ShareGate survey finds stale access tops Microsoft 365 incidents
Most IT teams in the governance vendor’s own research had a Microsoft 365 incident in the past year, even as full Copilot rollouts nearly doubled. UK respondents were among the most confident
- UK respondents were more assured than the rest: 60% were very confident their framework could support Copilot, against 48% elsewhere
- In the UK, 26% reported AI surfacing data it shouldn’t, against 30% in the rest of the sample
- Oversharing affected 26% of organizations in the IT operations survey
- Microsoft MVPs reviewed the findings before publication
Start with offboarding: confirm that departing staff and ended partner relationships lose access to every site, team and shared link, not only their account. Next, review tenant sharing defaults; anonymous links with no expiry look like the setting most worth changing first. Before widening Copilot, run test prompts as an ordinary user and see what sensitive content comes back. Move from periodic reviews to alerts on new external sharing where the tenant allows it.
“People say they're ready because the controls exist. They under-report the exposures because nobody volunteers those.”Eric Overfield, CIO of Creospark and a Microsoft MVP contributor to the ShareGate report
ShareGate, which sells Microsoft 365 migration and governance software, released its State of Microsoft 365 2026 report in September. In its IT operations survey, 77% of organizations had at least one of four governance incidents in the past 12 months. The report’s overview page gives 82%, which also counts staff failing to find content or Copilot returning stale results. Chapter 3 leaves that answer out because nothing was exposed.
The report rests on two separate surveys, which ShareGate says should never be combined. The IT operations survey asked 943 managers, directors and vice-presidents in seven countries, 135 of them in the UK, and was fielded in May 2026. The AI governance survey asked 851 IT leaders, 204 in the UK, in March 2026. That sample leans heavily toward technology companies (about 59%). All figures are self-reported and unweighted.
Stale access was the most common incident: 38% had a former employee or partner keep access they should have lost. Two-thirds (65%) only learn of problems through scheduled reviews or after the fact, and just 1% use purpose-built governance tooling. Incident rates tracked sharing settings, at 43% where anonymous links are blocked against 89% where they are allowed tenant-wide with no expiry.
On AI, full Copilot deployment rose to 56% from 29% in ShareGate’s 2025 edition, though it says year-on-year comparisons use different samples and should be read as trends. While 93% of IT leaders say their governance is ready for Copilot, 29% say an AI tool has already surfaced sensitive data it should not have reached.
Sources
- ShareGate, “State of Microsoft 365 2026”, report overview and methodology, September 2026. https://sharegate.com/state-of-microsoft-365
- ShareGate, “State of Microsoft 365 2026”, chapter 1, September 2026. https://sharegate.com/state-of-microsoft-365/chap-1
- ShareGate, “State of Microsoft 365 2026”, chapter 3, September 2026. https://sharegate.com/state-of-microsoft-365/chap-3
- Infosecurity Magazine, “Over 75% of Organizations Experience Microsoft 365 Governance Issues”, 24 September 2026. https://www.infosecurity-magazine.com/news/75-organizations-microsoft-365/
