jellebelletje/CARA

A scored adoption readiness assessment for organisations considering a Microsoft 365 Copilot pilot. No signup, no server, results as PDF.

0

stars

20

commits

TypeScript

primary language

Aug 16, 2026

updated

adoption
assessment
change-management
copilot
m365
microsoft-365
microsoft-copilot
no-backend
privacy-friendly
readiness-assessment

README

CARA, Copilot Adoption Readiness Assessment

Run the assessment: jellebelletje.github.io/CARA

The CARA results screen: a verdict, a readiness score, six scored dimensions and the launch conditions they generate

A scored readiness assessment for the question organisations actually ask before starting a Microsoft 365 Copilot pilot: what has to be in place before we can start?

CARA is worked through as a conversation between an adoption coach and the organisation. It scores six dimensions, produces a go / no-go verdict, and turns every gap into a concrete launch condition: what to do about it, which side owns it, and whether it has to be closed before the pilot starts, alongside it, or before broad rollout.

The assessment itself

The CARA intro screen, showing the six dimensions and the four readiness levels

Where CARA sits

A complete Copilot decision needs four stages. Microsoft covers three of them with real, runnable instruments. For the fourth it publishes checklists and guides but no scored diagnostic, and that is the gap CARA fills.

CARA is not a technical, security or data-governance assessment and does not replace one. Run the instruments below alongside it.

Stage 1. Can we deploy safely?

Assessments to run:

InstrumentWhat it assessesWhere you run it
Copilot Optimization AssessmentData governance maturity and data security controls. Microsoft recommends completing it before deploying Copilot.M365 admin center, Copilot, Settings, Readiness
Copilot Readiness ReportTechnical eligibility, prerequisite licences, update channels, assigned versus available Copilot licences, and recommended preparation actions.M365 admin center, Reports
Purview DSPM for AI data risk assessmentsOversharing exposure. Which sites and files Copilot could surface, and which sensitive content is unlabelled.Purview portal, DSPM, Discover, Data risk assessments
SharePoint Advanced Management content assessmentSites that are overshared, ownerless or inactive, oversized audiences, and broken permission inheritance. Restricted Content Discovery excludes sensitive sites from Copilot.SharePoint admin center

Reference reading behind those:

Stage 2. Can the organisation absorb the change?

CARA, the assessment in this repository. Microsoft's own material for this stage is planning support rather than diagnosis:

Stage 3. Are people adopting it?

Stage 4. Is it producing value?

The scoring model

Every question is scored on four levels, and the levels are three different thresholds rather than one scale of "more".

LevelMeaning
Not readyThis will break the pilot, or make its results uninterpretable. Fix before starting.
EmergingThe pilot can start, with a named condition and an owner against it.
ReadyThe pilot will run cleanly and produce a trustworthy answer.
ScalableThis would survive org-wide rollout, not just a friendly pilot cohort. Not required to start a pilot.

Two rules follow from that, and they are what make CARA usable rather than a gate everyone fails:

  • Only red blocks. Amber never blocks a pilot, it generates a launch condition.
  • Scalable is not required to start. It is what you re-score against after the pilot, when the question changes from "can we start?" to "can we scale?".

A pilot exists to answer questions. CARA is built so that it never demands the pilot's own output as the pilot's input.

Verdicts

NO-GO              any dimension is Not ready
GO WITH CONDITIONS no dimension is Not ready, at least one is Emerging
GO                 all dimensions are Ready or better
SCALE-READY        at least 4 dimensions are Scalable, none below Ready

The verdict is not an average. Averaging six dimensions hides the single fatal gap, which is the entire point of a go/no-go instrument.

The question bank

46 questions across six dimensions. See content/questions.md, which is the human-readable source of truth. The app reads a typed mirror of it.

Full form for a proper engagement, short form (the pilot-critical subset) for a first conversation.

Working on it

This project needs Node 22, which .nvmrc pins. In the project directory:

nvm use
npm install
npm test                  # scoring engine and Dutch coverage
npm run questions:check   # validate the question bank
npm run questions:build   # regenerate content/questions.md from src/data

src/data/ is the source of truth. content/questions.md is generated, so do not edit it by hand.

Languages

English and Dutch, switched with the flags in the header. The choice travels in the share link, so a session filled in in Dutch opens in Dutch.

English is the source of truth in src/data/. Dutch is an overlay in src/i18n/nl/, keyed by question id, so a third language can be added file by file without touching the English. A test fails if any Dutch question, hint, anchor or launch condition is missing, because the runtime fallback to English would otherwise hide the gap.

Analytics

The page counts anonymous visits with Cloudflare Web Analytics: no cookies, no fingerprinting, no personal data. It exists to answer one question, whether anyone is using this, and nothing finer than that.

It is off unless a token is configured. The build reads VITE_CF_BEACON_TOKEN, and with no token the script is never injected and the page makes no third-party request at all. A local checkout and a fork are therefore silent by default.

Answers can never reach it. The share link encodes answers in the URL fragment, so the fragment is read once on load and stripped from the address bar immediately, and nothing writes it back. A share link is built on demand when you copy the report. Any analytics that reported location.href would otherwise have shipped a complete set of client answers to a third party, which is the failure this design exists to prevent.

Status

In development. 46 questions with full rubrics and launch conditions, in two languages, with the scoring engine under test.

Using CARA in your own organisation

You are welcome to clone this and run it yourself, for your own organisation or with your own clients. Attribution is required. See LICENSE for the exact terms; the short version is that the credit line must stay visible wherever CARA is used or published.

git clone https://github.com/jellebelletje/CARA.git
cd CARA
nvm use          # Node 22, see .nvmrc
npm install
npm run dev

To publish your own copy:

  1. Fork the repository, or clone it and push to a repository of your own.
  2. In your repository settings, enable GitHub Pages with GitHub Actions as the source.
  3. Push to main. The workflow in .github/workflows/deploy.yml builds and publishes it.

Everything runs in the browser. There is no server and no database, and nothing an assessment records leaves the machine it was filled in on unless the person filling it in chooses to share the link.

Adapting the questions

The question bank is meant to be adapted to your own practice.

  • Edit the files in src/data/dimensions/. Each question carries its own text, hint, four rubric anchors and two launch conditions, so a change is local to one object.
  • Run npm run questions:check to validate. It enforces unique ids, complete anchors, both launch conditions, 5 to 10 questions per dimension, and the pilot-critical balance.
  • Run npm run questions:build to regenerate content/questions.md.

Keep the attribution in place when you do. Adapting the bank does not make it yours.

House style

No em-dashes, anywhere, in content or code comments.

Contributors

jellebelletje

20 commits

jellebelletje/CARA

A scored adoption readiness assessment for organisations considering a Microsoft 365 Copilot pilot. No signup, no server, results as PDF.

0

stars

20

commits

TypeScript

primary language

Aug 16, 2026

updated

adoption
assessment
change-management
copilot
m365
microsoft-365
microsoft-copilot
no-backend
privacy-friendly
readiness-assessment

README

CARA, Copilot Adoption Readiness Assessment

Run the assessment: jellebelletje.github.io/CARA

The CARA results screen: a verdict, a readiness score, six scored dimensions and the launch conditions they generate

A scored readiness assessment for the question organisations actually ask before starting a Microsoft 365 Copilot pilot: what has to be in place before we can start?

CARA is worked through as a conversation between an adoption coach and the organisation. It scores six dimensions, produces a go / no-go verdict, and turns every gap into a concrete launch condition: what to do about it, which side owns it, and whether it has to be closed before the pilot starts, alongside it, or before broad rollout.

The assessment itself

The CARA intro screen, showing the six dimensions and the four readiness levels

Where CARA sits

A complete Copilot decision needs four stages. Microsoft covers three of them with real, runnable instruments. For the fourth it publishes checklists and guides but no scored diagnostic, and that is the gap CARA fills.

CARA is not a technical, security or data-governance assessment and does not replace one. Run the instruments below alongside it.

Stage 1. Can we deploy safely?

Assessments to run:

InstrumentWhat it assessesWhere you run it
Copilot Optimization AssessmentData governance maturity and data security controls. Microsoft recommends completing it before deploying Copilot.M365 admin center, Copilot, Settings, Readiness
Copilot Readiness ReportTechnical eligibility, prerequisite licences, update channels, assigned versus available Copilot licences, and recommended preparation actions.M365 admin center, Reports
Purview DSPM for AI data risk assessmentsOversharing exposure. Which sites and files Copilot could surface, and which sensitive content is unlabelled.Purview portal, DSPM, Discover, Data risk assessments
SharePoint Advanced Management content assessmentSites that are overshared, ownerless or inactive, oversized audiences, and broken permission inheritance. Restricted Content Discovery excludes sensitive sites from Copilot.SharePoint admin center

Reference reading behind those:

Stage 2. Can the organisation absorb the change?

CARA, the assessment in this repository. Microsoft's own material for this stage is planning support rather than diagnosis:

Stage 3. Are people adopting it?

Stage 4. Is it producing value?

The scoring model

Every question is scored on four levels, and the levels are three different thresholds rather than one scale of "more".

LevelMeaning
Not readyThis will break the pilot, or make its results uninterpretable. Fix before starting.
EmergingThe pilot can start, with a named condition and an owner against it.
ReadyThe pilot will run cleanly and produce a trustworthy answer.
ScalableThis would survive org-wide rollout, not just a friendly pilot cohort. Not required to start a pilot.

Two rules follow from that, and they are what make CARA usable rather than a gate everyone fails:

  • Only red blocks. Amber never blocks a pilot, it generates a launch condition.
  • Scalable is not required to start. It is what you re-score against after the pilot, when the question changes from "can we start?" to "can we scale?".

A pilot exists to answer questions. CARA is built so that it never demands the pilot's own output as the pilot's input.

Verdicts

NO-GO              any dimension is Not ready
GO WITH CONDITIONS no dimension is Not ready, at least one is Emerging
GO                 all dimensions are Ready or better
SCALE-READY        at least 4 dimensions are Scalable, none below Ready

The verdict is not an average. Averaging six dimensions hides the single fatal gap, which is the entire point of a go/no-go instrument.

The question bank

46 questions across six dimensions. See content/questions.md, which is the human-readable source of truth. The app reads a typed mirror of it.

Full form for a proper engagement, short form (the pilot-critical subset) for a first conversation.

Working on it

This project needs Node 22, which .nvmrc pins. In the project directory:

nvm use
npm install
npm test                  # scoring engine and Dutch coverage
npm run questions:check   # validate the question bank
npm run questions:build   # regenerate content/questions.md from src/data

src/data/ is the source of truth. content/questions.md is generated, so do not edit it by hand.

Languages

English and Dutch, switched with the flags in the header. The choice travels in the share link, so a session filled in in Dutch opens in Dutch.

English is the source of truth in src/data/. Dutch is an overlay in src/i18n/nl/, keyed by question id, so a third language can be added file by file without touching the English. A test fails if any Dutch question, hint, anchor or launch condition is missing, because the runtime fallback to English would otherwise hide the gap.

Analytics

The page counts anonymous visits with Cloudflare Web Analytics: no cookies, no fingerprinting, no personal data. It exists to answer one question, whether anyone is using this, and nothing finer than that.

It is off unless a token is configured. The build reads VITE_CF_BEACON_TOKEN, and with no token the script is never injected and the page makes no third-party request at all. A local checkout and a fork are therefore silent by default.

Answers can never reach it. The share link encodes answers in the URL fragment, so the fragment is read once on load and stripped from the address bar immediately, and nothing writes it back. A share link is built on demand when you copy the report. Any analytics that reported location.href would otherwise have shipped a complete set of client answers to a third party, which is the failure this design exists to prevent.

Status

In development. 46 questions with full rubrics and launch conditions, in two languages, with the scoring engine under test.

Using CARA in your own organisation

You are welcome to clone this and run it yourself, for your own organisation or with your own clients. Attribution is required. See LICENSE for the exact terms; the short version is that the credit line must stay visible wherever CARA is used or published.

git clone https://github.com/jellebelletje/CARA.git
cd CARA
nvm use          # Node 22, see .nvmrc
npm install
npm run dev

To publish your own copy:

  1. Fork the repository, or clone it and push to a repository of your own.
  2. In your repository settings, enable GitHub Pages with GitHub Actions as the source.
  3. Push to main. The workflow in .github/workflows/deploy.yml builds and publishes it.

Everything runs in the browser. There is no server and no database, and nothing an assessment records leaves the machine it was filled in on unless the person filling it in chooses to share the link.

Adapting the questions

The question bank is meant to be adapted to your own practice.

  • Edit the files in src/data/dimensions/. Each question carries its own text, hint, four rubric anchors and two launch conditions, so a change is local to one object.
  • Run npm run questions:check to validate. It enforces unique ids, complete anchors, both launch conditions, 5 to 10 questions per dimension, and the pilot-critical balance.
  • Run npm run questions:build to regenerate content/questions.md.

Keep the attribution in place when you do. Adapting the bank does not make it yours.

House style

No em-dashes, anywhere, in content or code comments.

Contributors

jellebelletje

20 commits

Languages

TypeScript

98.0%

CSS

1.8%