The Australian Public Service (APS) has been provided with a comprehensive roadmap for securely adopting Microsoft 365 Copilot, following the conclusion of a six-month government trial that demonstrated significant productivity gains from AI integration.

Technology firm AvePoint has released a detailed guide titled "Beyond Microsoft 365 Copilot Readiness for the Australian Public Service," which addresses the critical security and governance challenges facing government agencies as they move from AI readiness to full-scale implementation.

The Australian Government's six-month Microsoft 365 Copilot trial, which concluded in 2024, revealed encouraging results for AI adoption in the public sector. According to the guide, 75% of users reported increased productivity, 68% saw improvements in work quality, and participants saved more than 10 work hours per month on average.

However, it was identified in the whole-of-government adoption of GenAI that “Poor data security and information management practices can lead to inappropriate access to sensitive information.”

Three-Pillar Security Framework

The AvePoint guide establishes a three-pillar approach for sustainable AI adoption:

Risk Management and Mitigation: The guide emphasises that risk management will be the biggest challenge for 82% of executives implementing AI strategies in 2025. With APS entities managing vast data volumes - some handling over 500 petabytes - the framework stresses the need for proactive threat identification and continuous monitoring.

Data Classification and Management: Proper data structuring and labelling are identified as essential for quality AI outputs. The guide notes that without effective classification systems, Microsoft 365 Copilot cannot deliver accurate results despite its comprehensive information access capabilities.

Analytics for AI Optimisation: Advanced analytics are recommended to monitor AI usage patterns, measure productivity impact, and identify successful use cases, enabling agencies to refine their AI strategies and demonstrate return on investment.

The guide emphasises alignment with established Australian security frameworks, including the Information Security Registered Assessors Program (IRAP), the Australian Cyber Security Centre's Information Security Manual (ISM), and the Essential Eight Mitigation Strategies.

AvePoint's Confidence Platform, which supports the framework, has achieved IRAP assessment to PROTECTED level, demonstrating compliance with Australian government security standards.

Addressing AI Adoption Challenges

According to Gartner research cited in the guide, Microsoft 365 Copilot introduces several security challenges including risk configuration settings enabled by default, increased oversharing risks, content sprawl risks, new retention and compliance challenges, and expanded attack surfaces requiring monitoring.

“Security professionals must simply focus on predicting steps (or missteps) that could lead to an exploit and closing those paths., said Dana Simberkoff, Chief Risk, Privacy and Information Security Officer at AvePoint

“In the absence of security education or experience, employees, users, and customers naturally make poor security decisions with technology. This means that systems need to be easy to use securely and difficult to use insecurely.”

Looking ahead, the guide notes that by 2029, AI agents are expected to autonomously resolve 80% of common customer service issues, reducing operational costs by 30%. With platforms like Microsoft 365 Copilot Studio, APS entities can develop customised AI agents without complex coding requirements.

Global AI systems spending is projected to reach US$632 billion by 2028, with organisations expecting efficiency boosts (61%), increased data insights (54%), and better decision-making (51%) from AI implementation.

Rather than replacing jobs, the guide positions AI as a tool to empower APS employees to focus on strategic work requiring uniquely human skills such as empathy and ethical judgment. This represents an opportunity for workforce transformation where public servants develop new competencies in AI oversight.

AvePoint’s comprehensive framework aims to help the APS transition confidently from AI readiness to effective implementation while maintaining security and compliance standards essential for government operations.

Download Guide here.