Configuration-led approaches to Microsoft 365 governance are no longer sufficient, according to new research from Info-Tech Research Group. The spread of AI tools such as Copilot is making the weaknesses harder to ignore.
The global IT research and advisory firm published the finding in its blueprint, Govern Microsoft 365, which sets out a policy-first framework to help IT and security leaders align governance to business priorities, reduce risk and enable secure collaboration.
Info-Tech's research indicates that while Microsoft 365 has transformed how organisations collaborate, governance models have not kept pace. Many organisations still rely on isolated configurations rather than a cohesive, policy-driven model, producing inconsistent controls and greater exposure.
As Copilot expands how users access and surface enterprise data, poorly governed permissions and content carry more weight.
"Microsoft 365 governance fails when it's treated as a series of configurations rather than a business-aligned model," said John Donovan, principal research director at Info-Tech Research Group. "Organisations need clear governance intent, defined ownership, and policy-driven controls that remain consistent as the platform evolves and AI adoption accelerates."
Recurring governance gaps
The blueprint identifies several common failings. They include overreliance on default configurations, unclear accountability, and unmanaged content and access across Teams, SharePoint and OneDrive. Others are delayed governance decisions made only after problems arise, and limited readiness for AI where weak data classification increases exposure.
Info-Tech recommends setting governance direction based on business goals, then assessing current capabilities to identify gaps. It also advises translating governance intent into enforceable controls, clarifying roles and decision ownership, and embedding governance through communication and policy.
The blueprint provides supporting resources including a control map, capability assessment, RACI chart, acceptable use policies and a communication plan. Info-Tech says the approach helps organisations move from fragmented practices to a consistent operating model while preparing environments for AI.