Montreal – September 23, 2026 -- Seventy-seven percent of organizations experienced at least one Microsoft 365 governance incident in the past year, even as two-thirds now run multiple AI tools against the same tenant content, according to the second annual State of M365 report released by ShareGate.
Three-quarters of organizations report Microsoft 365 governance incidents in the past year
The survey of nearly 1,800 IT professionals and leaders across nine countries found 38% left former employees or guests with access they should have lost, 35% hit an audit or compliance gap, and 26% had sensitive content reach the wrong people. A fifth incident category -- users unable to find content -- was reported by 41% but excluded from the headline figure, which would otherwise reach 82%.
Full Copilot deployment nearly doubles as AI tool sprawl accelerates
Full Copilot deployment rose from 29% to 56% year over year, and 93% of organizations now run Copilot in production in some form, up from 82% in 2025. Twenty-eight percent of fully deployed tenants run three or more AI tools; alongside Copilot, 54% use ChatGPT Enterprise, 36% use Gemini, and 32% use Claude for Work. AI now consumes more than a fifth of the IT budget at 22% of organizations, rising to 32% among those with full Copilot rollouts.
Purpose-built governance tooling stalls at 1% for a second straight year
Despite the incident rate, adoption of dedicated governance tools held flat at 1%, while 57% rely on built-in Microsoft tools, 38% use manual or internal policies, and 4% have no governance in place at all. Sixty-five percent of teams learn about problems only after the fact through quarterly audits or user complaints, versus 35% using proactive monitoring and automated alerting. Yet 63% of organizations describe their own governance as operationalized or better -- drawn from the same group that reported an incident.
Richard Harbridge, Principal Industry Advisor at ShareGate, said tenant environments are rarely broken outright; teams simply lack visibility into what is happening within them, and confidence grows in the absence of surfaced problems rather than the absence of actual issues. He noted that layering multiple AI tools onto ungoverned content compounds the visibility gap quickly.
Compliance concerns now delay one in three Microsoft 365 migrations
Thirty-four percent of organizations said compliance concerns caused them to delay or avoid a migration in the past 12 months, up from 20% in 2025, and 87% said compliance significantly or moderately impacts migration decisions, up from 82%. Only 7% of organizations said they would change nothing about their last migration; the top regrets were planning earlier (45%), buying tooling sooner (38%), and cleaning up the source environment first (36%). Sixty-eight percent still run hybrid cloud and on-premises environments, requiring every control to be applied twice, while only 28% are fully cloud-based, up from 22% a year earlier.
Asked what would help most, 34% of IT professionals pointed to better controls for AI agents, ahead of executive buy-in (20%) and automated remediation (18%); more budget ranked last at 3%.