The problems and why they matter

Findings from the State of M365 Governance Report 2026 show a clear confidence gap:

• 83% are confident they know who has access to sensitive data, yet 90% have experienced a confirmed or suspected incident linked to misconfiguration or over-permissioned access.
• 91% are confident AI would only surface authorised content, while 58% admit confidential content is currently accessible to the wrong departments.
• 76% have deployed or piloted Copilot or another AI tool accessing M365 data, but only 43% completed a thorough permissions review first.

AI didn't create these governance gaps. It is making them harder to ignore and making the ability to identify and verify them more important than ever.