Most Organizations Skip Permissions Reviews Before Deploying AI Tools
Syskit survey of 327 US/UK IT leaders finds 76% deployed M365 AI tools but only 43% reviewed permissions and oversharing risk first.
Syskit's State of Microsoft 365 Governance Report 2026, based on a survey of 327 IT and security decision-makers at US and UK organizations with 500+ employees, shows most enterprises deploy AI tools like Copilot without thorough permissions reviews. Only 22% have a formal policy defining what AI agents may access, and 9% let agents inherit the deployer's full permissions. 90% report experiencing or suspecting a security incident tied to M365 misconfigurations or over-permissioned access in the past two years.
- 76% of surveyed organizations deployed or piloted enterprise AI such as Copilot on M365 data
- Only 43% completed a thorough permissions and oversharing review before AI deployment
- 41% leave SharePoint sites accessible to all staff; 33% share files with Everyone
- Just 4% could produce a complete access report for an auditor within an hour
- Survey covered 327 IT and security decision-makers at US and UK firms with 500+ employees
- Products
- Microsoft 365CopilotSharePoint
- Organizations
- Syskit
From the original article
2 min read at infosecurity-magazine.com
A new Syskit study has shown that only 43% of organizations with AI agents deployed in Microsoft 365 environments completed a permission review before doing so
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.