Why Microsoft 365 AI Demands More Than Good Intentions

by Christian Buckley · October 14, 2026

Yes yes yes….enterprise AI is transforming the modern workplace, Copilot is streamlining our workflows, and organizational productivity is supposedly hitting an all-time high….yada yada yada. But if you spend any real time under the hood of enterprise Microsoft 365 environments, you know there’s often a canyon between executive ambition and what IT is actually dealing with on the ground.

A recent data graphic from ShareGate’s State of Microsoft 365 study (https://sharegate.com/state-of-microsoft-365) sums this up perfectly under the banner of “Belief vs. Proof.” It highlights a persistent pattern in IT operations: teams assume they’re covered, but the operational data tells a much messier story.

When you line up ShareGate’s findings with broader research from Microsoft, McKinsey, and Gartner, the core takeaway is impossible to ignore. Good intentions aren’t a substitute for automated governance.

1. The Permissions Paradox and AI That Respects Bad Hygiene

ShareGate found that while a staggering 93% of IT teams feel confident their AI permissions are dialed in, nearly a third (29%) have already had AI surface restricted or sensitive files to users who shouldn’t have seen them. Here’s the reality: Copilot and adjacent generative AI tools don’t break through your security perimeter. They honor existing permissions with ruthless accuracy. Decades of sloppy ACL inheritance, orphaned “Anyone with the link” shares, and wide-open SharePoint team sites, the stuff that stayed buried simply because traditional search was clumsy, suddenly get pulled right to the surface the second someone asks a natural language question.

This is a drum I’ve been beating for a while. Back in May, I wrote about the governance practice that lives entirely off the books in most organizations, where sensitive content sits in a cryptically named SharePoint site and everyone assumes that obscurity equals protection (https://buckleyplanet.com/2026/05/copilot-doesnt-know-about-your-unwritten-rules/). I call it the Delve Effect, because we went through this exact panic when Delve launched and people insisted their permissions were broken. They weren’t broken then, and they aren’t broken now. They’re working as designed. The unwritten rules don’t travel, but the permissions do. That 29% tells me a lot of organizations are still learning this the hard way, and my advice hasn’t changed: run the SharePoint Advanced Management content assessment before you broaden your rollout, start with HR, legal, finance, and executive content, and treat permission hygiene as an ongoing rhythm rather than a project with a completion date.

If you want to dig deeper into closing these gaps, take a look at the Microsoft Data Security Index report (https://info.microsoft.com/ww-landing-data-sec-index-2026.html), which explores how automated posture management helps rein in data leakage across modern workloads. It’s also well worth checking out Gartner’s generative AI insights (https://www.gartner.com/en/topics/generative-ai) for their analysis on why lingering permission debt continues to stall enterprise rollouts.

2. Strategy Without Accounting and the AI ROI Black Hole

According to ShareGate, 75% of organizations say they have clear AI objectives, but 51% point to poor cost visibility as their number-one obstacle to proving return on investment. It’s easy for leadership to mandate Copilot adoption across every department, but very few organizations take the time to set up real accounting frameworks to track license utilization, prompt habits, or hard operational gains. Without verifiable numbers, those ambitious AI goals quickly run into skeptical CFOs.

I’m not at all surprised by the cost visibility number. In June, I wrote about why the go-live party is where most Copilot deployments go to die (https://buckleyplanet.com/2026/06/the-go-live-party-is-where-most-copilot-deployments-go-to-die/): the licenses get provisioned, leadership gets a “deployment complete” update, the project team disbands, and the usage data sits in the admin center with nobody acting on it. Part of the ROI problem is that we measure the wrong things. Cumulative license activations is a number that only goes up, and it tells you nothing about whether the tool is embedded in how people actually work. The organizations where Copilot takes hold measure active usage by role on a regular cadence and tie it to specific scenarios. And with consumption-based pricing now in the mix thanks to Copilot Cowork (https://buckleyplanet.com/2026/07/with-copilot-cowork-generally-available-how-costs-change/), cost visibility is only going to matter more.

For a broader perspective on the value-realization problem, head over to McKinsey’s The State of AI (https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai), where their data shows that while GenAI adoption is everywhere, fewer than one in four organizations can tie it back to concrete bottom-line EBIT gains. On the flip side, check out the Microsoft Work Trend Index (https://www.microsoft.com/en-us/worklab/work-trend-index) for a look at how early qualitative metrics, like user satisfaction and workflow velocity, might provide interim indicators while financial reporting catches up.

3. The Governance Illusion of Manual Checklists

ShareGate points out that 63% of IT teams describe their M365 governance as operationalized or mature, yet only 1% actually govern using a purpose-built tool. Relying on default admin center toggles, manual checklists, or a shared Excel spreadsheet isn’t real governance. It’s administrative optimism. In fast-moving collaborative tenants, passive policies remain purely hypothetical until an embarrassing oversight forces everyone into crisis-cleanup mode.

That 1% figure is the one that jumps off the page for me. When I wrote about sensitivity labels back in June (https://buckleyplanet.com/2026/06/the-label-on-the-door-does-not-protect-what-is-inside/), the core point was that labels only work when they’re applied by design, through a provisioning workflow that maps a workspace’s purpose to the right label, rather than leaving that decision to whoever happens to click “Create team.” That’s what operationalized governance actually looks like. The system makes the right call by default, so the average user never has to think about it. A checklist, on the other hand, depends entirely on someone remembering to check it. The architecture isn’t complicated, but it requires an intentionality that most deployments skip in the rush to get Copilot enabled.

You can explore this disconnect further in McKinsey’s QuantumBlack Insights (https://www.mckinsey.com/capabilities/quantumblack/our-insights), which unpacks why documented rules fall flat without automated technical enforcement. I also recommend reading the 2026 Microsoft Work Trend Index Annual Report (https://www.microsoft.com/en-us/worklab/work-trend-index) to see how the surge in autonomous agents and AI workflows is exposing brittle operational frameworks across major enterprises.

4. Asymmetric Sprawl and the Unlocked Back Door

One of the most telling data points in the report is that 90% of organizations put friction or approval gates in front of creating a new workspace, but only 35% do anything to manage end-of-life or decommissioning. In other words, IT guards the front entrance like a fortress while leaving the loading dock wide open. Inactive SharePoint sites, abandoned Teams channels, and orphaned Microsoft 365 Groups sit around forever, silently piling up storage costs, cluttering user search, and leaving stale data waiting for an AI prompt to misinterpret it.

Sprawl is one of the oldest problems in the SharePoint world, and I’ve been writing and speaking about it for years. What worries me now is that the back door is getting bigger. In my post on why security fundamentals still matter in the age of AI (https://buckleyplanet.com/2026/08/ai-is-changing-security-but-fundamentals-still-matter/), I talked about offboarding debt. If you build five custom agents to help automate your sprint tasks, who turns them off when the project wraps up or you change roles? Companies already struggle to revoke access when an employee changes departments. Now imagine managing that employee plus the twenty-odd background automations they spun up over the course of a year. Workspaces, groups, agents, and connections all need an end-of-life plan, and the stale content they leave behind is exactly what Copilot will happily pull into an answer.

To see the full breakdown and how your own environment compares, grab the complete ShareGate report. It offers great context on lifecycle bottlenecks and practical ideas for getting decommissioning off the back burner.

5. Migration Hesitation and the Gap Between Trusting the Cloud and Trusting Your Tenant

A massive 96% of IT teams feel confident Microsoft 365 meets their regulatory and compliance standards, yet 34% still delay or dodge migrations out of compliance fears. On top of that, 83% want identity preparation baked directly into their migration tools, but only 11% have it. There’s a crucial difference between trusting Microsoft’s underlying datacenter security and having complete confidence in your own tenant’s hygiene. When identity and permission cleanup has to happen manually before a move, projects stall.

I spent a good chunk of my career on the migration side of this ecosystem, including director roles at Metalogix and AvePoint, and this pattern is a familiar one. Most migrations don’t stall because of the cloud. They stall because of what we’re trying to bring with us. On Episode 30 of Guardians of M365 Governance (https://buckleyplanet.com/2026/06/summary-of-guardians-of-m365-governance-ep-30/), we talked about how organizations often migrate old habits into new platforms without ever realizing the business value of modern collaboration, and permissions and identity are the most expensive habits to move. When identity cleanup is a manual pre-migration chore, it becomes the long pole in the tent, and that’s usually when compliance concerns turn into a reason to wait. Microsoft’s datacenter isn’t the risk. A decade of unmanaged access is.

To get clarity on where platform security ends and tenant responsibility begins, review the Microsoft Trust Center (https://www.microsoft.com/en-us/trust-center). It provides a solid baseline for the shared responsibility model, which is essential context whenever compliance questions hold up a migration.

Verification Checklist for Moving From Belief to Proof

Bridging the gap between what you think is happening in your tenant and what you can prove requires shifting away from passive policies and toward automated operational hygiene. Use this checklist to baseline your Microsoft 365 estate before expanding your AI rollout:

Audit open groups and broken inheritance. Run tenant-wide discovery scans on public groups, orphaned OneDrive accounts, and sites using broad internal sharing links before assigning more Copilot licenses.
Automate end-of-life lifecycle policies. Replace manual reviews with automated inactivity triggers, periodic group owner attestations, and archiving workflows so workspaces don’t outlive their purpose.
Establish concrete cost-per-outcome metrics. Track targeted workflow velocity, prompt adoption frequency, and seat activity rather than relying exclusively on broad qualitative satisfaction surveys.

Don’t wait for an internal audit or an embarrassing data leak to find out where your tenant actually stands. Run a discovery scan on your public workspaces and over-permissioned sites this week, and start building an operational baseline you can actually defend.