LicencesIllustrative sample
Pay only for seats in use
Licensed-but-unused and disabled-but-licensed accounts, listed for review.
Before“We think some seats are idle.”
After22 of 120 seats are review candidates
OPSPILOT · AI MANAGEMENT FOR MICROSOFT 365, AZURE AND CLOUD
Microsoft 365, Azure and cloud estate AI managementyou can check, and approve.
Microsoft 365 AI management, sometimes searched as Office 365 AI management, means knowing what Copilot and the rest of your tenant are doing, and what to fix first. The same idea extends to Azure and the wider cloud estate. OpsPilot is Cloudek’s read-only workspace for it: Microsoft 365 reports are built today, with Azure, AWS and on-premises reading still to come. It turns settings into plain-English findings, ranks them, shows the evidence and leaves every change to a named person. This page uses a fictional company.
- Read-only access
- Evidence on every finding
- A person approves every change
- Identity68
- Access82
- Apps52
- Licences86
Fix first (sample)
- 12 admin accounts have no MFA method registeredEntra ID
- 23 app secrets end within 60 daysApps
- 314 licensed accounts quiet for 90+ daysLicences
THE SHORT ANSWER
What is Microsoft 365
AI management?
It covers two jobs. One is governing the AI already in your tenant, mainly Microsoft 365 Copilot: who has it, who uses it and what it can reach. The other is using AI to explain tenant reports in plain English. Both depend on an accurate, current picture of licences, identities, access and security settings.
AI cloud estate management is the same job across more places: Microsoft 365, Azure subscriptions, other clouds and on-premises servers, read in one consistent, evidence-first way.
OpsPilot is built around that picture. It reads, ranks and explains; people decide. For the buying side, see the comparison of Microsoft 365 Copilot, Copilot Studio and Azure AI Foundry and when Copilot is not the right tool.
What to manage: a checklist
- Copilot readiness and licence value. Who holds a licence, who used it in the last 7 days, and who is licensed but quiet.
- Data access. Copilot works within existing permissions, so broad sharing in SharePoint needs a look first. See finding SharePoint oversharing.
- Entra ID identity hygiene. MFA coverage, admin roles, guests, stale and unowned accounts.
- Licence reporting. Unused seats and disabled accounts that still hold licences.
- Security posture. Secure Score actions, Conditional Access gaps and legacy sign-in.
- Agents and credits. Plan Copilot Studio use with the credit estimator and compare it with Foundry for building agents.
HOW IT WORKS
How OpsPilot approaches it:
question, evidence, decision.
- Connect read-onlyRead permissions only, for the platforms you choose, agreed in writing first.
- AskPick a question or a report. Checks are fixed, named, read-only queries.
- See the evidenceEach finding shows what was read, when, and what could not be checked.
- ApproveNothing changes unless a named person approves a separate, scoped piece of work.
SAMPLE OUTCOMES
Microsoft 365 tenant reporting,
in sample outcomes.
Every figure below is invented for a fictional company, “Example Ltd”. They show the shape of a finding, not a result anyone has achieved.
IdentityIllustrative sample
Entra ID: close the MFA gaps
Who can sign in without a second factor, admins first.
Before“Is everyone on MFA?”
After2 of 9 admins have no method registered
AccountsIllustrative sample
Retire stale accounts
Enabled accounts quiet for 90 and 180 days, with service accounts flagged.
BeforeOld accounts nobody owns.
After23 enabled accounts quiet for 90+ days
CopilotIllustrative sample
Copilot readiness and licence value
Licences assigned against people actually using it in the last 7 days.
Before“Is Copilot being used?”
After22 of 40 licensed people active in 7 days
Secure ScoreIllustrative sample
Secure Score quick wins
Controls ranked by points gained per unit of effort and user impact.
BeforeA long list of recommendations.
After5 quick wins ranked by effort
Sign-in policyIllustrative sample
Find legacy sign-in paths
Legacy authentication use and Conditional Access coverage gaps.
BeforeUnknown old protocols.
After4 legacy sign-ins traced to 2 sources
ServersPlanned
Retire Windows Server 2016
Planned: a read-only on-premises agent (design only today). Try the planning tools in your browser now.
TodayBrowser-based, nothing uploaded to Cloudek
CertificatesPlanned
Never miss a certificate expiry
Planned: expiry watching from read-only inventory. Analyse your own inventory in the browser today.
TodayBrowser-based inventory analyser
AZURE AND THE WIDER CLOUD ESTATE
Azure and cloud estate AI management,
where OpsPilot is heading.
Microsoft 365 reports are built. Azure reading is in development: a design using Azure Reader at a chosen resource group, not yet available to customers. AWS, other clouds and on-premises servers are planned. All figures are invented for “Example Ltd”.
AzureIllustrative sample
In developmentAzure subscriptions and what changed
Resource inventory and changes at a chosen scope, read with Azure Reader.
Before“What is in this subscription, and what moved?”
After41 resources, 7 changed since last month
CostIllustrative sample
In developmentCost and idle resources
Review candidates such as stopped VMs and unattached disks. Never claimed savings.
BeforeIdle resources nobody owns.
After9 idle resources listed for review
PostureIllustrative sample
PlannedDefender for Cloud and Secure Score posture
Cloud security recommendations ranked next to your Microsoft 365 Secure Score.
BeforeTwo portals, two lists.
AfterOne ranked list of 6 actions
Hybrid identityIllustrative sample
Azure side in developmentEntra ID and hybrid identity
Synced and cloud-only accounts side by side, from the Microsoft 365 hybrid sync review.
Before“Which accounts exist only on-premises?”
After12 cloud-only, 3 synced but disabled
AWS and othersIllustrative sample
PlannedAWS and other clouds
Read-only account and identity inventory, in the same evidence-first format.
BeforeEach cloud, its own console.
After1 view, with “not checked” where no access exists
On-premisesIllustrative sample
PlannedOn-premises servers
Patch status, backups and certificates from a read-only agent (design only).
Before“Which servers missed the patch window?”
After3 of 12 servers behind
Go deeper: Hyper-V vs Azure VMs vs Azure Local, three-year cost · Azure security defaults · Hybrid Azure AD prerequisites · Azure identity protection · SIEM cost without blind spots · Windows Server licensing calculator · Azure and hybrid assessment · Ongoing infrastructure support
ASK, WITH EVIDENCE
Ask your tenant and cloud estate a question.
Read the answer and its limits.
Sample answers for Example Ltd. Each one names what was read and what was not checked.
Sample answerIllustrative sample
2 of 9 admin accounts have no MFA method
Two accounts hold privileged roles but have no registered authentication method beyond a password. Start with the break-glass review, then the two named accounts.
- ReadEntra ID · authentication methods
- ReadDirectory role assignments
- Not checkedThird-party MFA tools
3 app secrets end within 60 days
Three registrations have a latest credential ending soon. Each lists who to ask, because owners are counted rather than named.
- ReadApp registrations · credential end dates
- ReadOwner counts
- Not checkedKey Vault rotation jobs
22 of 40 licensed people were active in 7 days
Activity is not the same as value, so the answer is a prompt for a conversation with the team, not a verdict. The window is 7 days only.
- ReadLicence assignments
- ReadCopilot usage counts · aggregate
- Not checkedPer-person prompts or content
2 open advisories, grouped by service
One mail-flow advisory and one Teams incident are open. Each lists its status, last update and what to check next.
- ReadService health · overview and issues
- Not checkedRoot cause (not promised)
In development
7 of 41 resources changed in the last 30 days
Four were new, two were reconfigured and one was deleted. Each lists who made the change and when, as recorded in the activity log.
- ReadAzure resource inventory · one resource group
- ReadActivity log
- Not checkedAWS (no access granted)
In development
9 resources are review candidates for idleness
Stopped VMs and unattached disks are listed with their last activity. They are candidates to review, not savings, and a person decides.
- ReadAzure resource inventory
- ReadResource metrics · fixed window
- Not checkedReservations and pricing
Planned
3 of 12 servers missed the last patch window
Across cloud VMs and on-premises servers, three are behind. The on-premises part needs a read-only agent that is design only today.
- ReadAzure VM update status
- ReadOn-premises agent · patch status
- Not checkedAWS EC2 (no access granted)
BEFORE AND AFTER
Microsoft 365 licence reporting:
from “I think we overpay” to a review list.
OpsPilot lists review candidates, never claimed savings. A person decides what to reassign or remove, ideally ahead of a renewal.
Licence review · Example LtdIllustrative sample
120 licences assigned. Who needs them?
No view of who has stopped signing in, or which leavers still hold a licence.
22 review candidates out of 120
Limits shown with the list: sign-in data lags, and service or break-glass accounts may look quiet on purpose.
TIMELINE EXAMPLE
A clear plan before
a deadline arrives.
Windows Server 2016 extended support ends on 12 January 2027. This is how an inventory could become an ordered plan.
- Step 1 · InventoryList every Server 2016 machine and roleRead-only inventory, no changes to servers.
- Step 2 · DecideMigrate, upgrade in place or retire, per roleEach choice names its reason and risk.
- Step 3 · ApproveA named person approves the workScope, window and rollback agreed first.
- 12 Jan 2027Extended support endsAnything left needs an extended-security plan.
Sample inventory · Example LtdPlanned
| Server | Role | Starting view |
|---|---|---|
| EX-FS01 | File server | Migrate |
| EX-DC02 | Domain controller | Migrate |
| EX-PRN01 | Print server | Either |
| EX-APP03 | Line-of-business app | Ask vendor |
Illustrative sample The on-premises agent behind this is a design, not a product. The browser planner linked above is separate and works today.
THE REPORT LIBRARY
Entra ID and licence reporting:
reports OpsPilot is built to produce.
Each is a fixed, read-only check. Which ones run for your tenant is confirmed in writing before any access.
- Executive summaryOne explainable grade, a fix-first list and what was not run.
- Identity security and MFA gapsSign-in methods and weak spots, admins first.
- Stale and unused accountsQuiet, never-signed-in and licensed-but-unused.
- Privileged accessStanding and eligible admin roles.
- Conditional Access gapsCoverage and what policies leave open.
- Legacy authenticationOld protocols still signing in.
- Guest and collaboration sprawlExternal guests and public groups.
- App credentialsSecrets and certificates nearing their end date.
- Unowned apps and groupsObjects with nobody to ask.
- Hybrid identity syncSynced and cloud-only accounts side by side.
- Service health digestOpen incidents by service, with next checks.
- Copilot adoption and licence valueLicences against 7-day activity.
- Secure Score actionsControls ranked as quick wins.
- Licence and offboardingSeats by product and leaver checklists.
TRUST BY DESIGN
Built to look,
never to touch.
Read-only access
Reports use read permissions. OpsPilot checks do not change your environment; any change needs a separate, approved scope.
Fixed, named queries
No free-form Microsoft Graph queries or PowerShell. AI-generated commands are not run silently.
Evidence and limits
Findings show their source, when it was read and what could not be checked. AI can be wrong, so check consequential results.
A person approves
Suggestions are drafts for review. Nothing is applied until a named person approves it.
Access in writing
Nothing connects to your tenant through this website. Access, scope and fees are agreed in writing first.
No login, no sign-up
OpsPilot is Cloudek’s own workspace. There is no customer login on this page.
Read permissions the reports are built around (Microsoft Graph), plus Azure Reader at a chosen resource group:
- Application.Read.All
- AuditLog.Read.All
- Group.Read.All
- LicenseAssignment.Read.All
- Policy.Read.All
- Reports.Read.All
- RoleManagement.Read.Directory
- SecurityEvents.Read.All
- SecurityIncident.Read.All
- ServiceHealth.Read.All
- User.Read.All
Only those needed for the reports agreed are requested. See the trust centre for how data is handled and which third-party services are involved.
WHO IT IS FOR
For the people who
answer for the estate.
IT leads
Small teams with a big estate and no time to open ten admin centres. A ranked list replaces guesswork.
Organisations with managed IT
A shared, evidence-first view between your team and Cloudek, with clear ownership of every next step.
Security and compliance owners
Dated evidence to support reviews. OpsPilot does not make an organisation compliant, and Cloudek holds no certification or attestation to offer.
- PlannedRead-only on-premises agent for servers, patching and certificates (design only).
- PlannedRepeat snapshots to show security posture over time.
- ConceptChange risk preview before anyone approves. See the roadmap.
QUESTIONS
Straight answers.
Can I buy or sign up for OpsPilot?
No. It is Cloudek’s own operations workspace and this page shows direction. There is no self-serve sign-up and no customer login. Talk to us about what you would want to ask your estate and what is feasible.
Does it change anything in my tenant?
No. The checks are read-only. Any change would be a separate piece of work, scoped and approved by a named person first.
What access would it need?
Read permissions only, for the reports agreed, listed above. Access and scope are confirmed in writing before anything connects.
Are all these reports ready to run on my tenant?
Not necessarily. Reports are built and tested at different stages. We say plainly which are ready for your environment and which are still being proven.
Where does AI come in?
AI explains findings in plain English and points to the evidence. It can be wrong. It is not given tools and does not run commands.
Does it make us compliant?
No. It surfaces evidence for your own review. Cloudek holds no compliance certification to pass on to you.
Are the numbers on this page real?
No. Every figure is invented for a fictional company called Example Ltd and marked as an illustrative sample.
What does Microsoft 365 Copilot management and governance involve?
It involves knowing who is licensed and who uses Copilot, what data they can reach, and which settings and policies apply. OpsPilot reports the licence, activity, access and security parts read-only. Policy decisions stay with your team.
Can OpsPilot report on Copilot readiness and licence value?
It is built to compare Copilot licences assigned with 7-day aggregate activity and to list licensed people who look inactive. Activity is not value, so the result is a starting point for a conversation, not a verdict.
Can OpsPilot manage Azure as well as Microsoft 365?
Microsoft 365 reports are built. Azure reading is in development and not yet available to customers: the design uses the built-in Reader role at a resource group you choose, so it can see inventory and activity but change nothing. “Manage” here means read, rank and explain; changes stay with people.
What is AI cloud estate management?
It is the practice of keeping one accurate, current view of everything you run across Microsoft 365, Azure, other clouds and on-premises servers, and using AI to explain it in plain English. OpsPilot’s approach is read-only, evidence-first and approved by a person.
How is this different from Microsoft Copilot in Azure?
Microsoft Copilot in Azure is Microsoft’s own assistant inside the Azure portal. OpsPilot is a separate, Cloudek-run reporting workspace that reads across Microsoft 365 and, in time, other platforms, shows its evidence and limits, and drafts changes for a person to approve. They can be used side by side.
Will OpsPilot cover AWS and on-premises servers?
Both are planned, not built. AWS would be read-only account and identity inventory; on-premises servers would need a read-only agent, which is a design today. See the roadmap for status.
LET’S TALK
What would you ask
your estate first?
Tell us the question that keeps coming up. We will talk through what could be read, what could not, and how it would be scoped and agreed in writing.
Updated · Last reviewed
This page describes direction, not an offer or a product you can buy. Screens use fictional sample data and are not real results. Availability, scope, fees and responsibilities are agreed in writing for each engagement. AI output can be wrong or out of date.