The test of an engagement is what you can do afterwards without the supplier. Not what was delivered, not how it was received, and definitely not how many days were sold. If the answer is “run the same exercise ourselves next quarter”, it worked. If the answer is “buy phase two”, something has gone wrong, possibly on purpose.
I sell this kind of work, so read the rest with that in mind.
What a competent engagement contains
Five things. A proposal missing any of them is a proposal for activity.
- A decision at the end, not a report. The scope should name the decisions: which processes, which licence position, which controls.
- Access to your real tenant and your real content. Anyone who can do this work will ask to see the permissions position, usage reports and content estate. Planning from workshops produces a plan for a different organisation.
- The named person doing the work is the person you met. Ask who is on the tools, what else they are on that month, and put the names in the contract.
- Something that transfers. A runbook your admin can follow, a spreadsheet with the assumptions exposed rather than a PDF with the answer. If nothing can be changed, you have rented an opinion.
- A willingness to reach a cheap conclusion. The honest finding is often “your permissions model is the problem and nothing else matters until that is fixed”. A supplier who can say that in week two and stop is worth more than one who can fill twelve weeks.
Things I would not sell you
Prompt libraries. The standard deliverable, and I have stopped producing them. They go stale within weeks, and the skill that matters is judging whether an output is right. Generate one internally from the tasks your team does.
A strategy deck that could have been written without meeting you. Search it for the names of your own processes, systems and teams. If they appear only in the appendix, you paid for a market overview.
Any readiness assessment that is a permissions report with a cover page. You can run the reports yourself. The value is in what gets fixed first, so if the proposal does not say who decides and by when, it is the report.
And ISO/IEC 42001 certification sold to you as EU AI Act compliance. That is the most mis-sold thing in this market. The standard is not part of the EU harmonisation process; the European AI Office signalled in May 2024 that it was not fully aligned with the final AI Act text, and providers relying on it alone “retain the full evidentiary burden if challenged by regulators”. The standard expected to carry presumption of conformity is prEN 18286, whose public enquiry closed on 22 January 2026 with publication expected late in 2026. They differ in kind: ISO/IEC 42001 certifies an organisation’s AI management system; the AI Act regulates each high-risk system as a product, assessed at market placement.
A related move: a supplier pointing at Microsoft’s certification instead of their own work. Microsoft does hold ISO/IEC 42001 certification covering products including Microsoft 365 Copilot and Copilot Studio, and says you can use it in your compliance assessment. It also says you are responsible for engaging an assessor to evaluate the controls and processes in your own organisation. A vendor’s badge is an input to your assessment, not your assessment.
When you do not need anyone
Four situations where the answer is to keep your money.
Finding out whether people will use it. Copilot Chat is included at no extra cost with eligible Microsoft 365, Office 365 and Teams licences. Turn it on for one team, leave it a month, then ask what they stopped using it for. A better signal than any discovery workshop, including mine.
Finding out what agents already exist in your tenant. Agent 365 reached general availability for Commercial on 1 May 2026, and the agent inventory in the Agent Registry, along with basic governance actions (publish, block, delete, reassign owner), is available on all Microsoft 365 Enterprise, Business, Education and F plans. Nobody needs to be paid to open a list.
Modelling E5 plus Copilot against E7. Your licensing partner and your Microsoft account team will build that comparison at no charge, and they hold your actual pricing; an independent consultant does not. Pay for a challenge to the assumptions, not for the arithmetic.
Anything where the real blocker is that nobody will change a process. If the constraint is that a director will not alter how their team works, no supplier can fix it, and every engagement bought to fix it becomes an elaborate way of documenting the refusal. A consultant can carry an unpopular message. A consultant cannot buy authority for you.
The tells
Days quoted without decisions attached. A methodology with a trademark on it. A productivity figure quoted without saying who funded the study. A pilot designed so it cannot produce a negative result. A supplier who will not say what would make them recommend stopping.
That last one is the whole test. Ask it in the pitch: what would you have to find for your advice to be that we should not do this yet? Anyone who has done the work will have a specific answer, usually about content and permissions. Anyone who has not will say every organisation is different.
I have got this wrong from the selling side too. I used to sell a two-day discovery workshop as standard, because it was easy to price. It produced things I could have learned from a usage report and one honest conversation with an admin. Now I ask for read access and an hour with the person who runs the process.
If the proposal does not say what decision it produces, who makes it, and what evidence would change it, you are not buying advice. You are buying weeks.