Report by Syskit
State of M365 governance report 2026: The confidence gap
Key Findings
83% of respondents are confident they know exactly who has access to sensitive data in their Microsoft 365 environments.
90% of IT and security decision-makers experienced a confirmed or suspected security incident tied to misconfiguration or over-permissioned access in their Microsoft 365 environments in the past two years.
91% of IT and security decision-makers are confident AI would surface only content users are authorized to see.
58% of IT and security decision-makers admit confidential content is accessible to departments that should not see it right now.
99% of IT and security decision-makers have Microsoft 365 audit logging enabled.
27% of IT and security decision-makers actively review Microsoft 365 audit logs with alerts.
5% rate their Microsoft 365 gonernance as optimized.
4% could produce a full access report within an hour if an auditor asked today.