Publishing September 2026. Join the waitlist for first access

State of M365 governance report 2026: The confidence gap

Organizations have never been more confident about their M365 environments. Their own answers suggest they have never had less reason to be. New research from Syskit, conducted by Censuswide, measures the distance between the two, and what happens now that AI is reading everything the permission model allows.

The full report publishes this September. Join the waitlist and you'll get it first.

Get early access

Be the first to receive it in your mailbox

Join the waitlist, and we'll send you the complete report the moment it publishes in September, ahead of the public release. You'll find out what IT directors and cybersecurity seniors report about the current state of the M365 governance.

The gap at a glance

A preview of what the research found. The full report, all seven chapters, publishes in September.

327 IT and security decision-makers told us how well their Microsoft 365 environments are governed. Then they told us what is in them.

83% are confident they know exactly who has access to sensitive data. 90% experienced a confirmed or suspected security incident tied to misconfiguration or over-permissioned access in the past two years.
91% are confident AI would surface only content users are authorized to see. 58% admit confidential content is accessible to departments that should not see it, right now.
99% have Microsoft 365 audit logging enabled. 27% actively review those logs with alerts.

The full report explains the gap behind every one of these numbers.

Expert voices

Read alongside the people who help organizations secure environments.

Commentary throughout the report from Microsoft MVPs Vlad Catrinescu and Gokan Ozcifci, who work with Syskit, and from Syskit leadership including CEO Toni Frankola and Frane Borozan, President of the Board and Microsoft MVP.

Vlad Catrinescu

Syskit Technical Evangelist, Microsoft MVP, Microsoft Certified Trainer, Author

IT professional at heart, Vlad focuses on helping administrators deploy, manage, automate, and configure governance across services such as SharePoint, OneDrive for Business, and Microsoft Teams. As an author, Microsoft Certified Trainer, and recognized international speaker, Vlad has helped over a million IT professionals and end-users across the globe to better understand and to get the most out of Office 365 and the greater Microsoft 365 platform.

Gokan Ozcifci

Microsoft Regional Director & Microsoft MVP

Gokan is an independent SharePoint and Office365 consultant for Neoxy where he assists customers with building innovative, intelligent and responsive cloud driven solutions. With the Mobile first, Cloud first ideology, his aim is to empower every person and organization to do more with the Microsoft cloud and the ecosystem is perfectly aligned to accelerate this. Gokan is a frequent conference speaker and has been honoured with the Microsoft Regional Director and Microsoft’s Most Valuable Professional (MVP) awards. Additionally, he is an active Microsoft Certified Trainer (MCT) and a Microsoft Regional Lead for all MCTs in Belgium.

Frane Borozan

Microsoft MVP & President of the Board at Syskit

Frane Borozan is a Microsoft MVP for Microsoft 365 and M365 Copilot, and co-founder of Syskit. For more than a decade, he has helped enterprises gain control of their Microsoft 365 environments, specializing in governance, security, and preparing organizations for AI adoption. At Syskit, he drives product innovation, building tools that give IT teams the visibility and controls they need to deploy Microsoft 365 Copilot and other AI technologies securely and at scale. Beyond product development, he is an active member of the Microsoft community, regularly speaking at industry events, sharing technical insights, and helping organize community initiatives.

Untitled - April 19, 2026 at 19.11.06-53 (1)

Toni Frankola

CEO at Syskit

Toni Frankola is the CEO and co-founder of Syskit, leading the company since its founding in 2009. With more than 25 years of experience in IT, he has guided Syskit's evolution from on-premises administration tools to a Microsoft 365 governance platform, recognizing early that governance, security, and compliance would become critical as organizations moved to the cloud. Today, he focuses on the company's long-term strategy, helping enterprises prepare their Microsoft 365 environments for secure collaboration and AI adoption. He also writes about technology, software, and building product companies at toniontech.com.

What you’ll find inside

Attitudes, experiences, and what they have observed in their tenants in seven chapters. One gap, measured from every side. Here's what lands in September.

Where governance stands today. Only 1 in 20 organizations call their governance optimized, and half run it with one to two people.
The confidence paradox. What organizations believe about access, what they do to verify it, and what they admit is exposed anyway.
Sprawl, drift and ownership. More than 9 in 10 carry workspaces nobody owns, and only 16% have data ownership that works in practice.
The audit stopwatch. Just 4% could produce a full access report within an hour. For most, the honest answer is measured in days.
The hidden bill. 9 in 10 estimate at least one license in twenty is idle, and the vendor usually notices first.
AI on ungoverned ground. 76% have AI touching their M365 data. Fewer than half checked the permissions first.
What would move the needle. What actually unlocks governance investment, in the respondents' own words.

Plus:

An industry lens across six sectors
A US vs UK comparison
A self-assessment to locate your own organization on the maturity path

Curious to learn more about M365 governance?

Don't wait, and get in touch with our experts with all your governance challenges. Together we'll untangle messy permissions and simplify M365 management.

Let's talk

About this research

Research conducted by Censuswide among 327 IT and cybersecurity decision-makers in organizations of 500+ employees, United States and United Kingdom, May to July 2026. Full methodology will be published with the report. Please cite as Syskit, The State of M365 Governance Report 2026, and link to this page.