Microsoft 365 Copilot doesn’t arrive in a clean Microsoft 365 tenant. It arrives in an environment that organizations have been building for years — full of SharePoint sites, Teams, OneDrive content, duplicate documents, historic migrations, guest accounts, inconsistent permissions, forgotten workspaces, broken ownership models, and content nobody has reviewed in years.For traditional Microsoft 365 management, much of this technical debt could remain relatively hidden. AI changes that.In this episode of M365.FM, Mirko Peters talks with Richard Harbridge, Microsoft MVP and industry advisor at ShareGate, about why AI readiness is fundamentally connected to Microsoft 365 modernization and governance.The conversation moves beyond the question of how to deploy Copilot and focuses instead on a more important question: What kind of Microsoft 365 environment are we actually giving AI access to?
COPILOT DOESN’T CREATE THE MESS — IT AMPLIFIES IT
One of the central ideas in this conversation is that Microsoft Copilot is not necessarily creating entirely new governance problems. Instead, AI makes existing problems significantly more visible and consequential.Organizations have accumulated years of decisions around permissions, sharing, workspace creation, ownership, migrations, external access, inactive content and collaboration.Richard describes this accumulation using the concept of “sprawl.”Sprawl itself is not automatically bad. A growing number of Teams, SharePoint sites and other resources can be evidence that people are successfully adopting Microsoft 365.The problem begins when that growth happens faster than the organization’s ability to manage it.Temporary permissions become permanent. Old collaboration spaces remain accessible. Ownership changes. Business structures evolve. Content stays online long after its original purpose has disappeared.Copilot then operates on top of that existing environment.
MICROSOFT 365 SPRAWL IS BIGGER THAN TEAMS AND SHAREPOINT
When people hear “Microsoft 365 sprawl,” they often immediately think about too many Teams or SharePoint sites.But Richard argues that sprawl is multidimensional.Organizations can experience workspace sprawl, permission and access sprawl, ownership problems, inactive resources, lifecycle problems, administrative complexity, conditional access sprawl and increasingly integration and connector sprawl.The rise of AI adds another dimension.Microsoft 365 environments increasingly connect data, applications, AI systems and agents. That means organizations need to think beyond individual workloads and start looking at Microsoft 365 as an interconnected ecosystem.Governance can no longer be treated purely as “SharePoint governance” or “Teams governance.”
THE CONFIDENCE GAP IN MICROSOFT 365 GOVERNANCE
Richard shares an especially interesting finding from ShareGate’s research.A very large percentage of IT leaders report being highly confident in their Microsoft 365 governance. Yet a significant portion of those same organizations report that Copilot has surfaced content that users arguably should not have been able to discover — or they suspect this may have happened but do not know how to verify it.That creates an important distinction between having governance controls available and actually having a continuously governed environment.Policies, configuration options and administrative controls alone do not guarantee that an organization understands its current Microsoft 365 state.AI can expose that gap very quickly.
DID MICROSOFT MAKE COLLABORATION TOO EASY?
Microsoft Teams, SharePoint and OneDrive are successful partly because Microsoft has made collaboration extremely easy.But easy collaboration also makes it easy to create more resources.One response organizations have traditionally used is restricting workspace creation. Richard explains why that alone does not solve the problem.A workspace created today may serve an entirely different purpose six months, one year or two years later.Its owners may change.The organization may restructure.The project may finish.The content may become irrelevant.The people who originally understood why the workspace existed may leave.Governance therefore cannot stop at provisioning.Organizations need lifecycle processes, reviews, attestations and signals that continuously determine whether resources are still appropriate.
GOVERNANCE HAS TO BECOME CONTINUOUS
One-time cleanup projects are not enough.An organization can spend months cleaning its Microsoft 365 environment before deploying Copilot, but without continuous governance, the same problems will gradually return.That means organizations need repeatable processes around ownership, permissions, inactivity, lifecycle management, archiving and retirement.The objective is not to eliminate Microsoft 365 sprawl completely.It is to turn unmanaged sprawl into managed sprawl.
WHERE SHOULD ORGANIZATIONS START BEFORE SCALING COPILOT?
Imagine an enterprise with 10,000 employees, thousands of Teams and SharePoint sites, years of accumulated content and inconsistent permissions.Where should it begin?Richard recommends looking at the specific types of sprawl and identifying where the organization carries the greatest risk.For one company, that might be access control and oversharing.For another, it might be inactive content and lifecycle management.For another organization, privileged identities or administrative management may represent the larger problem.Instead of treating Microsoft 365 governance as one enormous cleanup exercise, organizations can break the problem into measurable categories and prioritize the areas where improvement matters most.
COPILOT ADOPTION SHOULD BE TEAM-BASED
The conversation also challenges one traditional Microsoft technology adoption model.Organizations frequently deploy new technologies through distributed champions.Richard argues that Copilot benefits from a more team-oriented adoption model.Rather than distributing a small number of licenses across unrelated champions throughout an organization, companies can benefit from saturating teams with AI capabilities so that people learn together, develop shared practices and integrate Copilot into collaborative workflows.AI adoption is not only about giving individuals another productivity tool.It changes how teams work together.
MAKING MICROSOFT 365 RISK MEASURABLE
Governance initiatives often struggle because their value is difficult to communicate to business leaders.The conversation explores ShareGate’s Risk Radar, which is designed to help organizations evaluate different categories of Microsoft 365 sprawl, compare maturity against benchmarks and understand which areas deserve attention.An important part of this approach is translating governance risk into financial terms.Instead of asking leadership for time and resources simply because “we need better governance,” IT teams can connect improvements to the potential cost of unmanaged risk.That makes Microsoft 365 modernization and governance easier to position as a business investment rather than another administrative IT project.
AI AGENTS MAKE GOVERNANCE EVEN MORE IMPORTANT
Copilot is only part of the story.As organizations begin creating and deploying more AI agents, governance becomes substantially more complex.Agents can change over time. They can interact with tools, data and other systems. Their ownership can become unclear. Permissions can evolve, and organizations will eventually have to deal with agent lifecycle management at scale.Who owns an agent?Who reviews it?What resources can it access?What happens when its original owner leaves?When should an agent be retired?When should multiple agents be consolidated?These questions look remarkably similar to problems organizations already experience with Teams, SharePoint sites and other Microsoft 365 resources — except AI increases both the speed and potential impact.
GOVERNANCE FROM THE RESOURCE UP
Richard discusses the importance of looking at governance from the underlying resources upward.An AI experience may sit on top of SharePoint, Microsoft 365 data, Power Platform resources, connectors, permissions and other systems.Organizations therefore cannot govern only the visible AI interface.They need to understand the complete chain of resources, data and permissions supporting it.This becomes increasingly important as agents gain more capabilities and organizations move from relatively simple assistants toward agents that can take action.
THE FUTURE IS “EVERYTHING GOVERNANCE
”Looking several years ahead, Richard expects Microsoft governance to become significantly more holistic.Instead of separate conversations about SharePoint governance, Teams governance, Power Platform governance and AI governance, organizations increasingly need to understand how all of these layers interact.Microsoft Purview is highlighted as an important part of this evolution, particularly as Microsoft expands capabilities around data security and posture management.Governance professionals therefore need to broaden their perspective beyond the administration interface or workload they traditionally specialized in.AI sits across boundaries.Governance increasingly has to do the same.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-copilot-ai-modern-work--6704921/support.
