Two thirds of Microsoft 365 teams learn of governance incidents only via audits or user complaints

A review every three months leaves up to about 91 days between a bad change and the report that finds it. Most of these tenants run on a 91-day detection floor ^[4][8].

Scale the access failure against the whole sample. 38% of the 77% who reported an incident works out to roughly 29% of every organisation surveyed, so about three in ten left a departed employee or an external guest holding access for some part of the year ^[1].

None of the three failure modes the report counts is an intrusion. Two of them are access that should have been revoked and content that reached the wrong readers ^[3][5].

Stale guest accounts are an old problem. Copilot coverage grew by a factor of 1.93 in twelve months ^[2], and spending moved with it: 22% of respondents said AI has taken more than a fifth of their IT budget, rising to 32% among teams with Copilot fully deployed ^[9].

Asked what would help most, 34% chose better controls for AI agents, 20% executive buy-in, 18% automated remediation and 3% extra budget ^[12]. The agent-control ask outweighs the budget ask by about eleven to one ^[3].

ShareGate is a Microsoft 365 governance specialist and ran both surveys itself ^[2][16]. Its reading is that the incidents come from poor visibility, overconfidence in current governance approaches and AI governance skills gaps ^[13]. Among respondents, 37% named a lack of AI governance expertise as a top concern, behind data quality and retention and behind security and access ^[11].

"Most of the tenant environments I look at aren't broken; they just don't know what's happening within them. Teams feel confident because nothing has surfaced yet, but that doesn't mean there's nothing wrong," said Richard Harbridge, principal industry advisor at ShareGate ^[14]. He also said: "The fix isn't more diligence or a bigger team. It's tooling and processes that surface and fix problems in week one instead of month three." ^[15]