Most firms report Microsoft 365 access and sharing failures as Copilot use doubles
Reviewed by Helen Jones
ShareGate published its second annual State of M365 report on 23 September 2026, drawing on two surveys of nearly 1,800 IT professionals and leaders in nine countries. Seventy-seven percent said they had at least one governance incident in the past year, defined as oversharing, leftover access, audit gaps, or shadow IT and AI. The most common failures were former employees or guests still holding access they should have lost (38 percent), an audit or compliance gap (35 percent), and sensitive content reaching the wrong people (26 percent). Forty-one percent also said users could not find content, a figure ShareGate left out of the 77 percent total. Full Copilot deployment roughly doubled from 29 percent to 56 percent, and 93 percent now have Copilot in production in some form. Only 1 percent use purpose-built governance software. Fifty-seven percent rely on Microsoft's own tools, 38 percent on manuals and internal policy, and 65 percent still learn about problems after the fact through quarterly audits or user complaints.
Before Copilot was common, leftover guest accounts, sharing links, and messy permissions mostly sat quiet until an audit or a ticket. A small admin team could treat cleanup as a slow backlog because most employees never saw the full picture of who could open what. That bargain is weaker now. Copilot and extra AI tools retrieve whatever they are allowed to see, so the same stale access that used to be invisible becomes an answer in chat. The survey is self-reported and ShareGate sells governance products, but the pattern matches what already shows up in SharePoint admin work: incidents are found late, and the first Copilot wave is landing on tenants that still govern by complaint.
Analysis
Treat this as a change to act on before the next Copilot expansion, not a reason to buy a new platform. Pick one busy Team or communication site, dump owners, guests, and sharing links, and close leftover access for people who have already left.
Source note
Pulse published by Collab365 Spaces, reviewed by Helen Jones on . Cite as "Most firms report Microsoft 365 access and sharing failures as Copilot use doubles", Collab365 Spaces. 2 sources referenced.