Customer Zero Starter Kit
Use your internal Copilot governance, security, training, and agent-readiness proof to build customer conversations, fixed-fee projects, enablement packages, and recurring managed governance.
The customer conversation is not "we have a tool." It is: we ran this on ourselves first, found the same exposure you are likely carrying, fixed it in a measurable order, trained our own users, governed AI demand, and built the management cadence to keep it from drifting. That lived proof is what makes the practice sellable.
"The deployment is not the asset; the documented experience is."
Customer Zero capture disciplineCustomer Zero becomes a business when you capture the work while doing it. The deployment is not the asset; the documented experience is. Capture the before-state, exact steps, time-on-task, gotchas, after-state, decision rationale, training questions, champion wins, and anonymized proof.
Do not sell "Copilot deployment" as the headline. Lead with governed Copilot experiences grounded in trusted business data: your own before-state, your own remediation order, your own training motion, your own management cadence, and your own customer-safe proof. Customer Zero is not just credibility; it is the positioning Microsoft is asking partners to lead with.
Re-verify all partner-asset links before any customer proposal: aka.ms/SOW-Generator, aka.ms/MIP-Labeling-Assistant, aka.ms/MIP-Industry-OnePagers, aka.ms/Deploy-Scripts, aka.ms/Github-CopilotCli-Guide, and the SMB Information Protection asset pack are partner-login-gated and temporary. The Customer Zero sequencing, capture discipline, maturity gate, and GTM ladder are practitioner-consensus synthesis distilled for this motion, not Microsoft doctrine.
Use this as the rule for every internal activity: if it would help a customer believe the motion, scope the work, train a user, or trust the result, capture it while it happens.
| Capture type | What it is | Why it matters commercially | What it becomes |
|---|---|---|---|
| Time-on-task | How long each scan, remediation, label simulation, training build, review, and report actually took. | Lets your CFO and practice lead price fixed-fee work from measured delivery reality. | Scoping tables, margin guardrails, delivery staffing assumptions. |
| Before/after deltas | Dated evidence that exposure, Secure Score, label coverage, or shadow-AI posture changed. | Creates the proof slide that turns an abstract risk into a customer decision. | Assessment deck, remediation proof-of-value, QBR story. |
| Decision logs | Why an app was sanctioned or blocked, why a label was tuned, why a control was enforced, why an exception was accepted. | Makes delivery repeatable beyond one senior consultant and protects you from vague promises. | AUP starter, taxonomy rationale, governance runbook, support script. |
| Anonymized proof | Heat maps, screenshots, training artifacts, champion examples, trend reports, and management-plane outputs with identifiers stripped. | Gives your sales team credible proof without exposing your tenant or any customer. | Sales collateral, sample deliverables, workshop material, executive proof. |
Anonymize on capture, not later. A real tenant name, site name, person name, or sensitive figure baked into a master artifact makes it harder to reuse and creates its own exposure. Strip identifiers the moment you bank the proof.
This is the practical conversion table: internal work becomes proof, proof becomes a customer deliverable, and deliverables become services. The governance catalog is distinct from the adoption add-ons so the three bright lines stay legible: assess cheap -> remediate/label fixed-fee -> govern recurring.
| Internal Customer Zero activity | Customer pain it proves | Captured artifact | Sellable deliverable | Service offering |
|---|---|---|---|---|
| Governance Catalog | ||||
| Ran readiness and exposure scans before change | "We do not know what Copilot could expose." | Heat map, scan notes, license-boundary notes | Executive exposure assessment and risk-readiness briefing | Copilot Exposure Assessment |
| Restricted worst sites and remediated oversharing | "We have old permissions, broad grants, stale guests, and anonymous links." | Before/after deltas, remediation runbook, time-on-task | Scoped remediation project with measured proof | Oversharing Remediation |
| Discovered unmanaged AI and redirected users | "Users are already using AI outside IT's view." | GenAI app inventory, sanction/block log, redirect comms | Shadow-AI assessment, AI acceptable use policy starter, redirect plan | Shadow AI Discovery & Redirect |
| Built labels, simulated auto-labeling, trained users | "Information protection is too complex and users do not know what to do." | Taxonomy, simulation log, training deck, user questions | Right-sized label model and role-aware training package | Label Taxonomy & Training |
| Ran the management cadence | "A remediated tenant will drift without recurring governance." | Cadence runbook, trend report, SLA, recurring task list | Monthly governance service with executive reporting | Managed Copilot Governance |
| Adoption And Enablement Offers | ||||
| Ran champion enablement and prompt guides | "Users have licenses but do not change how they work." | Champion roster, role workflows, prompt guides, before/after examples | 30/60/90 adoption sprint and champion workshop | Copilot Adoption & Champion Enablement |
| Governed first internal agents and AI requests | "We want agents, but we need identity, access, lifecycle, and support discipline." | Agent intake, access review, decision log, registry note | Governed agent starter workshop and intake model | Governed Agent Starter |
The cleanest practice motion keeps the commercial lines bright: assess cheap -> remediate/label fixed-fee -> govern recurring. Lead with a low-friction proof conversation, then move into scoped projects, then earn the annuity.
Managed governance renews when the customer sees drift being managed in plain language. The monthly executive summary should be leadable in 30 seconds: one visible delta metric, one risk trend, and one recommended action.
| Cadence | What you review | Commercial point |
|---|---|---|
| Monthly | Exposure trend, DSPM/SAM findings, shadow-AI changes, label drift, access-review exceptions, helpdesk patterns, agent requests, and one-page executive summary. | Keeps governance visible after the project and creates renewal confidence. |
| Quarterly | QBR with before/after delta, adoption blockers, expansion conversation, renewal health check, and label-training refresh. | This is where Year 1 expansion usually shows up: label taxonomy review, retraining, and department enablement. |
| Annual | Taxonomy review, policy refresh, user retraining, tool-fit review, service scope refresh, and agent-governance maturity check. | Moves the service from "monitoring" to strategic Copilot operating rhythm. |
| Optional add-on | ROT data review: flag files not accessed in 2+ years for site-owner review before Copilot keeps surfacing stale content. | Emerging managed-governance add-on; position as practitioner synthesis, not Microsoft doctrine. |
These two offers stay attached to the Customer Zero story, but they are customer enablement offers, not governance services. Keep them commercially visible without forcing AgentOps language onto the governance catalog.
The adoption and enablement layer should not be an afterthought. The playbook is clear that adoption is a deliverable, not a side effect: discovery and scenario mapping, pilot deployment with the right users, adoption sprint, training, prompt guides, usage reviews, and renewal/expand conversations. Your internal champions become the pattern for customer workshops: who to invite, which workflows to start with, what prompts to teach, how to route support, and what proof the customer executive should expect at 30 and 60 days.
| Internal asset | Customer package | Commercial use |
|---|---|---|
| Champion Identification conversation | Champion Selection Workshop | Helps customers license doers first, not just leaders. |
| Role-specific prompt guides | Department Prompt Packs | Turns vague adoption into concrete workflows for sales, operations, HR, finance, marketing, and managers. |
| Scenario deck | Executive Value Mapping Session | Shows how Copilot maps to customer outcomes before broad rollout. |
| 30-day usage check-in | Adoption Health Review | Finds blockers early and creates the next project or training need. |
| 60-day ROI conversation | Executive Impact Review | Connects time saved, quality improvements, and governance wins to the renewal or managed-service conversation. |
| AI support runbook | Helpdesk Enablement Add-On | Gives your customer's support team scripts, routing, and escalation paths. |
Do not build generic training first. Productize the role packs that proved value inside your own firm, then adapt them to your customer's industry.
| Role pack | Customer workshop promise | Reusable deliverables |
|---|---|---|
| Sales Follow-Up Pack | Turn meetings into customer follow-up, action lists, proposal outlines, and prep briefs. | Transcript prompt guide, follow-up email template, proposal-outline prompt, before/after proof slide. |
| Operations Meeting Pack | Compress recurring meeting prep, recap, action tracking, and status updates. | Standup recap prompt, status email template, action owner checklist, 30-day usage check-in questions. |
| Office Manager / Executive Assistant Pack | Improve inbox, calendar, agenda, and executive communication workflows. | Tone-adjustment prompts, agenda prompts, long-thread summary prompts, support FAQ entries. |
| HR Document Pack | Draft and revise job descriptions, onboarding checklists, and policy communications. | JD prompt, onboarding checklist prompt, policy-summary prompt, sensitivity-label guidance. |
| Finance Insight Pack | Use Copilot in Excel for trend spotting, outlier review, formulas, and executive explanation. | Anonymized workbook demo, trend-analysis prompt, finance-control questions, board-summary example. |
| Marketing Content Pack | Turn source material into campaign drafts, emails, social posts, and sales-deck copy. | Content repurposing prompt, brand-review checklist, editing-time tracker, campaign example. |
| Manager Meeting Recovery Pack | Help managers recover missed meetings, identify decisions, and follow up on owned actions. | Missed-meeting prompt, action review checklist, manager weekly rhythm, proof slide. |
Start with a live role scenario from the playbook: meeting summary, sales follow-up, content draft, finance trend, or operations status update. Create desire before explaining the governance work that protects it.
"We ran this on ourselves first. Here is the before-state we found, the order we used, and what changed." Keep it anonymized and specific.
Show exposure categories and red zones before talking about licenses, projects, or managed services.
Pair governance proof with a champion workflow: the sales follow-up, the operations status update, the finance trend analysis, or the meeting recap.
Assessment and shadow-AI discovery open the door, remediation and labels become fixed-fee projects, and recurring governance protects the environment from drift.
Do not quote remediation from vibes. Quote it from your internal time-on-task, your customer's tenant size, the number of red-zone sites, and whether sprawl exceeds the native ceiling.
Package the practice through the CSP motion, Solutions Partner designations, Copilot specialization, Frontier Partner Badge recognition where applicable, and FastTrack where they fit the customer and partner model. Verify CSP accelerators, Copilot specialization requirements, Frontier Partner Badge criteria, and any three-year Copilot subscription packaging in Partner Center at delivery time; never quote a fixed figure or licensing term without re-checking it.
The gate matters because selling before you have proof turns the service into a promise your delivery team has not priced or practiced. Use this as the executive go/no-go list.
The two offers below are customer enablement offers, not governance services. They are ready when your own champion workflows and governed-agent intake are proven enough to repeat.
The capture layer is not administrative housekeeping. It is the manufacturing line for your future services. The hard part is plain: a working internal Copilot tenant is not the asset; the dated, screenshotted, before-and-after record of how you got there is the asset. If you do not instrument the run while it happens, you finish with tribal knowledge instead of delivery IP.
Do not let the team "write it up later." Memory erases the gotchas, and the gotchas are what make the offer valuable. Capture during execution, version it, assign an owner, and anonymize immediately if the artifact may ever become customer-facing.
| Capture field | What the team must record | Why you should care | How it becomes commercial IP |
|---|---|---|---|
| Before-state | Dated screenshots or exports before any change: Secure Score, SAM Data Access Governance, DSPM for AI, Cloud Discovery, label coverage, champion workflow baseline. | No before-state means no proof. No proof means the customer has to trust a story instead of seeing a measurable risk or value gap. | Executive assessment deck, sales proof slide, QBR baseline, customer "this is what your exposure looks like today" narrative. |
| Exact steps | Portal path, policy configuration, PowerShell command, review decision, role involved, and order of operations used. | This is how you stop depending on one senior consultant to remember the magic. | Delivery runbook, onboarding path for junior consultants, quality-control checklist, scoped SOW language. |
| Time-on-task | Clock time for assessment, remediation, label simulation, training preparation, champion workshop, report build, and management review. | This is the basis for fixed-fee pricing. Without it, every proposal is a guess wearing a blazer. | Pricing bands, staffing model, margin guardrails, "what changes when tenant size changes" assumptions. |
| Gotchas | What broke, what surprised the team, what required a workaround, where licensing depth was insufficient, what the customer would need to decide. | Gotchas are credibility. They let sales say "we have seen this before" and let delivery avoid relearning the same lesson. | Risk notes, pre-flight checklist, discovery questions, change-control language, escalation paths. |
| After-state and delta | The same metric after remediation, enforcement, training, or management cadence, plus the delta and the date. | This is the proof-of-value. It gives the customer a reason to keep funding the program after the first project. | Remediation proof deck, recurring governance report, renewal/expand conversation, managed-service QBR. |
| Internal phase | Evidence you should demand | Executive question it answers | Offer it feeds |
|---|---|---|---|
| Assessment | Purview DSPM for AI summary, SAM Data Access Governance report, Secure Score, Cloud Discovery snapshot, one-page exposure heat map, license-boundary notes. | What could Copilot expose today, and where do native tools stop? | Copilot Exposure Assessment; Shadow AI Discovery & Redirect. |
| Foundation and remediation | Restricted Access Control decisions, oversharing remediation runbook, EEEU/anonymous-link deltas, per-site time-on-task, -WhatIf output where relevant. |
What did we have to fix before scale, and how long did it actually take? | Oversharing Remediation; remediation SOW; managed-governance onboarding. |
| Pilot and champions | Champion roster, role workflows, scenario deck, prompt guides, 30-day usage questions, workflow before/after examples. | Which users proved value fastest, and what changed in their actual work? | Copilot Adoption & Champion Enablement; role-based training packs. |
| Shadow AI | GenAI app inventory, risk ranking, sanction/block decision log, redirect communications, AI acceptable use policy starter. | Where is AI already happening outside governance, and how do we redirect demand? | Shadow AI Discovery & Redirect; AI policy workshop; managed governance. |
| Information protection | Label taxonomy, simulation-mode results, tuning decisions, enforcement plan, training deck, user questions. | How do we make protection usable instead of just configured? | Label Taxonomy & Training; information protection SOW; recurring label review. |
| Management plane | Governance cadence, SOC/helpdesk handoff, SLA, trend report, recurring drift patterns, executive readout, label refresh plan, optional ROT review. | How do we keep the tenant from drifting after the project? | Managed Copilot Governance. |
| Agent readiness | Agent request intake, access review, data-source inventory, registry note, lifecycle decision, support routing. | How do we let the business build agents without bypassing identity, permissions, and lifecycle control? | Governed Agent Starter; agent governance add-on; managed governance expansion. |
You can read the artifact in five minutes and understand the risk, the action taken, the result, and the commercial implication.
A consultant who did not do the original work can repeat the task, see the expected output, and know when to escalate.
The proof is anonymized, dated, and specific enough to use in a customer conversation without exposing your tenant.
The artifact includes time-on-task and scope drivers so fixed-fee work is priced from evidence, not optimism.
| Anti-pattern | Why it hurts | Principal correction |
|---|---|---|
| Reconstructing after the fact | Memory smooths over the very issues customers pay you to understand. | Require live capture inside the evidence library for every phase. |
| No before-state | A remediation without a baseline has no provable delta. | No change work starts until before-state screenshots/exports exist. |
| Undated, unowned runbooks | They rot quickly against fast-moving Microsoft tooling and become dangerous. | Every runbook has an owner, date, version, and re-verification note. |
| Steps without time | Delivery knows what happened but leadership cannot scope or price it. | Clock the work. Use time-on-task to create pricing bands. |
| One expert, no shadowing | You have a bottleneck, not a practice. | Use the shadowing arc: I do/you watch, I do/you help, you do/I help, you do/I watch. |
| Confidential data in reusable proof | The artifact cannot safely become a sales or delivery template. | Anonymize on capture, not later. |
This is the part you can actually use with your team. Every week of the internal run should end with a commercial review, not just a technical status update. The question is not "did we configure the thing?" The question is "what did we learn that becomes proof, process, pricing, or a managed-service control?"
| Leadership question | What the delivery owner must bring | Decision you make | Commercial output |
|---|---|---|---|
| What did Copilot readiness expose in our own tenant? | Dated exposure heat map, native-tool outputs, license-depth notes, red-zone list. | Which risks must be remediated before broader internal rollout? | Assessment talk track, discovery questions, customer executive briefing. |
| Where did native tooling stop being enough? | Specific bottleneck: sprawl beyond the native ceiling, multi-tenant operations, reporting, runtime monitoring, or multi-AI governance. | Whether to standardize on native-only delivery or add a third-party layer. | Tool-selection memo and proposal guardrails so the team does not invent vendor claims. |
| What work is repeatable, and what was a one-off? | Remediation steps, elapsed time, gotchas, prerequisites, exceptions, and after-state delta. | What becomes fixed-fee scope vs discovery-dependent scope. | Oversharing Remediation offer, scoping bands, margin assumptions. |
| Which doer workflows created belief fastest? | Champion examples from sales, operations, office manager/EA, HR, finance, marketing, and meeting-heavy managers. | Which role packs become standard customer enablement packages. | Champion workshop, role prompt packs, adoption sprint, 30/60/90 customer cadence. |
| What requires recurring governance? | Drift patterns, label exceptions, shadow-AI decisions, access review needs, helpdesk escalations, agent requests, ROT data signals, and executive-readout quality. | What moves from project closeout into monthly managed service. | Managed Copilot Governance scope, SLA, QBR format, expansion path. |
| Can someone else on our team deliver this? | Runbook maturity, shadowing status, escalation rules, quality checks, customer-safe proof assets. | Whether the offer is sellable now or still trapped in one expert's head. | Ready-to-sell gate, delivery certification by phase, staffing plan. |