What a Discovery Sprint actually delivers, day by day.

The pre-engagement: week zero, before the clock starts.

The Sprint is fixed-fee and fixed-duration, which only works if we walk in already loaded. Before Day 1 we ask for six things, and we will not start the clock until we have them: a signed scoping agreement and statement of work, read-only tenant access to your Microsoft 365 and Azure environments, a list of five to eight stakeholder interview targets with calendar coordinates, your current AI policy if one exists (a draft is fine; we expect a one-pager), the most recent IT or security audit you can share, and a list of the top five systems the organization runs day-to-day—your fundraising CRM, your EHR, your accounting platform, whatever the operational core looks like.

This intake takes roughly three business days on the client side, sometimes a week if the IT lead is part-time or the access provisioning has to wait on a board chair. The work is bounded and we send a checklist. The Sprint clock starts the morning we have all six. Everything that follows depends on this material being in place, which is why we treat it as part of the engagement rather than as a precursor to it.

The tenant access piece is the one that occasionally surprises people. We are asking for a read-only Global Reader role in Microsoft Entra and equivalent read access in Azure—not because we plan to change anything, but because the assessment tooling cannot generate a meaningful posture report on the outside. We document the access we use, log every read, and remove the role on Day 14. The scoping agreement names this in plain language, and your IT lead can revoke at any point.

Days 1–3: discovery interviews and tenant assessment.

The first three days run in parallel on two tracks. On the people side, we run 60-minute interviews with the Executive Director or CEO, the CFO or COO, the IT lead, two program leads, and one front-line staff member. The interviews are not surveys—they are structured conversations with a small set of questions we keep returning to: what do you do, what slows you down, where are you already using AI (named tools, ChatGPT included), and what are you afraid of. The front-line interview is the one that surfaces the shadow AI footprint that the executive team does not always know about.

On the tenant side, we run an automated assessment of the Microsoft 365 environment using Microsoft Partner tooling. The assessment pulls license utilization, identity posture (Microsoft Entra conditional access coverage, multi-factor authentication adoption per identity), data classification status (Microsoft Purview sensitivity labels applied, where, and to what), a SharePoint and OneDrive oversharing report, and Defender and Sentinel signal coverage across your endpoints and identities. None of this is generated by hand. The tooling exists and we are an accredited operator—our work in Days 1–3 is to run it correctly against your tenant, not to invent the analysis from scratch.

What the assessment finds is usually not what the client expects. We have walked into Business Premium tenants with conditional access policies written and never enforced, into E5 tenants paying for Purview and Defender capabilities that were never turned on, and into SharePoint estates where the "Everyone except external users" group had inherited edit access on roughly 40 percent of sites. The first three days are not about judgment. They are about establishing ground truth.

Days 4–7: the analysis.

By Day 4 we have raw discovery on one side and raw tenant data on the other. The analysis week turns both into four written artifacts, each scoped to be readable by a non-technical executive committee:

1. A shadow AI scan—which ungoverned AI tools are in active use, by whom, doing what, and where the organizational exposure sits (data leakage, vendor lock-in, compliance gaps).
2. An oversharing report—what content in SharePoint and OneDrive would Microsoft 365 Copilot expose on day one, prioritized by sensitivity and remediation difficulty.
3. A governance posture assessment—where you sit against the seven readiness questions we walked through in an earlier field note, scored on a four-point scale per question with the specific gap named.
4. An AI opportunity matrix—the top eight to twelve workflows in your organization scored by AI impact and implementation feasibility, with one recommended starting point that is small enough to ship in six weeks and meaningful enough to defend to a board.

The four artifacts are designed to compose. The shadow AI scan and the oversharing report describe the current state. The governance assessment names the work that has to happen before any new AI deployment. The opportunity matrix gives the organization a defensible first move. Together they form the spine of the Day 14 deliverable.

Days 8–11: deliverable construction.

The second week is writing. We assemble the four artifacts into a single board-presentable document and add the strategic layer that an executive committee actually needs in order to act:

• The findings, formatted as a 25- to 40-page document with an executive summary the board chair can read in ten minutes.
• A 90-day roadmap with three or four prioritized work streams, each with scope, duration, expected outcome, and a rough investment range. Excel for the operators, PDF for the board packet.
• A governance remediation plan—the specific tactical work to close the readiness gaps named in artifact three, sequenced and sized.
• A first-deployment recommendation, usually one workflow scoped at Agent Launchpad size—a six-week production deployment in the $25,000 to $50,000 range, with a written scope and named success metrics.
• The Microsoft license and incentive picture—what you are already paying for, what is underused (the typical foundation has 30 to 40 percent of its E3 or Business Premium entitlements dormant), and what Microsoft funding programs might offset the work ahead. This is where the Sprint frequently pays for itself in the first 60 days post-readout.

We write the document in plain language and pass it through a second-reader review on Day 11. If anything in the analysis is uncertain, we say so in writing rather than rounding to a confident sentence. The board deserves to see the confidence interval.

Days 12–14: the readout.

The last three days are the handoff. Day 12 and 13 are reserved for final document polish and scheduling. Day 14 is the readout: a 90-minute board-ready presentation to the executive team plus the IT lead, in person if you are in our footprint and over Teams if you are not. We walk through the findings, the 90-day roadmap, the governance remediation plan, and the recommended first deployment. We answer questions. We leave the document with you in editable form—the deliverable is yours, not ours.

The next step is yours. There is zero implicit obligation to engage Centered Networks for the work the roadmap describes. We have had Discovery Sprint clients take the document, hand it to their incumbent IT firm, and execute the roadmap that way. We have had others ask us to scope the first deployment on the spot. Both are fine. The Sprint is priced and structured to stand on its own, which is the whole point of paying for it.

One detail that matters for the readout itself: we recommend the IT lead attend, not just the executive committee. The roadmap names specific tactical work—a conditional access policy set, a Purview label scheme, a SharePoint permissions remediation plan—and the person who is going to either execute that work or supervise it needs to hear the rationale directly. The single most common request we get after the readout is "send a follow-up working session with our IT lead." We build that into the engagement at no additional cost.

What you walk away with.

On the morning of Day 14, before the readout begins, here is the full list of artifacts you keep—in writing, in your tenant or your file share, in editable formats your team can update without us:

• The 25- to 40-page Discovery Sprint findings document.
• The 90-day roadmap, in Excel and PDF.
• The shadow AI scan.
• The SharePoint and OneDrive oversharing report.
• The Microsoft license and incentive analysis.
• The governance remediation plan.
• The first-deployment scope document.

The structural promise is the part that surprises people, so it is worth restating in the language we use on the Discovery Sprint page itself: the deliverable lands on Day 14 or you pay nothing. We refund the engagement fee in full, no questions asked. We have not yet had to invoke this promise. Two weeks is a serious commitment from both sides, and the refund clause is how we put our money where the timeline is.