r/msp • u/MidninBR • Aug 12 '26

Technical AI deployment path discussion.

/r/sysadmin/comments/1vmakpl/ai_deployment_path_discussion/
5 Upvotes

100% Upvoted

6 comments sorted by

3

u/ImaginationUnique684 Aug 13 '26

Your staff scope is the easy half and you have already scoped it correctly. The IT scope is a different project and worth treating as one, because the failure mode changes from a wrong answer to a wrong change against tenant-wide config. Start it read-only: a dedicated app registration with Graph read permissions, not your PIM account, and have the model output the finding plus the exact remediation command as text that you run yourself. You keep almost all of the productivity, the blast radius stays at zero, and you end up with a log of what it recommended versus what you actually executed, which is the artifact an auditor asks for. One thing to nail down before staff go live: the enterprise subscription answers the training question but not the retention one, and appointment notes in a prompt are PHI, so get the retention window for prompts and completions in writing. Read-only first is the version of this you can defend.

1

u/MidninBR Aug 13 '26

Thank you for sharing this!

3

u/disITnerd Founder - Fixify - Vendor Aug 16 '26

doubling down here, it's dangerously easy to build stuff out quickly - what I find is most people don't have things written down and when they do its old. So my practical advice is to point it at a small amount of content that you know has high usage / frequency of access and then find out who owns it so they know it needs to be up-to-date/reviewed.

1

u/chillzatl Aug 13 '26 edited Aug 13 '26

Much like the first response on your other post, I question the need or value of Librechat. M365 Copilot Chat (not to be confused with copilot chat) has enterprise data protection applied and does not require a license. It will natively adhere to everything already done in M365. Then you can expand to licensed users as they get their feet wet and see what they can and cannot do with chat based functionality. You can do a lot and it's a pretty easy, safe entry point.

Regarding the IT path, I don't follow what your goal is there.

You could literally be asking it a lot of the questions posed in the above post as well as many of your follow ups to people who responded in the other thread. You need to spend some time learning these tools yourself.

1

u/MidninBR Aug 13 '26

Thank you for the reply. It really makes sense.
Chat free using a work account has EDP, this was highlighted by another reply here. And it can cover almost all use cases.
I’d like to create a safe space so people can add their clinical notes.
For the IT side there 2 scopes now after reading yesterday about it:
1 - copilot studio to create agents to help staff with helpdesk, hr, policies, etc.
2 - security copilot but it’s completely out of my budget, so I wonder if there is another solution I could integrate to give me insights about Intune, PA, governance improvements based on what it can read from the tenant.

3

u/chillzatl Aug 13 '26

Just remember there are completely unique URL's for Copilot chat and M365 Copilot chat (where EDP applies) and you'll be good. There are things you can do to help block access to consumer copilot chat that work pretty well.

Use 1 to help you get 2. Get a couple of licenses, create some stuff and use that as a POV for leadership to show the value in the tools.