoft Entra are trademarks of the Microsoft group of companies. Refunds, and what governs. The price is set and charged in US dollars, and if your card settles in another currency your bank sets the rate and may add its own fee, which is between you and your bank. Gumroad is the merchant of record and handles payment and first-line refund support, and Gumroad is where any sales tax or VAT it is required to collect is calculated and shown to you before you confirm. The full Kesslernity License and Terms are published at kesslernity.com/license under reference KESS-LIC-2026-001, and the version in force on the day you buy is the version that governs your purchase. Where anything above appears to say something different from the published Terms, the Terms win. Your rights under the consumer law where you live are not touched by any of this.