Microsoft 365 readiness gaps worry MSPs as AI demand grows

Augmentt has published research showing a Microsoft 365 readiness gap among managed service providers as demand for AI governance rises. The study surveyed 193 MSP professionals.

AI and Copilot governance was the fastest-growing client request for 40% of respondents, ahead of security and compliance at 24%. Yet only 10% said more than three-quarters of the client tenants they manage are ready for Copilot, and just 3% said every client tenant under their management is ready.

Nearly half of respondents, 47%, said they had experienced an AI- or Copilot-related data exposure or near miss in a client tenant during the previous 12 months. Among Service Delivery Managers, that figure rose to 56%.

The findings highlight concern over data handling as MSPs take on a wider role in overseeing AI within Microsoft 365 estates. Data security and oversharing risk was cited by 35% of respondents as the biggest barrier to offering AI or Copilot as a managed service, while 41% named data oversharing as their main concern as AI use expands.

Other concerns included clients adopting AI before governance is in place, cited by 14%, compliance exposure at 13%, incorrect permissions at 11%, shadow AI at 11%, and staff lacking sufficient AI expertise at 10%.

Security gaps

The study suggests many MSPs are supporting AI deployments on top of Microsoft 365 environments that are not fully standardised. More than three-quarters of respondents, 77%, said they were not fully confident that every client tenant currently met their own security baseline.

Several common weaknesses stood out. Stale accounts remaining active after offboarding were reported by 53% of MSPs, while 48% pointed to over-permissioned users or guest access. Another 40% cited configuration drift over time.

Those issues matter because Copilot works across the permissions and data structures already present in Microsoft 365. Existing gaps in identity management, access controls, and tenant configuration can therefore become more visible when AI tools are introduced into day-to-day workflows.

Manual workload

The research also found that much of the underlying administration remains manual. Overall, 58% of MSPs said they establish a new client tenant's security baseline manually or through custom scripts rather than applying it automatically.

Scale appears to be adding pressure. More than 2 in 5 respondents, 43%, manage more than 50 client tenants, while 41% manage more than 1,000 licensed seats. Microsoft 365 administration also involves large teams: 35% said four to six staff members work inside client environments on a typical day, 19% said seven to 10 do so, and 30% said more than 10 team members are involved.

Onboarding and offboarding was identified as the largest source of repetitive daily Microsoft 365 work by 33% of respondents. MFA and security configuration followed at 23%, while licence management was cited by 17%.

Switching between tenants and portals is also taking up time. The study found that 41% of MSPs said a single technician loses three or more hours each week moving between separate client tenants and portals. Among providers managing 251 or more tenants, 56% reported losing at least three technician hours per week to that task.

Reactive operations

Consistency and standardisation ranked as the top Microsoft 365 priority for 52% of respondents, ahead of margin, scale, or upsell opportunities. Even so, only 17% described their Microsoft 365 work as mostly proactive.

The remaining 83% said their workload was mostly reactive or a mix of reactive and proactive work. Among MSPs managing 251 or more tenants, only 8% said their Microsoft 365 operations were mostly proactive.

Microsoft's pace of platform change is adding to that burden. Nearly two-thirds of respondents, 63%, said a Microsoft change had created unplanned work or broken something within a client environment during the previous 12 months. More than half, 53%, also said they had experienced a security incident or near miss unrelated to AI during the same period.

Reporting and pricing

The survey found wide variation in how MSPs report security work to clients. Only 42% said they show clients security results through automated reporting, while 28% assemble reports manually, 16% communicate results verbally, and 10% rely on screenshots. Four percent said they do not report security results to clients.

Commercial models also differ. Some 36% price Microsoft 365 security and management work on a project-based or as-needed basis, 32% treat it as a separate line item on client invoices, and 30% bundle it into their standard managed services fee. Three percent said they do not offer it as a formal service.

Despite the security and operational issues, respondents did not appear broadly negative about Copilot itself. More MSPs said Copilot reduces their workload than increases it, with 43% reporting a reduction versus 24% who said it adds to their workload.

The larger challenge for MSPs appears to be not willingness to support AI, but bringing Microsoft 365 environments to a consistent standard across multiple clients. With AI and Copilot governance already the fastest-growing client request for 40% of respondents, demand appears to be moving faster than operational readiness.