Three in four organizations experienced Microsoft 365 governance incidents in the past year, as AI adoption outpaces the skills to govern it

ShareGate releases second annual State of M365 report highlighting a governance crisis, as 67% of organizations run two or more AI tools in their tenants 

MONTREAL, Sept. 23, 2026 /PRNewswire/ -- In the past year, 38% of organizations left former employees or guests with access they should have lost, 35% hit an audit or compliance gap, and 26% had sensitive content reach the wrong people. Altogether, 77% experienced at least one Microsoft 365 governance incident, as two-thirds now run two or more AI tools on that same content. Meanwhile, just 1% use a purpose-built governance tool. AI Adoption moved. Controls did not. The result is compliance and security exposure that most organizations can neither measure nor prove they control. 

That is the central finding of the second annual State of M365 report, released today by ShareGate, the tool helping over 100,000 IT pros keep their enterprise content under control. Drawing on two surveys of nearly 1,800 IT professionals and leaders across nine countries, the report examines how organizations managed, secured, and migrated content in Microsoft 365 in 2026. 

What makes those incidents more consequential than they were a year ago is what now reads across them. Full Copilot deployment roughly doubled, from 29% to 56%, and 28% of those tenants run three or more AI tools. Content that was once overshared has now become a liability that an AI tool can retrieve on request. 

The report points to three factors behind the incident rate: fragmented visibility into their own environments, overconfidence in how well governed those environments are, and an AI governance skills gap that has not closed. On the first, nothing has changed: purpose-built governance tooling still sits at 1%, the same share as in 2025, while 57% use built-in Microsoft tools, 38% rely on manual/internal policies, and 4% have no governance at all. 

The research also reveals that many organizations rely on periodic reviews to catch problems that everyday collaboration in a professional Microsoft 365 environment creates. 65% of teams learn about them only after the fact through quarterly audits or user complaints, while just 35% rely on proactive monitoring and automated alerting. Surprisingly, governance self-assessment runs in the opposite direction. 63% of organizations describe their governance as operationalized or better, drawn from the same 77% group who reported an incident, with just 1% using tooling built for the job. 
 
"Most of the tenant environments I look at aren't broken; they just don't know what's happening within them. Teams feel confident because nothing has surfaced yet, but that doesn't mean there's nothing wrong," said Richard Harbridge, Principal Industry Advisor at ShareGate. "That gap between 'no news' and 'no problems' is exactly where the governance incidents live, and when you layer in multiple AI tools, the visibility problem compounds fast. The fix isn't more diligence or a bigger team. It's tooling and processes that surface and fix problems in week one instead of month three." 

Other findings from the report include: 

• Copilot is now close to universal in Microsoft 365 tenants. 93% of organizations have it in production in some form, up from 82% in 2025.

• The AI stack is fragmented. Alongside Copilot, 54% use ChatGPT Enterprise, 36% Gemini, and 32% Claude for Work. 

• AI is already a material line item. 22% of organizations say AI has taken more than a fifth of their IT budget, rising to 32% among teams that have fully deployed Copilot. 

• Better controls for AI agents is the #1 thing IT professionals say would help most, named by 34%, ahead of executive buy-in (20%) and automated remediation (18%). More budget finished last at 3%.

• Compliance is stopping Microsoft 365 migrations at a growing rate. 34% of organizations said compliance concerns caused them to delay or avoid a migration outright in the past 12 months, up from 20% in 2025. 87% said compliance significantly or moderately impacts migration decisions, up from 82%.

• Almost nobody would run their last migration the same way. Only 7% would change nothing. The top regrets are planning earlier (45%), buying tooling sooner (38%), and cleaning up the source environment first (36%).

• Most environments are still split between cloud and on-premises. 68% run hybrid, which means every control has to be applied twice. Only 28% are fully in the cloud, up from 22% last year. 

The State of M365 report combines two self-reported surveys, each conducted across nine countries: 943 IT professionals, ranging from managers to VPs, on Microsoft 365 migration, compliance, and governance, and 851 IT leaders on AI deployment, costs, and exposure. Percentages are based on each question's response data. Governance incidents counted oversharing, stale access, audit gaps, and shadow IT/AI. A fifth category, users unable to find content, was reported by 41% of organizations but kept out of the headline figure, which would otherwise have been 82%. 

The full State of M365 research is available on ShareGate's website, with market-by-market insights across the United States, Canada, the UK, France, Germany, Ireland, the Netherlands, Australia and Japan. The interactive microsite includes the Microsoft 365 Governance Index, which lets IT teams benchmark their own environment against the results by country, industry, or organization size.

About ShareGate   
ShareGate keeps enterprise content ready for whatever comes next. It helps organizations understand what's in their Microsoft 365 tenant, move content where it belongs, and keep it under control so they always know what they have, where it is, and who can reach it. 

More than 100,000 IT professionals use ShareGate: in-house teams running their own Microsoft 365 environment, and the consultants, systems integrators and resellers who deliver that work for clients. It moves over 5 petabytes of data every month and has spent 15 years in the trenches alongside them. 

ShareGate is developed by Workleap Technologies, a Montréal-based software company.

Media Contact  
Tanner Garza  
PANBlast for ShareGate  
[email protected]