EPC Group launches TAR-8 standard for Microsoft 365 AI readiness

EPC Group published TAR-8, a public 24-point rubric for checking whether a Microsoft 365 and Azure tenant is ready for Copilot, AI agents and approved external models. The standard is meant to show not just who can use AI, but what the system can find, change, retain or transmit inside enterprise data.

Why it matters: - TAR-8 tries to answer the operational question a license report cannot: what an AI system can actually access, change, keep, or send once it is connected to enterprise data. - The standard is aimed at CIOs, security leaders and compliance teams that need evidence before expanding Copilot, agents or external model use. - EPC Group says the framework is designed to turn readiness claims into control checks and reviewable evidence.

What happened: - EPC Group announced public availability of its 8-Surface Tenant AI Readiness Standard, or TAR-8, on Sept. 23, 2026. - The standard assesses Microsoft 365 and Azure environments for readiness for Microsoft Copilot, AI agents and approved external AI models. - EPC Group published the complete rubric, interactive self-assessment, control-to-evidence mapping and implementation references on its TAR-8 standard page. - The public article also links to EPC Group's VCAIO offering, the TAR-8 scorecard at the standard page, contact options, and the Evidence Center.

The details: - TAR-8 evaluates eight connected tenant surfaces and scores each from 0 to 3. - The rubric ties each score to the operational evidence needed to support it. - The eight surfaces are identity, sensitive data, content estate, conversations, reports and dashboards, business applications and customer records, infrastructure and external models, and ownership and evidence. - Identity coverage reviews Microsoft Entra ID, Conditional Access, privileged access, app consent and agent identities. - Sensitive-data coverage reviews Microsoft Purview sensitivity labels, data loss prevention rules and retention settings for AI workflows. - Content-estate coverage reviews SharePoint sites, OneDrive files and Exchange mailboxes, including external sharing, broad links, inherited permissions, stale content and delegated access. - Conversation coverage reviews Teams chats, meeting transcripts, recordings and recaps, along with applicable meeting and retention policies. - Reports-and-dashboards coverage reviews Power BI semantic models and Microsoft Fabric data products, including ownership, endorsed definitions, row-level security and lineage. - Business-applications coverage reviews Dynamics 365, Dataverse, Power Platform and Copilot Studio for agent identity, permissions, connector policies, action logging and human approval. - Infrastructure-and-external-model coverage reviews Azure and Microsoft Foundry integrations, including approved models such as Claude, ChatGPT, Gemini and private models. - Ownership-and-evidence coverage identifies decision makers, sponsors, exceptions, review intervals and the records that show continuing oversight. - Each surface is scored as 0 for unknown, 1 for inventoried, 2 for controlled, or 3 for evidenced. - A total score can reach 24 points, but the total is not treated as a pass certificate. - EPC Group's published gates say any surface scored 0 means the tenant is not ready under the standard. - Identity, sensitive data and content must each reach at least 2 before Copilot is enabled broadly. - Conversations, reports and business applications must each reach at least 2 before agents can take actions. - Infrastructure and external models must each reach at least 2 before an external model is connected to tenant data. - Ownership and evidence are reviewed quarterly. - The standard maps its surfaces to Microsoft controls, the NIST AI Risk Management Framework and ISO/IEC 42001 concepts. - EPC Group says TAR-8 is its own published assessment standard, not a Microsoft program or independent accreditation. - The current version is listed as v1.0.1, with a 90-day Microsoft documentation review schedule. - The company says the assessment is read-only and does not change tenant settings. - The assessment produces three outputs: a surface-by-surface score, a prioritized remediation sequence and an evidence pack for security, executive, audit or insurer review.

Between the lines: - TAR-8 is meant to push AI readiness discussions away from broad marketing claims and toward auditable controls. - The framework also draws a line between Microsoft 365 permissions and controls that may not automatically carry over to an external model or agent integration. - EPC Group is positioning the standard as a way to connect governance work across Entra, Purview, SharePoint, Teams, Power BI, Fabric, Dynamics 365, Dataverse, Power Platform, Copilot Studio, Azure and Microsoft Foundry. - The company says its broader delivery record includes more than 300 Copilot initiatives and 300 AI implementations, plus more than 11,000 enterprise engagements overall.

What's next: - Organizations can use the free interactive scorecard to record an initial view and share a score link. - EPC Group says a scoped Tenant AI Readiness Assessment can apply the rubric to an organization’s environment after a discovery discussion. - The firm says follow-on work can lead into governance, architecture or virtual Chief AI Officer engagements based on the gaps the review finds. - Companies with a narrower starting point can focus first on identity, sensitive data and content controls before broad Copilot rollout. - Teams already using agents can assess action permissions, connector paths, analytics and audit records. - Enterprises using multiple model providers can test whether each approved path into Microsoft 365 data preserves the controls required by their architecture.

The bottom line: - TAR-8 gives EPC Group a structured way to judge whether an AI rollout is governed, evidenced and ready for real use — not just licensed for it.