Case studyWork/Assess

A manufacturer finds out what Claude would see before connecting it.

They had bought Claude for proposal work. Their files also held sensitive customer, finance and HR content. Before anything was connected, we scanned about 240,000 files, scored the tenant on eight competencies, and designed the boundary that keeps sensitive sites out of Claude's reach.

Company
Manufacturer, a few dozen people
Service
Assess · AI
Delivery
Remote, under NDA, metadata only
We used
The Scan, interviews, the Microsoft 365 maturity model, SharePoint, Microsoft Purview, Entra ID, Claude and its Microsoft 365 connector
240,000about that many files inventoried, at the permission and metadata level
1.6 TBabout that much content, across about 60 SharePoint sites
8competencies scored. The four an AI connector depends on all sat at the first level.
3,000about that many current documents proposed as Claude's working set
0file contents read. The scan worked from names, sizes, dates and permissions.
Counts from the engagement. Client not named. Screens below are mock-ups with sample data.
The story

Claude was bought. The question was what it would reach.

  1. Before

    Bought, not connected.

    The company had bought a company-wide Claude plan for proposal and marketing work. Its Microsoft 365 connector reaches whatever the signed-in person can open, and nobody could say with certainty what that was. Until someone could, it stayed unconnected.

  2. The ask

    Numbers before any switch is flipped.

    Assess the Microsoft 365 environment, show what a connected Claude would see, and set out what has to be true before it connects. Without anyone from Floor 16 opening a sensitive document.

  3. What we did

    A scan, interviews, scores and a boundary.

    A metadata-only scan of every SharePoint site, interviews across leadership, engineering, operations and project management, scores across eight competencies, a boundary design for Claude, a storage runway, and a fix list in five workstreams.

Scorecard

Eight competencies. The four Claude depends on scored lowest.

 Claude boundary

Which sites Claude may see, which it can't, and how to prove it.

 Storage runway

A capacity deadline found, and about three years of runway designed.

 Fix list

Five workstreams, about 40 items, each one taken on its own.
01 · Assess · Microsoft 365 maturity model

Eight scores. The four Claude needs were the lowest.

We scored the tenant on the eight competencies of the Microsoft 365 maturity model, from Initial (100) to Optimizing (500). Adoption was strong. Content, search, governance and AI, the four a tenant-wide AI connector depends on, all sat at Initial.

Mock-up. Levels as reported; layout and labels simplified.

1Grouped by what Claude needs. Content, search, governance and AI decide what a connector finds and whether it should. All four sat at Initial.
2Governance moves furthest. Its twelve-month target is the highest of the eight, because it gates the Claude rollout and because customers will ask for evidence of it.
3Heard and seen. Each score combines what people said in interviews with what the tenant data showed.
  • Adoption was not the problem. People worked in Teams, email and SharePoint every day. What they couldn't do was find, or trust, what those tools held.
  • About ten issues, ranked by urgency, each tied to the workstream that fixes it and the competency it moves.
What changed

The question moved from when to turn Claude on to what has to be true first.

02 · AI · Claude deployment readiness

A connector reads what its user reads.

Claude's Microsoft 365 connector acts as the signed-in person. It searches the tenant within that person's permissions, and at the time of the assessment it could not be limited to one site from the Claude side. So the boundary has to be built in Microsoft 365, site by site.

Sort

One tier per site

Open to Claude, closed to Claude, or decide first. No mixed sites.

Hide

Out of search

Restricted Content Discovery takes closed sites out of the search Claude depends on.

Lock

Encrypted files

Encrypting sensitivity labels keep files closed to Claude, even for people who work on that site.

Prove

A test account tries

Every closed site is tested before Claude connects. The evidence is that nothing comes back.

1One tier per site. Every control here is applied to a site and its libraries, so a site holding mixed content has no boundary at all.
2Two controls, layered. Hiding a site from search covers people who don't work there. Encryption covers the people who do, with full usage rights so staff still open, copy and print normally.
3Some calls are commercial. Sites holding client data or live bid pricing stay closed until the business decides. That is a judgment for the client, not a setting.
4The open side is curated. Claude would draft from a proposal library of approved boilerplate, capability statements and past project summaries, curated from a proposal archive of about 2,600 files.
  • Proven before production. The runbook opens with a gate test on Floor 16's own tenant. If encryption doesn't hold there, the design changes before any client content moves.
  • Floor 16 stays out of the closed sites. Where a step needs sight of a document, the client's own staff carry it out and Floor 16 witnesses the result, not the content.
  • The gaps are written down. File names still show, some file types can't carry a label, and vendor behavior can change, so the boundary is retested every quarter.
What changed

"What would Claude see?" got a written answer: a site map, two controls, a test, and a working set of about 3,000 current documents.

Mock-up with made-up site names. The real site map has the same structure.

03 · Assess · Storage runway

Storage set the first deadline.

The scan found SharePoint within about 70 GB of its licensed storage pool, with close to 300 GB added in the past eight months. On that path the tenant would reach its limit within a couple of months and go read-only soon after. Archiving inactive files, rather than buying space or deleting anything, would buy about three years.

Mock-up. Totals rounded from the report; the curve is illustrative.

1History rebuilt from file dates. Growth came in steps, when a large project delivered. Two single months each added more than 200 GB.
2Rates they have actually sustained. Slowest, median, recent, this year and fastest, not one straight line.
3Archive, not buy, not delete. Microsoft 365 Archive bills at a quarter of the rate of bought storage. Files stay in SharePoint, searchable and permissioned, and reactivation is free.
4Duplicates first. About 220 GB of redundant copies come out with owner sign-off, so nothing is archived twice.
  • Only about 5 percent of the files were business documents. Most of the volume was media and data that needs keeping, on a platform priced for documents.
  • Active storage would drop to about 0.5 TB, with a three-year cost shown for both paths.
What changed

The storage problem got a date, a cost for both paths, and a plan that deletes no business content.

04 · Assess · The fix list

Five workstreams. Claude comes last.

Every finding became an item of work, about 40 in all, grouped by what each one depends on rather than by date. Each workstream can be taken on its own. The report carried no pricing: the client chose what to scope after the walkthrough.

1Starts now. Sharing settings, app consent, account cleanup and interim Claude use need no new licensing.
2A date set by storage. Reclaiming capacity has a deadline that the tenant sets, not the plan.
3Tested, then connected. The connector goes to a pilot group only after the boundary test passes, then widens. The test repeats every quarter.
4Skills, not just access. The value is repeat work: proposal sections, statements of work and marketing collateral drafted from approved material.
What changed

A plan the client could take one piece at a time, with the reason for the order written next to each piece.

Mock-up. Workstreams as reported; wording shortened.

The rule

Nothing connects until the test passes.

Claude was already paid for, so we laid out three ways to run it, from useful today to connected for everyone. We also asked security to rule on one question first: must the data never train a model, or never leave its home region? What Claude can see and where it runs are separate questions, and the design branches on the answer.

Way to run ClaudeLive Microsoft 365 connectionUseful on day oneNeeds the boundary first
Curated Claude ProjectsOnly vetted content, added by hand
Scoped accountOne login with trimmed permissions
Governed rolloutEveryone, inside the tested boundary
YesAfter the boundary testNo

If full residency becomes the requirement, that is a separate build: Claude through a cloud provider's in-region endpoint, with the model confirmed in that region first.

Curated Projects nowProposal and marketing work, no connector
Boundary builtTiers, labels and discovery controls
Boundary testedA test account tries every closed site
Connected, then widenedA pilot group first, retested every quarter
The next steps

The client set the order.

At the walkthrough, leadership put licensing first, then classification, then Claude. The follow-on work is scoped as separate workstreams, each priced on its own, with the secure AI foundation first.

Scoping call, SOW and NDASecurity brought in before any access
Done
Scan, interviews and scorecardAbout 240,000 files, eight competencies, about ten issues
Done
Boundary runbook and storage runwaySite tiers, controls, gate test, three-year cost
Done
Report and walkthroughFix list in five workstreams, no pricing
Done
Licensing stepBought by the client
Client
Secure AI foundationLabels, discovery controls, data loss prevention, the boundary test
Proposed
Claude enablementCurated sources, training, reusable Claude skills
Planned
Month 1Month 2Month 3Month 4Next
01 Done08 Not firm yet18 Planned
What changed

Three ways to measure it.

For leadership
About ten

issues ranked by urgency, each with the workstream that fixes it and a reason for the order.

For security
One test

decides when Claude connects: a test account tries every closed site, and nothing comes back.

For the team
Today

Claude stays useful through curated Projects for proposals and marketing, with no connector and no licensing change.

Want the numbers before you connect AI?

Thirty minutes on what's in your tenant, who can open it, and what Claude, or any connected assistant, would reach.

Book the Scan See all scenarios