Most enterprises delay Copilot over SharePoint data concerns

CoreView research says 66% of enterprises have delayed or cancelled Microsoft Copilot deployments because of fears that AI could expose confidential SharePoint data. The report points to weak security controls, overconfidence in Microsoft 365 protections and poor access-review hygiene as key barriers to broader AI rollout.

Why it matters: - Microsoft Copilot can only surface what it can access, so weak SharePoint governance can turn an AI rollout into a data-exposure problem. - The findings suggest many enterprises are not ready to expand AI use safely across Microsoft 365. - Delays could slow enterprise productivity gains while security teams try to clean up permissions, sharing links and access controls.

What happened: - CoreView said 66% of enterprises have delayed or cancelled Microsoft Copilot deployments because of concerns that AI could expose confidential SharePoint data. - Nearly three-quarters, or 73%, are concerned AI is already surfacing sensitive information internally. - Organisations delaying Copilot are more than three times as likely as deployed organisations to be highly concerned about anonymous SharePoint links, at 48% versus 14%. - The findings come from CoreView's State of Microsoft 365 Security and Governance 2026 report. - The research is based on a survey of 279 IT, security and infrastructure decision-makers at organisations using Microsoft 365. - Respondents were concentrated in North America, including 86% from the US and 7% from Canada, with additional representation from the UK, Australia and continental Europe.

The details: - Three-quarters, or 75%, of C-level executives and vice presidents have delayed or cancelled Copilot deployments, compared with 60% of managers. - Nearly two-thirds, or 62%, rate their Microsoft 365 security as established or advanced. - More than half, or 54%, of those organisations are still missing at least one foundational security control, including administrator MFA, privileged access management or configuration tamper detection. - Administrator accounts are less likely to have fully enforced MFA than standard user accounts, at 55% versus 62%. - One in five organisations enforces MFA more weakly on admin accounts than on everyday employees. - More than one-third, or 37%, incorrectly believe Microsoft automatically backs up Microsoft 365 configurations. - Another 11% say they have no configuration backup at all. - Nearly two-thirds, or 63%, defer or limit user access reviews because they are too time-consuming. - Almost half, or 46%, struggle to get employees to complete access reviews. - CoreView said Microsoft 365 environments are growing, making manual governance harder to sustain. - The report says the base was led by Technology/Software at 28%, Healthcare at 19%, Finance/Banking at 14%, Manufacturing at 12% and State, Local and Education at 9%.

Between the lines: - The data suggests concern about Copilot is not only about AI itself, but also about long-standing Microsoft 365 hygiene issues that AI can expose quickly. - The strongest hesitation from senior leaders points to a board-level risk perception, not just an IT workflow problem. - The gap between self-rated security maturity and missing controls implies many organisations may not fully understand what Copilot can reach inside their tenant. - The emphasis on admin-account protection shows that governance weaknesses at the top of the permission chain can shape what AI reveals across the rest of the environment.

What's next: - CoreView said organisations will need continuous file-level visibility and remediation before Copilot becomes a routine productivity tool. - Simon Azzopardi, CoreView chief executive officer, said the company built CoreView Control for SharePoint for this moment. - Azzopardi said fixing the SharePoint estate can turn Copilot from a board-level risk into a productivity decision. - CoreView says it serves more than 4,000 organisations, including some of the world's largest Microsoft tenants. - CoreView says its products help customers secure, consolidate and manage complex Microsoft 365 environments, while identifying wasted spend in tenants.

The bottom line: - Enterprise Copilot adoption is running into a basic readiness problem: many organisations still cannot confidently prove what data Microsoft 365 users and AI assistants can access.