45% of large organizations hit by Microsoft 365 security incidents due to misconfigurations

New research finds Microsoft 365 complexity is overwhelming IT teams, leading to governance and security gaps

Published on Mar. 5, 2026

Got story updates? Submit your updates here. ›

According to a new report from CoreView, nearly half (45%) of large organizations have experienced a security or compliance incident caused by a Microsoft 365 misconfiguration in the past 12 months. The research finds that Microsoft 365 has expanded so rapidly in scope and complexity that one in five organizations now say it is almost impossible to manage and secure at an enterprise scale, with the UK reporting the highest rate at 27%.

Why it matters

As Microsoft 365 has become a critical business infrastructure for over 2 million companies globally, the growing complexity of the platform is creating significant operational burdens and security risks for IT teams. With nearly half of organizations lacking full visibility and control over their Microsoft 365 environments, they are increasingly turning to AI-driven automation to manage the platform, but this is introducing new concerns around security and governance oversight.

The details

The report highlights several key risk areas for organizations using Microsoft 365, including: 82% of IT leaders describing managing Microsoft 365 as a severe operational burden; organizations facing an average of over 140,000 failed login attempts per week; 45% lacking full control over their Microsoft 365 environment; 90% struggling to enforce even basic security controls; and 43% reporting failed or delayed audits due to slow, incomplete, or manual Microsoft 365 reporting. Additionally, 24% of IT leaders say they are facing resistance from their C-suite over AI adoption due to security concerns.

  • The research was conducted in 2026.

The players

CoreView

The global leader in Microsoft 365 tenant resilience and the publisher of the research report.

Got photos? Submit your photos here. ›

What they’re saying

“AI is being deployed into environments that aren't ready for it. Microsoft 365 has become operationally overwhelming, and organisations are turning to automation to cope. But when governance and security controls aren't already in place, AI doesn't fix the problem, it accelerates it. Without structure and guardrails, automation moves risk into production faster than teams can pull it back.”

— Andrea Sivieri, Chief Product & Technology Officer, CoreView (EINPresswire.com)

The takeaway

This research highlights the growing complexity and security challenges organizations face in managing Microsoft 365 at scale, underscoring the need for better governance, security controls, and strategic use of AI-driven automation to mitigate risks without introducing new vulnerabilities.