A scored adoption readiness assessment for organisations considering a Microsoft 365 Copilot pilot. No signup, no server, results as PDF.
0
stars
20
commits
TypeScript
primary language
Aug 16, 2026
updated
Run the assessment: jellebelletje.github.io/CARA
A scored readiness assessment for the question organisations actually ask before starting a Microsoft 365 Copilot pilot: what has to be in place before we can start?
CARA is worked through as a conversation between an adoption coach and the organisation. It scores six dimensions, produces a go / no-go verdict, and turns every gap into a concrete launch condition: what to do about it, which side owns it, and whether it has to be closed before the pilot starts, alongside it, or before broad rollout.

A complete Copilot decision needs four stages. Microsoft covers three of them with real, runnable instruments. For the fourth it publishes checklists and guides but no scored diagnostic, and that is the gap CARA fills.
CARA is not a technical, security or data-governance assessment and does not replace one. Run the instruments below alongside it.
Assessments to run:
| Instrument | What it assesses | Where you run it |
|---|---|---|
| Copilot Optimization Assessment | Data governance maturity and data security controls. Microsoft recommends completing it before deploying Copilot. | M365 admin center, Copilot, Settings, Readiness |
| Copilot Readiness Report | Technical eligibility, prerequisite licences, update channels, assigned versus available Copilot licences, and recommended preparation actions. | M365 admin center, Reports |
| Purview DSPM for AI data risk assessments | Oversharing exposure. Which sites and files Copilot could surface, and which sensitive content is unlabelled. | Purview portal, DSPM, Discover, Data risk assessments |
| SharePoint Advanced Management content assessment | Sites that are overshared, ownerless or inactive, oversized audiences, and broken permission inheritance. Restricted Content Discovery excludes sensitive sites from Copilot. | SharePoint admin center |
Reference reading behind those:
CARA, the assessment in this repository. Microsoft's own material for this stage is planning support rather than diagnosis:
Every question is scored on four levels, and the levels are three different thresholds rather than one scale of "more".
| Level | Meaning |
|---|---|
| Not ready | This will break the pilot, or make its results uninterpretable. Fix before starting. |
| Emerging | The pilot can start, with a named condition and an owner against it. |
| Ready | The pilot will run cleanly and produce a trustworthy answer. |
| Scalable | This would survive org-wide rollout, not just a friendly pilot cohort. Not required to start a pilot. |
Two rules follow from that, and they are what make CARA usable rather than a gate everyone fails:
A pilot exists to answer questions. CARA is built so that it never demands the pilot's own output as the pilot's input.
NO-GO any dimension is Not ready
GO WITH CONDITIONS no dimension is Not ready, at least one is Emerging
GO all dimensions are Ready or better
SCALE-READY at least 4 dimensions are Scalable, none below Ready
The verdict is not an average. Averaging six dimensions hides the single fatal gap, which is the entire point of a go/no-go instrument.
46 questions across six dimensions. See content/questions.md, which is the human-readable source of truth. The app reads a typed mirror of it.
Full form for a proper engagement, short form (the pilot-critical subset) for a first conversation.
This project needs Node 22, which .nvmrc pins. In the project directory:
nvm use
npm install
npm test # scoring engine and Dutch coverage
npm run questions:check # validate the question bank
npm run questions:build # regenerate content/questions.md from src/data
src/data/ is the source of truth. content/questions.md is generated, so do not edit it
by hand.
English and Dutch, switched with the flags in the header. The choice travels in the share link, so a session filled in in Dutch opens in Dutch.
English is the source of truth in src/data/. Dutch is an overlay in src/i18n/nl/, keyed by
question id, so a third language can be added file by file without touching the English. A test
fails if any Dutch question, hint, anchor or launch condition is missing, because the runtime
fallback to English would otherwise hide the gap.
The page counts anonymous visits with Cloudflare Web Analytics: no cookies, no fingerprinting, no personal data. It exists to answer one question, whether anyone is using this, and nothing finer than that.
It is off unless a token is configured. The build reads VITE_CF_BEACON_TOKEN, and with no
token the script is never injected and the page makes no third-party request at all. A local
checkout and a fork are therefore silent by default.
Answers can never reach it. The share link encodes answers in the URL fragment, so the
fragment is read once on load and stripped from the address bar immediately, and nothing
writes it back. A share link is built on demand when you copy the report. Any analytics that
reported location.href would otherwise have shipped a complete set of client answers to a
third party, which is the failure this design exists to prevent.
In development. 46 questions with full rubrics and launch conditions, in two languages, with the scoring engine under test.
You are welcome to clone this and run it yourself, for your own organisation or with your own clients. Attribution is required. See LICENSE for the exact terms; the short version is that the credit line must stay visible wherever CARA is used or published.
git clone https://github.com/jellebelletje/CARA.git
cd CARA
nvm use # Node 22, see .nvmrc
npm install
npm run dev
To publish your own copy:
main. The workflow in .github/workflows/deploy.yml builds and publishes it.Everything runs in the browser. There is no server and no database, and nothing an assessment records leaves the machine it was filled in on unless the person filling it in chooses to share the link.
The question bank is meant to be adapted to your own practice.
src/data/dimensions/. Each question carries its own text, hint, four
rubric anchors and two launch conditions, so a change is local to one object.npm run questions:check to validate. It enforces unique ids, complete anchors, both
launch conditions, 5 to 10 questions per dimension, and the pilot-critical balance.npm run questions:build to regenerate content/questions.md.Keep the attribution in place when you do. Adapting the bank does not make it yours.
No em-dashes, anywhere, in content or code comments.
20 commits
TypeScript
98.0%
CSS
1.8%
A scored adoption readiness assessment for organisations considering a Microsoft 365 Copilot pilot. No signup, no server, results as PDF.
0
stars
20
commits
TypeScript
primary language
Aug 16, 2026
updated
Run the assessment: jellebelletje.github.io/CARA
A scored readiness assessment for the question organisations actually ask before starting a Microsoft 365 Copilot pilot: what has to be in place before we can start?
CARA is worked through as a conversation between an adoption coach and the organisation. It scores six dimensions, produces a go / no-go verdict, and turns every gap into a concrete launch condition: what to do about it, which side owns it, and whether it has to be closed before the pilot starts, alongside it, or before broad rollout.

A complete Copilot decision needs four stages. Microsoft covers three of them with real, runnable instruments. For the fourth it publishes checklists and guides but no scored diagnostic, and that is the gap CARA fills.
CARA is not a technical, security or data-governance assessment and does not replace one. Run the instruments below alongside it.
Assessments to run:
| Instrument | What it assesses | Where you run it |
|---|---|---|
| Copilot Optimization Assessment | Data governance maturity and data security controls. Microsoft recommends completing it before deploying Copilot. | M365 admin center, Copilot, Settings, Readiness |
| Copilot Readiness Report | Technical eligibility, prerequisite licences, update channels, assigned versus available Copilot licences, and recommended preparation actions. | M365 admin center, Reports |
| Purview DSPM for AI data risk assessments | Oversharing exposure. Which sites and files Copilot could surface, and which sensitive content is unlabelled. | Purview portal, DSPM, Discover, Data risk assessments |
| SharePoint Advanced Management content assessment | Sites that are overshared, ownerless or inactive, oversized audiences, and broken permission inheritance. Restricted Content Discovery excludes sensitive sites from Copilot. | SharePoint admin center |
Reference reading behind those:
CARA, the assessment in this repository. Microsoft's own material for this stage is planning support rather than diagnosis:
Every question is scored on four levels, and the levels are three different thresholds rather than one scale of "more".
| Level | Meaning |
|---|---|
| Not ready | This will break the pilot, or make its results uninterpretable. Fix before starting. |
| Emerging | The pilot can start, with a named condition and an owner against it. |
| Ready | The pilot will run cleanly and produce a trustworthy answer. |
| Scalable | This would survive org-wide rollout, not just a friendly pilot cohort. Not required to start a pilot. |
Two rules follow from that, and they are what make CARA usable rather than a gate everyone fails:
A pilot exists to answer questions. CARA is built so that it never demands the pilot's own output as the pilot's input.
NO-GO any dimension is Not ready
GO WITH CONDITIONS no dimension is Not ready, at least one is Emerging
GO all dimensions are Ready or better
SCALE-READY at least 4 dimensions are Scalable, none below Ready
The verdict is not an average. Averaging six dimensions hides the single fatal gap, which is the entire point of a go/no-go instrument.
46 questions across six dimensions. See content/questions.md, which is the human-readable source of truth. The app reads a typed mirror of it.
Full form for a proper engagement, short form (the pilot-critical subset) for a first conversation.
This project needs Node 22, which .nvmrc pins. In the project directory:
nvm use
npm install
npm test # scoring engine and Dutch coverage
npm run questions:check # validate the question bank
npm run questions:build # regenerate content/questions.md from src/data
src/data/ is the source of truth. content/questions.md is generated, so do not edit it
by hand.
English and Dutch, switched with the flags in the header. The choice travels in the share link, so a session filled in in Dutch opens in Dutch.
English is the source of truth in src/data/. Dutch is an overlay in src/i18n/nl/, keyed by
question id, so a third language can be added file by file without touching the English. A test
fails if any Dutch question, hint, anchor or launch condition is missing, because the runtime
fallback to English would otherwise hide the gap.
The page counts anonymous visits with Cloudflare Web Analytics: no cookies, no fingerprinting, no personal data. It exists to answer one question, whether anyone is using this, and nothing finer than that.
It is off unless a token is configured. The build reads VITE_CF_BEACON_TOKEN, and with no
token the script is never injected and the page makes no third-party request at all. A local
checkout and a fork are therefore silent by default.
Answers can never reach it. The share link encodes answers in the URL fragment, so the
fragment is read once on load and stripped from the address bar immediately, and nothing
writes it back. A share link is built on demand when you copy the report. Any analytics that
reported location.href would otherwise have shipped a complete set of client answers to a
third party, which is the failure this design exists to prevent.
In development. 46 questions with full rubrics and launch conditions, in two languages, with the scoring engine under test.
You are welcome to clone this and run it yourself, for your own organisation or with your own clients. Attribution is required. See LICENSE for the exact terms; the short version is that the credit line must stay visible wherever CARA is used or published.
git clone https://github.com/jellebelletje/CARA.git
cd CARA
nvm use # Node 22, see .nvmrc
npm install
npm run dev
To publish your own copy:
main. The workflow in .github/workflows/deploy.yml builds and publishes it.Everything runs in the browser. There is no server and no database, and nothing an assessment records leaves the machine it was filled in on unless the person filling it in chooses to share the link.
The question bank is meant to be adapted to your own practice.
src/data/dimensions/. Each question carries its own text, hint, four
rubric anchors and two launch conditions, so a change is local to one object.npm run questions:check to validate. It enforces unique ids, complete anchors, both
launch conditions, 5 to 10 questions per dimension, and the pilot-critical balance.npm run questions:build to regenerate content/questions.md.Keep the attribution in place when you do. Adapting the bank does not make it yours.
No em-dashes, anywhere, in content or code comments.
20 commits
TypeScript
98.0%
CSS
1.8%