Governing the journey into AI: a Microsoft 365 guide

On 21 October, we’re hosting the first Inside Rencore: a regular session where our product team speaks directly with the people who rely on Rencore every day. Register here.

When we talk to customers, one topic comes up more than any other: AI. Some of you are piloting Copilot. Some of you haven’t approved any AI tools yet. Almost all of you are being asked by your leadership how fast you can move, and whether it’s safe.

This guide is my answer. It brings together what the evidence says, what we see across our customers, and what I believe it takes to move through the journey into AI with confidence. It’s long, so use the headings to jump to what matters most to you. Over the next week, I’ll also share two shorter posts that pick up the threads I care about most.

The short version is this. The journey into AI is a governance journey. Every stage depends on knowing who can reach what in your Microsoft 365 environment, and the organisations that get that right are the ones able to keep moving.

Where most organisations really are

If you only read the headlines, you’d think every large company had already rolled AI out to everyone. The evidence tells a more measured story.

McKinsey’s 2025 State of AI survey, based on almost 2,000 respondents in 105 countries, found that 88% of organisations now use AI in at least one business function. Yet nearly two-thirds have not started scaling it across the organisation. Only 23% are scaling an agentic AI system anywhere in the business. Use is wide, and depth is still limited.

The picture for Microsoft 365 Copilot is similar. When Gartner surveyed 132 IT leaders in 2024, around half of them at companies with more than 10,000 employees, 60% had started Copilot pilots. Only 6% had finished their pilots and were planning large-scale deployment. Just 1% had rolled Copilot out to all eligible employees.

That matches what our biggest customers tell us. Most are just getting started with Copilot. Many haven’t approved other AI tools, such as ChatGPT or Claude, at all. Large organisations move carefully, and as the next section shows, they have good reasons to.

Why big organisations move carefully

Two stories from the last few years explain the caution better than any survey.

In 2023, Samsung banned staff from using generative AI tools after engineers uploaded sensitive source code to ChatGPT. The company’s concern was simple: data sent to these tools was stored on external servers, was hard to retrieve or delete, and could end up disclosed to others.

In March 2024, the US House of Representatives banned staff from using the commercial version of Microsoft Copilot. Its Office of Cybersecurity judged it a risk because of “the threat of leaking House data to non-House approved cloud services.” Days later, the House said a government version built to a higher security and compliance standard would be reviewed, with staff able to regain access if it passed.

I find the second story the more useful one. The House paused, defined the controls it needed, and set out a path back to using AI. That is the journey most of our customers are on today.

There’s a catch, though. While organisations pause, their people often carry on. Deloitte’s 2026 survey of UK workers found that 31% of people using generative AI at work do so without their employer knowing, and one in six pay for their own tools. Holding back on approved AI simply moves AI use somewhere IT can’t see.

So caution on its own is a holding position. The real question is how to move forward safely, and that starts with understanding the stages.

The four stages of the journey

From what we see across our customers, the journey into AI tends to follow four stages. Each has its own risk, and each needs a different governance priority before you can safely move on.

Most large organisations we speak to sit somewhere between stage one and stage three. Look down the governance priority column and you’ll notice a pattern. Every stage depends on the one before it, and every stage comes back to access. That’s the bottleneck.

Why permissions are the bottleneck

In the same Gartner survey, 40% of IT leaders said they had delayed their Copilot rollout by three months or more because of concerns about oversharing. 64% said information governance and security risks needed significant time and resources.

The reason sits in how Copilot works. In Microsoft’s own words, “Microsoft 365 Copilot only surfaces organizational data to which individual users have at least view permissions.” Microsoft goes on to stress how important it is that “the right users or groups have the right access to the right content.”

In other words, Copilot inherits your permissions, exactly as they are today. If a sensitive file has been shared too widely, Copilot can find it for anyone who has access. Whatever access problems you already have, AI exposes them at a speed no person could match.

How access builds up

Access rarely becomes a problem in one dramatic moment. It builds up one reasonable decision at a time.

Someone joins a project and is added to a team. A partner needs a document, so a guest is invited. A link is shared to save time. The project ends, people change roles, and nobody goes back to undo any of it. Each step made sense when it happened. Together, they leave far more people and apps able to reach far more data than anyone intended.

A lesson from the news

Earlier this month, ASOS customers opened the app to find a push notification from attackers claiming to have stolen data. ASOS said someone gained access to an employee account by impersonating a trusted contact, then used those credentials to reach third-party platforms the company uses to communicate with customers. ASOS says names and contact details may have been accessed, but not payment details or passwords.

The investigation is ongoing, and this could happen to almost any large organisation. The incident had nothing to do with AI, but the lesson carries straight over. One set of credentials opened the door to several connected platforms, and from there straight to customers’ phones. The weak point was the access between systems.

Now picture the same compromised account with an AI assistant attached. It can search, summarise and pull together everything that account can reach, in seconds. The more access has quietly built up, the further that reach goes.

The four patterns we see most

In most Microsoft 365 environments we work with, the access problems fall into four patterns:

• Access no one is watching. Members, guests and apps keep permissions long after anyone remembers why they were granted. Nobody removes access, because nobody is sure it’s safe to.
• Sharing that never gets reviewed. Links and guest access set up for one project stay open for years. External partners change, and their access stays.
• Workspaces nobody owns. Teams and sites outlive their projects and their owners. When the owner leaves, there’s no one left to ask whether the content and access still make sense.
• Content Copilot can now find. Files overshared years ago and long forgotten are suddenly one question away.

None of these is new. Copilot simply makes them matter more, because it turns old permission problems into answers on someone’s screen.

How governance keeps pace

If access is the bottleneck, the obvious answer is a big clean-up project. Many organisations try it. Most find that by the time the project finishes, the environment has moved on again. A steady stream of Microsoft 365 updates lands every month, new teams are created every day, and Copilot keeps reaching more people.

Governance that relies on a yearly audit is out of date the day it finishes. To keep pace, it has to run continuously, and that only works at scale if it’s shared.

Governance doesn’t scale from the centre

Every large Microsoft 365 environment I’ve seen hits the same wall. In the early days, IT can keep track of things. Then adoption takes off. A few years later, there are thousands of workspaces, and nobody in IT can say with confidence who should still be in them.

The usual response is more central control: tighter request processes, bigger review spreadsheets, more tickets. It rarely works for long. IT ends up making access decisions about content it has never seen, while the people who do know the content are left out of the loop.

We believe the answer is to put decisions with the people closest to the work, and give IT the policies and visibility to stay in control.

Putting governance where people already work

That belief shaped the biggest piece of work our team delivered this year: the Rencore Governance Teams app. Workspace owners complete access reviews and approve requests directly in Microsoft Teams, the tool they already have open all day. They confirm who should be a member, which guests still need access and what is shared externally, for their own teams and sites. IT sets the rules and sees the results.

It took a great deal of effort to get right. A review that asks too much of a busy owner simply doesn’t get done, so we spent a lot of time on making each step quick and clear. The feedback from our customers and partners tells us it was worth every hour.

For us, the Teams app is the standout feature. Our workspace owners handle access reviews and requests in Teams, without ever needing the admin portal. They decide who stays in their teams and sites, which guests keep access and what stays shared externally. That takes pressure off IT and leaves the decision with the people who know the content best.

Managing director, enterprise organisation with 1,000+ employees

The model that keeps governance current

Put together, continuous governance comes down to three things:

1. Know what you have. A complete, current picture of your workspaces, owners, members, guests and sharing.
2. Decide the rules once. Clear policies for how workspaces are created, who can be invited and what happens when a project ends.
3. Let owners and automation do the rest. Owners confirm what only they can judge. Automation handles the repetitive work, from reminders to clean-up.

When governance works this way, your environment stays ready for each stage of the AI journey, without a new clean-up project every time.

Are you ready for the next stage?

Use this checklist to see where you stand. Each “no” is a gap that will slow you down at the next stage.

• Every team and site has an owner who still works here
• We can see every guest and when their access was last confirmed
• External sharing links are reviewed on a regular schedule
• Inactive workspaces are archived or removed automatically
• New workspaces follow a template and an approval step
• We know where our most sensitive content lives and who can reach it
• Owners take part in access reviews, without IT chasing them
• We can produce evidence of all of the above for an audit

Where to start

If you ticked fewer boxes than you’d like, you’re in good company. Here’s the order I’d tackle it in:

1. Get a complete inventory. You can’t govern what you can’t see. Start with every team, site, owner, member, guest and sharing link.
2. Make sure every workspace has an owner. Find the ownerless ones first. They carry the most hidden risk.
3. Review guests and external sharing. Ask owners to confirm what still needs to be open, and close the rest.
4. Clean up what’s no longer used. Archive or remove inactive workspaces so their content stops turning up where it shouldn’t.
5. Turn the rules into policies. Automate them so your environment stays ready as Copilot reaches more people.

None of this needs to wait for a big programme. The first two steps alone remove a lot of hidden risk, and they make every later stage of the journey easier.

What the reward looks like

It would be easy to read all of this as a reason to keep waiting. I see it the other way round. The value on the other side is real, and the evidence is building.

In 2025, the UK government ran a three-month trial of Microsoft 365 Copilot with more than 20,000 civil servants. Participants reported saving an average of 26 minutes a day, close to two working weeks per person per year. Those figures are self-reported, so treat them as a guide, but they show what’s possible when an organisation is ready.

The organisations that capture that value are the ones that can move from pilot to scale with confidence. Governance is what gives them that confidence.

Where Rencore stands

Some of you have asked whether Rencore is getting carried away with AI. It’s a fair question. There is a lot of excitement around AI right now, and we are excited about its potential too. But our focus hasn’t changed.

We will continue to help you run Microsoft 365 securely, with clear ownership, clean access and compliance built into everyday work. That foundation is becoming even more important as organisations roll out Copilot, and for many of our customers, that is the most immediate priority.

At the same time, we’re looking ahead. As agents and other AI platforms become part of your environment, we want to make sure you are ready to govern them too. And importantly, this doesn’t take us away from Microsoft 365. Even when organisations use AI platforms such as Claude or ChatGPT, much of the business data those tools need to work with will continue to live within the Microsoft 365 ecosystem.

So we’re not moving away from the foundation we’ve built. We’re building on it, extending governance from Microsoft 365 and Copilot to the broader AI landscape. And when you’re ready to take that step, we’ll be ready too.

Next steps

Wherever you are on the journey, you don’t have to work it out alone.

• Join the first Inside Rencore. On 21 October at 4pm CEST (3pm BST, 10am EDT), Sven, Tobias and I will cover what we shipped this year and what’s coming in the next six months, with 20 minutes for your questions. Register here.
• Talk to us. Book a call with our team and we’ll help you see where your environment stands today.

Bring the hard questions. What you tell us shapes what we build next.

Tiina Rytkönen
VP of Product and Engineering, Rencore

Last updated 15 October 2026