MSAI Lab · the demo

The two-estates demo

One demo tenant, two versions of the same fictional business. Estate A: three contradictory "FINAL" reports, a stale tracker, a confidential folder shared org-wide. Estate B: one approved report with metadata, a typed register, named-group permissions. Then the same Copilot question against both. Ninety seconds, argument over.

The four acts

Act 1 · Recognition

Open Estate A and say nothing

Final, Final_v2, FINAL-USE-THIS, someone's "my copy" of the tracker. The room recognises it instantly — that's the point. This is Level 1 on the maturity scale, and it's where most organisations live.

Act 2 · Confident mush

Ask Copilot the Monday-morning question

Summarise the latest monthly operations report and flag anything overdue.

The three "finals" disagree on jobs completed, revenue and what's overdue. Whichever version Copilot picks, another file contradicts it. Copilot isn't broken; the estate is.

Act 3 · The governed twin

Same tenant, same AI — structured estate

What does the Client Register say about Kestrel Mining — status, next action and due date?

One authoritative report with metadata; one typed register instead of a tracker spreadsheet. Clean answers, with sources. Act 3 minus Act 2 is the entire business case for the foundations work.

Act 4 · The permissions kicker

What else can Copilot see?

What documents mention board remuneration?

It surfaces the board pack from the org-wide-shared folder. Close with: "Copilot didn't leak anything. It revealed sharing that already existed. That's why permission hygiene comes before rollout — not after the first incident."

Build it in your own tenant (~10 minutes)

Demo tenants only. The kit creates deliberately bad governance — an org-wide link on a folder named "Board - Confidential". All content is obviously fictional ("Meridian Field Services"). Never run it in production.

Generate the fictional content: New-SampleContent.ps1 — the contradictory finals, the stale tracker, the governed twin's register.
Sign in once with Connect-MgGraph -Scopes 'Sites.FullControl.All' (the Graph-only route needs no app registration).
Seed both estates: Seed-ViaGraph.ps1 builds the messy library, the org-wide overshare, the governed library with metadata, and the typed Client Register list.
Wait for search indexing (15–60 minutes), assign a Copilot seat to the demo account, then rehearse the four acts.

Gotchas we hit so you don't

Azure CLI can never mint SharePoint tokens — az fails with AADSTS65002; use Connect-MgGraph (its first-party app is preauthorized).
Graph's device-code sign-in times out in 120 seconds — have the person at the machine run the interactive browser flow instead.
On macOS the token cache is keychain-bound — the shell that signed in must be the shell that runs the seeding.
"Anyone" links may be off at tenant level (good) — an organisation-scope link is the realistic oversharing anyway.
The Copilot payoff needs a real M365 Copilot seat — free Copilot Chat doesn't ground in tenant content. SMB tenants (≤300 seats) can use the 30-day self-service trial; switch off auto-renewal the day you start it.

Get the scripts on GitHub Ask us to run it live