Most Microsoft 365 Copilot training was built for commercial tenants. Washington state agencies do not run in commercial tenants. They run in GCC (Government Community Cloud), where web grounding ships off by default, where feature waves land on a different clock, and where the state’s new AI Policy (DATA-04, adopted by the State CIO on December 11, 2025) puts NIST AI Risk Management Framework obligations on top of every deployment. If your training deck came out of a commercial reseller’s content library, your users are getting taught features they cannot turn on and workflows that will not pass an audit.
Washington Is Not a Generic Training Market
Executive Order 24-01 set the direction in January 2024. DATA-04 made it operational at the end of 2025. Every state agency now has to designate an AI Contact, inventory AI-enabled technology, and align deployment to the NIST AI RMF. The AI Task Force Interim Report from December 2025 telegraphs where the legislature is heading next: developer and deployer obligations, transparency requirements, a hard line between low-risk and high-risk systems. Local governments, counties, cities, and special purpose districts are not strictly bound by the state policy, but procurement officers, records managers, and legal teams are reading the same documents and applying the same posture.
That is the floor your Copilot training has to clear. Generic “ten prompts to try in Word” content does not survive that floor. Your end users need to know what they can and cannot put into a prompt. Your IT staff needs to know what Purview labels, DLP policies, sensitivity classification, and Copilot interaction audit logs look like before a rollout, not after one. Your leadership needs to understand the NIST AI RMF mapping well enough to sign the inventory entry and defend it to an auditor or the public records request that is coming.
Training in Washington government is a compliance artifact. Treat it that way or skip it.
GCC Is Not Commercial M365 With a Flag On It
Copilot in GCC behaves differently from Copilot in commercial. Web grounding ships off. Tenant grounding is the whole game. Feature waves land later. Agent Builder is in GCC. Copilot Studio publishing to Teams and Microsoft 365 surfaces is in GCC. Researcher and Analyst agents are rolling into the government clouds on a separate cadence from commercial. A trainer who learned Copilot in a commercial tenant last quarter is teaching a different product than the one your users have in front of them. If your Washington government AI consultant cannot tell you which Wave 2 features are live in GCC this month and which are still in GCC-High preview, they are not the right one.
This matters for three concrete reasons. First, the default-deny posture changes what prompts produce useful output. If your retrieval surface is your SharePoint, OneDrive, and Exchange data and nothing else, your users have to learn how to write prompts that lean on that surface instead of expecting the model to pull in outside context. Second, the feature gap creates expectation management problems. A user who saw a commercial demo of a feature that has not landed in GCC will assume the product is broken. Third, the governance surface (Purview, sensitivity labels, DLP, conditional access, audit logging) is the entire point in GCC. Training that skips it is training that creates a public records problem and an oversharing problem at the same time.
What Real Copilot Training Looks Like in GCC
I run GCC Copilot and Power Automate training as workshops, not slide decks. The pattern that holds up across agencies:
Day one is M365 Copilot end-user fluency built around the agency’s actual document types. Records, case files, briefing memos, budget narratives, FOIA responses, policy drafts. Real prompts against the live tenant with sensitivity labels enforced. Users learn what works, what does not, and why. They leave with a prompt library tied to their job, not a generic cheat sheet.
Day two is governance and IT readiness. Purview label scheme review, DLP policy walk-through, audit log inspection, Copilot interaction audit, role-based access cleanup, oversharing assessment using Microsoft’s SharePoint Advanced Management tooling. This is where I usually surface the oversharing problem nobody wanted to look at before the rollout. It is also where the agency’s AI inventory entry starts to actually have evidence behind it.
Day three is builders. Copilot Studio agents, Power Automate flows, Agent Builder, custom MCP servers where they make sense. The goal is not to ship a hundred agents. The goal is to ship two that retire real FTE-hours, document them so they can be audited, and leave a pattern your internal team can copy without me in the room.
If a vendor is selling you a one-day Copilot 101 with no governance content and no builder track, you are paying for a podcast you could have listened to for free.
The Training Stack That Holds Up Across Renewals
M365 Copilot is the surface most users see, and M365 Copilot consulting is where most agencies start. But the surface is only as useful as what sits behind it. Copilot Studio development is where agency-specific agents get built: an HR policy agent that cites the actual handbook, a records retention agent grounded in the agency’s CORE schedule, a procurement agent that knows your contract vehicles. Power Automate is the connective tissue that takes a Copilot action and turns it into a workflow touching Graph, line-of-business systems, or RPA where the line-of-business system has no API. Custom AI agent development, including RAG over agency document corpora and custom MCP servers exposing internal tools, is where the agency stops being a consumer of Microsoft features and starts owning capability.
Training has to span that whole stack or it teaches users to ask Copilot for things their tenant cannot do. I write curriculum against what the tenant actually supports today, not what a Microsoft roadmap blog post promised for next quarter. When the roadmap lands, the curriculum gets updated. That is the difference between training that ages well and training that is stale by the time the second cohort runs.
Compliance-First, Not Compliance-Bolted-On
The NIST AI RMF is not a checklist you run at the end. Govern, Map, Measure, and Manage map cleanly onto how a Copilot deployment should be scoped, piloted, measured, and operated. DATA-04 expects you to show your work. Training should be the artifact that demonstrates the Govern function for your workforce: documented, role-based, retained, tied to a specific deployment, and inspectable on demand.
A training program that produces a sign-in sheet and a feedback form is not an artifact. A training program that produces a curriculum map tied to NIST AI RMF functions, a Purview label exercise log, an audit log review walk-through, and a builder portfolio with documented agents is an artifact your AI Contact can hand to a legislator or an auditor without flinching.
Why Direct Engagement Beats a Big Integrator for Training
Big integrators send a sales engineer to scope, a junior to deliver, and a project manager to invoice. The person teaching your staff Copilot Studio has often never published an agent into a production GCC tenant. I scope, build, and deliver the work myself. The engineer in front of your team is the same one who wrote the curriculum and the same one who will be in the tenant when something breaks at 4 PM on a Friday.
Puget Sound AI is a veteran-owned small business out of Puyallup. U.S. Navy veteran founder, SAM active, UEI SU4QWJZWXY97, CAGE 17DX6, NAICS 541512, 611420, and 541519. Contract types that work for direct engagement: micro-purchase, simplified acquisition under FAR Part 13, firm-fixed-price, time and materials. Most Washington agency training engagements close inside simplified acquisition thresholds, which means a procurement officer can move on it without a months-long competition. For agencies that want a structured production push instead of standalone workshops, the GCC AI Jumpstart takes a single agency use case from scope to production in six weeks with training and documentation built in.
Next Step
If you are responsible for Copilot rollout, GCC AI training, AI governance, or the DATA-04 inventory at a Washington state agency, county, city, or special purpose district, the path forward is a thirty-minute call. I will tell you whether a workshop, a readiness assessment, or a jumpstart engagement is the right next move, and I will tell you honestly when the answer is none of those. Let’s talk.