The AI practice toolkit for MSPs.
Scope, sell, and deliver from proven assets.

Install all required PowerShell modules (Microsoft.Graph, ExchangeOnline, Teams, Az, PnP) and connect to the client tenant. Run this first.

Collects licence inventory, SKUs, assigned vs available seats, and flags AI-relevant licences. Output: tenant-profile.json, licence-inventory.csv.

Discovers Copilot for M365 licensed users, Teams AI apps, Power Platform signal. Output: copilot-licensed-users.csv, teams-ai-apps.csv.

Assesses Secure Score, Conditional Access policies, privileged role assignments, and guest access config. Output: secure-score.json, conditional-access-policies.csv.

Inventories Microsoft Purview sensitivity labels, DLP policies, SharePoint sharing settings, and retention policies. Output: sensitivity-labels.csv, dlp-policies.csv.

Collects M365 usage reports to understand collaboration patterns and department-level tool adoption. Output: department-activity-summary.csv.

Checks Power Automate environments, connector policies, flow count, and generates an automation opportunity map. Output: power-platform-environments.csv.

Aggregates all output into discovery-report.json and generates a client-ready discovery-summary.html with RAG status for each domain.

Runs scripts 01–08 in sequence with a single command. Pass -TenantDomain and -TenantName parameters.

Pre-engagement checklist, stakeholder interview questions for CEO/IT/Finance/Ops/HR/End users, PSF scoring methodology, and readout structure.

Pre-formatted Excel workbook to paste CSV outputs into for client-ready presentation. Includes RAG status cells and summary charts.

Word template for the written discovery summary report. Eight sections, structured to map directly to the HTML output from script 08.

Complete SOW with scope narrative, deliverables list, exclusions, timelines, payment terms, and liability clauses.

SOW for a standard deployment engagement. Includes phased delivery milestones, client obligations, acceptance criteria, and change control process.

SOW for policy development engagements. Includes document list, review process, sign-off mechanism.

Monthly retainer SOW with service description, review cadence, SLAs, termination clauses.

One-page change request for scope changes. Captures what changed, why, time/cost impact, and client approval signature.

Day-by-day task plan for a 2-day on-site assessment. Includes pre-engagement prep, interview schedule, analysis, report writing, and readout. Gantt + task list.

Full Gantt for a standard 6-week Copilot deployment. Phases: tenant readiness, data governance, agent build, pilot, monitoring setup, handover. Includes client task dependencies.

10-day project plan for policy development. Includes stakeholder interviews, drafting, review cycles, and sign-off.

Standard 60-minute kick-off agenda. Covers scope confirmation, stakeholder introductions, access requirements, communication norms, and next steps.

Everything you need from the client before starting: admin access, licence details, data classification status, key contacts, existing tools inventory.

One-page weekly report: progress this week, planned next week, RAG status, risks, decisions needed. Send every Friday.

Formal sign-off document at project close. Captures deliverables accepted, outstanding items, warranty period, and next engagement recommendation.

3-page proposal. Page 1: what we're proposing and why it matters. Page 2: scope and deliverables. Page 3: investment, timeline, about us.

4-page proposal with deployment phases. Includes ROI calculator section (time saved × headcount × cost) and PSF alignment paragraph.

2-page proposal. Designed for risk/compliance audiences. Opens with regulatory framing.

3-page proposal for audit engagements. Explains the PAI-8 maturity model and what a scorecard looks like. Designed for boards and procurement.

1-page retainer proposal. Clear service description, monthly scope, pricing, and what's excluded.

About your AI practice. Your credentials, methodology, team, and what makes you different. Attach to proposals or send standalone.

Client-facing spreadsheet. Input: headcount, task types, hours per week. Output: estimated hours saved per year, cost of AI deployment vs value of time returned. Bring it to the discovery call.

7 templates: awareness email, follow-up, discovery confirmation, proposal cover note, proposal follow-up, engagement start, engagement close.

The core assessment tool. 8 control sheets (C1–C8), each with evidence prompts, maturity descriptors (L0–L3), scoring calculation, and finding narrative fields. Auto-calculates domain and overall scores.

Interview questions for 5 stakeholder types: technical lead, operations lead, compliance officer, senior executive, end user. 40–60 minutes each.

What to ask for before arriving on-site. AI policies, data classification records, system architecture, incident logs, vendor contracts. Tells the client what to prepare.

Structured risk log for assessment findings. Columns: control domain, finding description, current risk rating, recommended remediation, target risk rating, ownership.

Log of evidence collected during the audit. Document name, date, source, what control it supports, assessor notes.

Send to clients 2 weeks before assessment. Gathers basic information so you hit the ground running: AI tools in use, existing policies, M365 licence level, headcount.

SharePoint sharing settings, sensitivity label status, guest access review, DLP policy inventory, conditional access review, MFA coverage. Pass/fail per item with remediation notes.

Pre-designed 4-label scheme (Public / Internal / Confidential / Highly Confidential) with Copilot access rules per label. Customise and implement.

10 pre-written system prompts for common Copilot agent types: IT helpdesk, HR FAQ, sales assistant, finance query, onboarding guide, meeting summariser, project status, customer service, procurement, and policy advisor. Each includes CAN/CANNOT/UNCERTAIN instructions.

Document every connector: system connected, service account used, permissions granted, date configured, least-privilege sign-off. Audit trail for each integration.

The complete pre-go-live checklist from the M365 playbook in working document form. Each control has a responsible owner, evidence field, and sign-off signature line.

Structured UAT for Copilot agents: happy path tests, edge cases, scope boundary tests, prompt injection tests, connector failure tests, approval flow tests. Pass/fail with tester notes.

The document you leave with the client. What the agent does, what it doesn't do, how to add knowledge sources, how to modify topics, who owns it, who to call.

For the client's internal IT team. Where the dashboards are, what metrics to review weekly, what triggers an incident, escalation path.

Client-facing procedure for AI agent incidents. How to identify, contain, and report. Who to notify (including the MSP). Evidence preservation steps.

Staff-facing policy: what AI tools are permitted, what data can be used with AI, what is prohibited, how incidents are reported. 4–6 pages. Plain English.

Governs how AI tools and services are evaluated, approved, and procured. Includes vendor risk assessment criteria aligned to PSF D8.

Standard data classification extended with AI-specific rules: what each classification level means for AI processing, prompting, and output handling.

A living document listing every AI agent in use, what actions it can take, which actions require human approval, and who is the named responsible owner.

What to do when an AI agent does something unexpected. Identification, containment, investigation, notification, and post-incident review.

Records of processing activities for AI-related data processing. One template per AI system. Covers data categories, legal basis, retention, and Microsoft as processor.

Ongoing risk register for AI systems in production. Inherent risk, controls, residual risk, review date, owner.

40-slide deck for a 3-hour workshop. Sections: What AI agents are (non-technical), how to use Copilot effectively, what to do when something seems wrong, data and privacy, hands-on exercises. Fully designed, fully branded for PAI / your company.

Script and timing for every slide. Discussion questions, exercise instructions, common questions and answers, energy management notes.

5 exercises for the workshop: effective prompting, finding information with Copilot, summarising a meeting, spotting a hallucination, deciding when not to use AI.

Leave-behind for workshop attendees. Key concepts, reference card for Copilot usage, data handling rules, how to report an issue.

Printable/PDF certificate for workshop attendees with your branding, date, and participant name.

Separate shorter deck for senior management. Covers: what the business now has deployed, what the risks are, what governance is in place, what to expect.

A tabletop exercise scenario for client IT/governance teams. Fictional AI agent incident with injects. Tests the client's actual incident response procedure.

Full assessment report template. Executive summary (2 pages), PAI-8 domain findings, risk register, prioritised roadmap, appendices. Structured for board presentation.

Formal audit report with maturity scorecard, detailed domain findings, evidence summary, recommendations, and management response section.

Delivered at project close. What was deployed, how it was configured, what monitoring is in place, what the client is responsible for ongoing.

One-page monthly report: agent performance metrics, incidents this month, controls reviewed, recommendations, next month's focus.

10-slide deck for presenting findings to exec teams. Summary, top 3 findings, risk heatmap, roadmap, investment case. Designed for 20-minute board slot.

High-resolution badge for your website, proposals, and email signature. 'PAI Certified AI Integrator' with verification link.

Plain-language, non-technical explainer for business owners. Your branding. Leave behind after discovery calls or attach to awareness emails.

10 ready-to-publish LinkedIn posts across a 10-week narrative arc: credential announcement → first client → what we learned → sector use cases → common mistakes → next steps.

Ready-to-paste copy for your website's AI services page. Intro, service list, credentials, 'why us', CTA.

HTML email signature block with credential badge and verification link. Also as DOCX instructions for Outlook.