In this episode of the m365.fm podcast, Christian Buckley joins the conversation to unpack why traditional governance models are struggling to keep up with the pace of AI adoption inside Microsoft 365. The discussion explores how tools like Copilot and autonomous AI agents are reshaping collaboration, compliance, and content management — often faster than organizations can adapt their policies and processes.

Christian explains that most governance frameworks were designed for static content and predictable user behavior, not AI systems capable of generating, accessing, and acting on information across the tenant. The episode dives into the growing risks of “agent sprawl,” shadow AI, uncontrolled permissions, and poor data quality, all of which can undermine security, compliance, and trust in AI-driven workplaces.

A major theme throughout the episode is that governance is no longer just an IT responsibility. Successful AI governance requires a balance between innovation and control, with clear ownership, lifecycle management, automation, and strong communication between business users and IT teams. The hosts also discuss practical Microsoft 365 governance strategies, including the role of Microsoft Purview, metadata, content lifecycle policies, review workflows, and AI readiness assessments.

Rather than treating governance as a one-time cleanup project, Christian argues organizations must view it as an ongoing operational practice embedded into daily work. The conversation provides actionable insights for IT leaders, architects, and Microsoft 365 administrators preparing their organizations for the realities of AI-powered collaboration.

Relying on outdated frameworks puts your organization at risk as technology changes faster than ever. Most governance policies were never built for the rapid pace and unpredictability that AI brings. The world has seen enterprise AI adoption jump from 32% in 2013 to 71% in 2023. Investment in AI is projected to reach nearly $200 billion globally by 2025. These numbers highlight why you must reassess your governance approach now. Policy gaps can lead to real consequences, so you need adaptive, AI-specific governance that keeps up with today’s demands.

Statistic	2013	2023
AI Publications	100,000	242,000
Enterprise AI Adoption (Generative)	32%	71%

Key Takeaways

AI technology evolves rapidly. Organizations must regularly update governance policies to keep pace with these changes.
Outdated frameworks expose organizations to risks. Implement adaptive, AI-specific governance to protect data and maintain trust.
Bias in AI can lead to unfair outcomes. Monitor AI systems closely to identify and mitigate bias at every stage of development.
Transparency is key. Clearly document AI processes to build trust with users and stakeholders.
Establish clear roles and responsibilities. Assign accountability for AI governance to ensure compliance and oversight.
Conduct regular AI risk audits. Identify gaps in policies and controls to strengthen governance frameworks.
Foster collaboration across teams. Engage diverse perspectives to enhance AI governance and address complex challenges.
Invest in continuous training. Educate staff on responsible AI use and governance to prepare for emerging risks.

AI’s Unique Challenges

Rapid AI Evolution

Fast innovation cycles

You face a world where ai changes at lightning speed. New ai systems appear almost every week, and each one brings new features and risks. The number of ai publications jumped from 100,000 in 2013 to over 242,000 by 2023. Enterprise adoption of generative ai soared from 32% to 71% in just one year. This rapid growth means your ai governance strategies can quickly become outdated. Only 35% of companies have established ai governance frameworks, which leaves many organizations exposed. You need to keep pace with these fast innovation cycles to protect your data and maintain trust.

Unpredictable trends

You cannot always predict where ai will go next. Trends shift quickly, and new uses for ai systems emerge overnight. Traditional governance frameworks often fail to address these changes. As ai adoption rates are expected to reach 85% by 2025, but governance maturity may only hit 40%, the gap widens. You must prepare for unexpected developments and adapt your ai governance policies to manage new risks as they arise.

Opacity Issues

Black box models

Many ai systems operate as black boxes. You may not understand how these systems make decisions, even when they affect important outcomes. The complexity of ai algorithms creates non-linear relationships that are hard for humans to interpret. This lack of explainability can lead to inconsistent results and make it difficult to spot errors or bias. For high-impact decisions, you need explainability to ensure fairness and accountability.

Audit difficulties

Auditing ai systems presents unique challenges. These systems can produce different explanations for similar outcomes, especially after retraining on new data. The probabilistic nature of ai decisions adds another layer of complexity. You may struggle to trace the logic behind a decision, which makes it harder to meet compliance requirements. Without explainability, you risk missing critical errors that could harm your organization or customers.

Data Risks

Privacy concerns

You must protect sensitive information when using ai systems. Weak authentication methods can allow unauthorized access, putting your data at risk. Membership inference attacks can reveal if specific data points were used in training, which threatens privacy and security. Data protection becomes even more important as ai systems handle larger and more complex datasets.

Security vulnerabilities

Attackers target ai systems in new ways. They can manipulate input data to poison models or exploit hardware vulnerabilities. Insecure endpoints may allow data extraction, exposing confidential information. You need strong data protection measures and robust ai governance to defend against these threats. The table below highlights common data risks you should watch for:

Risk Type	Description
Unauthorized Access	Exploitation of weak authentication methods to gain unauthorized access to ai systems.
Input Manipulation	Attackers can poison model behavior by manipulating input data.
Data Extraction	Insecure endpoints can be exploited to extract sensitive data from ai systems.
Hardware Vulnerabilities	Attackers may exploit vulnerabilities in specialized hardware used by ai systems.
Model Poisoning	Direct manipulation of ai model parameters or architecture, leading to hidden backdoor attacks.
Transfer Learning Attacks	Targeting transfer learning models to introduce hidden backdoors or biases.
Membership Inference Attacks	Attackers can determine if specific data points were included in the training set.

Tip: Regular audits and strong data protection policies help you reduce privacy and security risks in your ai systems.

Ethical Dilemmas

AI brings many benefits, but you must also face serious ethical dilemmas. These challenges go beyond technology. They touch on fairness, privacy, and the impact on society. You need to understand these risks to use AI responsibly.

Bias risks

AI systems can reflect and even amplify human biases. If you train an AI model on biased data, the results will also show bias. For example, hiring tools may favor certain groups over others. Facial recognition systems sometimes misidentify people with darker skin tones. These errors can lead to unfair treatment and discrimination.

You must watch for bias in every step of your AI project. This includes collecting data, training models, and making decisions. Bias can enter through small mistakes or overlooked details. Even well-meaning teams can miss hidden patterns that cause harm.

Note: Bias in AI does not only affect individuals. It can also shape public opinion and influence important decisions. For example, the misuse of AI in political campaigns has raised concerns about fairness and transparency.

Unintended outcomes

AI can produce results that you did not expect. Sometimes, these outcomes can cause real harm. You may see AI systems make decisions that go against your values or goals. For example, AI-driven automation can lead to job loss and increase income inequality. If you do not plan for these effects, your organization and society may suffer.

Here are some real-world examples of unintended outcomes from AI:

Lethal autonomous weapons have raised humanitarian and legal concerns. The United Nations has called for a global ban on these systems.
Governments use AI for mass surveillance. This raises privacy issues, especially with facial recognition technology.
Deepfake technology can damage reputations and spread false information. Regulators now investigate these risks.
The rise of artificial general intelligence brings new moral questions. You must consider who holds responsibility if machines surpass human intelligence.

You cannot always predict how AI will behave in complex situations. You need strong governance policies to guide your actions and respond quickly to new challenges.

Tip: Regularly review your AI systems for unexpected results. Involve diverse teams to spot risks early and protect against harm.

AI’s ethical dilemmas require your attention and action. By understanding bias risks and unintended outcomes, you can build trust and use AI for good.

Governance Policies and AI Gaps

You face a new era where traditional governance policies cannot keep up with the demands of artificial intelligence. Many organizations still rely on outdated frameworks that do not address the speed, complexity, and unpredictability of modern AI. This gap creates real risks for your business and your data.

Outdated Frameworks

Static risk models

Most governance policies use static risk models. These models work for predictable systems, but AI changes too quickly. You need an ai governance framework that adapts to new threats and opportunities. If you stick with old models, you miss hidden risks and fail to protect your organization.

Limited AI oversight

Traditional governance often lacks proper oversight for AI. You may not have clear roles or responsibilities for monitoring AI systems. Without strong oversight, you cannot ensure responsible ai use or catch problems early. Christian Buckley, a Microsoft Regional Director, highlights in his podcast that you must rethink your ai governance strategy. He explains that AI tools like Microsoft Copilot can reveal gaps in your existing policies by surfacing information across multiple platforms. This exposure shows why you need effective ai governance that fits today’s technology.

Compliance Challenges

Slow adaptation

AI evolves faster than most governance policies. You may struggle to update your rules and controls in time. This slow adaptation puts your organization at risk. Many companies find that rapid technological advancements outpace their regulatory frameworks. You need an ai governance framework that can keep up with these changes.

Real-time monitoring gaps

AI systems often work in real time, but your oversight may not. Without real-time monitoring, you cannot catch issues as they happen. This gap makes it hard to balance innovation with compliance. You also face challenges in coordinating among different teams and stakeholders. The complexity and opacity of AI models make accountability and transparency even harder to achieve.

Here are some common compliance challenges you might face:
- Understanding gaps due to complex technology
- Lack of accountability in AI applications
- Tension between innovation and compliance
- Difficulty keeping up with AI evolution
- Logistical challenges in coordinating among multiple stakeholders

Missing AI Guidelines

Lack of standards

Many organizations do not have clear standards for AI use. Without these guidelines, you risk using AI in ways that could harm your business or your customers. For example, you might upload confidential information into a tool without realizing the consequences. You could also rely on inaccurate AI-generated output or use enterprise licenses for personal tasks. These actions can create serious problems for your organization.

Accountability issues

When you lack clear policies, it becomes hard to assign responsibility for AI decisions. You may not know who should review legal, privacy, or security risks. If you use a vendor tool with AI features, you might not understand how it handles your data. Agentic AI, which acts on its own, can create problems too fast for humans to detect. You need an ai governance framework that sets clear roles and responsibilities.

Common Governance Gaps	Implications for AI Adoption
Unsecured data permissions	Risk of unauthorized access to sensitive information
Missing sensitivity labels	Difficulty in managing data privacy and compliance
Lack of Teams/SharePoint governance	Ineffective collaboration and data management
No change management plan	Challenges in adapting to AI integration
Untrained staff	Increased risk of misuse and errors in AI outputs
No measurement loop	Inability to assess AI effectiveness and risks

AI tools like Microsoft Copilot can surface these hidden flaws in your traditional governance policies. When you use Copilot, you may discover unsecured data permissions or missing sensitivity labels that you did not notice before. This visibility helps you identify and fix gaps in your ai governance framework.

You also need to consider data sovereignty. AI systems often process data across borders, which can create legal and compliance risks. Without strong governance, you may lose control over where your data goes and who can access it.

Risks and Challenges of Missing AI Guidelines
Uploading confidential company information into a tool without realizing the implications
Relying on inaccurate AI-generated output
Using an enterprise license for personal purposes
Applying AI to workstreams that require legal, privacy, security, or compliance review
Using a vendor tool that includes AI functionality without understanding how that tool handles data
Applying agentic AI without proper testing that could create massive problems too fast for humans to detect in time

You must build an enterprise ai governance approach that addresses these risks. This means setting clear standards, assigning accountability, and ensuring oversight at every stage. Effective ai governance helps you manage data sovereignty and protect your organization from new threats.

Note: Lack of understanding and expertise in AI among policymakers and regulators makes it even harder to close these gaps. You need to invest in education and cross-team coordination to build a strong ai governance framework.

By updating your governance policies and focusing on oversight, you can create a safer environment for AI adoption. You will also support responsible ai and help your organization thrive in the age of artificial intelligence.

Real-World Consequences

Policy Failures

AI incidents

You see the impact of weak governance when real-world incidents make headlines. AI systems can fail in ways that harm people and organizations. For example, output corruption happens when AI investment advisors recommend the wrong securities because of biased training data. In healthcare, AI may suggest outdated treatments if it relies too much on old information. Data poisoning can also occur, where AI systems expose sensitive information due to weak controls.

Incident Type	Description
Output Corruption	AI investment advisors in financial services recommending inappropriate securities due to biased training data.
Healthcare Risks	AI suggesting outdated treatments because of historical data being overweighted in training sets.
Data Poisoning	AI systems inadvertently exposing sensitive information due to vulnerabilities in training data.

You need to establish a responsible AI culture to anticipate these negative outcomes. Pre-determined escalation procedures and timely response mechanisms help protect your brand and stakeholder confidence.

Lessons learned

You can learn important lessons from past policy failures. Many organizations have seen that good intentions are not enough. For example, trade adjustment policies often failed to support displaced workers, leading to broken promises. You should focus on developing technologies that help workers, not just replace them. Comprehensive support systems work better than simple adjustment assistance.

You also see that institutional failures come from a lack of commitment to compliance culture and clear policies. Procedural failures happen when there is a gap between written policies and what people actually do. Performance failures occur when individuals or automated systems make mistakes that lead to negative outcomes.

Regulatory Gaps

Global inconsistencies

You face challenges because regulation cannot keep up with the speed of AI. Rapid technological advancement often outpaces regulatory frameworks. The complexity and opacity of AI models make accountability difficult. You need adaptive policies and global cooperation to close these gaps.

AI adoption rates are expected to rise from 20% in 2020 to 85% by 2025.
Governance maturity may only reach 40% by 2025.
68% of Americans express concern over unethical AI decision-making.
Many countries have different approaches to regulation, which creates confusion for organizations.

Cross-border issues

AI is a global phenomenon. You must address cross-border issues to enforce governance policies effectively. Regulatory fragmentation makes it hard for organizations that operate internationally. Countries often have different standards and political views, which makes global cooperation challenging. You need effective governance frameworks that can work across borders.

Note: Without strong global cooperation, you may struggle to manage AI risks that cross national boundaries.

Organizational Risks

Reputation damage

You risk serious reputation damage if you do not manage AI properly. In digital environments, problems can escalate quickly. For example, Grok’s offensive content led to a CEO’s resignation within 48 hours. Small organizations may face even greater threats, as social media can create permanent records that resurface during negotiations or regulatory reviews.

Legal liabilities

You also face legal liabilities if you lack strong governance. Healthcare organizations risk HIPAA violations if AI systems access patient data without proper controls. Financial services firms may face SEC enforcement for not following fiduciary duties. You must ensure your AI systems comply with all relevant regulation to avoid costly penalties.

Tip: Build strong governance policies and stay updated on regulation to protect your organization from these risks.

Strengthening Governance Policies

Core Principles

Transparency

You need transparency to build trust in your AI systems. When you make your AI processes clear and understandable, you help everyone see how decisions happen. Transparency and explainability let you show users, regulators, and partners that your AI works as intended. You should document how your AI models work, what data they use, and how you test them. This approach helps you answer questions and address concerns quickly. When you focus on transparency, you create a foundation for stakeholder trust and responsible AI governance.

Accountability

Accountability and oversight are essential for safe AI use. You must assign clear roles and responsibilities for every stage of your AI projects. This means naming system owners, defining who approves changes, and setting up incident-response plans. When you know who is responsible, you can respond to problems faster and prevent mistakes. Accountability and oversight also help you meet legal and ethical standards. You should keep audit logs and review them regularly to ensure your AI systems follow your policies.

Tip: Form an AI governance committee with members from legal, IT, compliance, and management. This team can oversee AI implementation, auditing, and risk management.

Adaptive Design

Iterative updates

AI changes quickly, so your governance policies must keep up. You should design your policies to allow for regular updates. This approach lets you respond to new risks and opportunities as they appear. Iterative updates help you fix problems before they grow. You can use a phased implementation approach, starting with planning and risk classification, then updating your policies as you learn more. This method keeps your AI governance strong and relevant.

Component	Description
Organizational Structure	Defines roles and responsibilities to prevent siloed governance efforts.
Data Governance	Ensures lawful, high-quality data inputs through tracking, access control, and quality monitoring.
Algorithm Governance	Establishes transparency and testing protocols for model development and validation.
Risk Assessment	Identifies and classifies risks, implementing mitigation strategies for high-risk systems.
Compliance Management	Aligns governance frameworks with regulations like the EU AI Act and ISO standards for readiness.
Accountability Structures	Defines ownership and responsibilities, including incident-response plans and audit logs.
Continuous Monitoring	Implements ongoing checks for performance and compliance, ensuring models remain effective over time.
Phased Implementation Approach	Outlines a strategic, iterative process for governance that includes planning, risk classification, and policy definition.

Feedback loops

Feedback loops make your governance policies even stronger. You should collect feedback from users, technical teams, and business leaders. This input helps you spot inefficiencies and close loopholes. When you listen to feedback, you can adjust your policies to fit real-world needs. Built-in feedback loops also help you address new risks quickly. This process supports ongoing improvement and keeps your AI governance effective.

Benefits of adaptive design in AI governance:
- Flexibility to adjust policies as technology changes
- Rapid iteration for ongoing updates and improvements
- Feedback loops to address inefficiencies and loopholes
- Layered oversight and impact assessments to minimize risk
- Accelerated workflows and risk minimization
- Stronger ethical compliance

Collaboration

Cross-functional teams

You need cross-functional teams to manage AI governance well. These teams bring together experts from legal, IT, human resources, compliance, and business units. When you combine different skills and viewpoints, you create better oversight and stronger policies. Cross-functional collaboration encourages teamwork between technical and business teams. This approach aligns innovation with ethical responsibility and helps you address complex challenges.

Practical steps for effective collaboration:
- Assemble an executive-level committee with representatives from information security, risk management, legal, technology, and ethics.
- Conduct an AI readiness and risk assessment. Create a centralized inventory of AI use cases and document system owners.
- Hold regular meetings to review AI projects and share updates across teams.

Organizational alignment

Organizational alignment ensures everyone works toward the same goals. You should communicate your AI governance policies clearly to all staff. Training programs help employees understand their roles and the importance of oversight. When everyone knows the rules and expectations, you reduce the risk of mistakes. Organizational alignment also supports trust and helps you enforce your policies at every level.

Note: Strong collaboration and alignment make your AI governance scalable, enforceable, and auditable. This approach helps you maintain trust and meet regulatory requirements as your AI systems grow.

Continuous Monitoring

Real-time assessment

You need to watch your AI systems closely at all times. Real-time assessment helps you spot problems as soon as they happen. This means you can fix issues before they grow. You should set up tools that send instant alerts if something goes wrong. For example, you might get a warning if your AI system slows down or makes too many mistakes.

You should track important metrics, such as:

Inference latency (how fast your AI responds)
Accuracy thresholds (how often your AI gets things right)
Throughput (how much work your AI does in a set time)
Resource utilization (how much computer power your AI uses)

You also need to look at how your AI performs over time. Historical monitoring helps you find slow changes, like when your AI starts to make more errors or uses lower-quality data. By checking both real-time and past data, you can keep your AI systems safe and reliable.

Tip: Set up dashboards that show these metrics in real time. This makes it easy for you and your team to see problems and act fast.

Automated enforcement

You can use automated enforcement to make sure your AI systems follow your rules. Automated tools can check for policy violations without human help. For example, if someone tries to access data they should not see, the system can block them right away.

Strong security measures are important. You should use:

Strong authentication to make sure only the right people use your AI
Data encryption to protect information as it moves and sits in storage
Role-based access control so users only see what they need
Data anonymization to hide personal details

Automated enforcement helps you respond to threats quickly. It also makes your governance policies scalable and auditable. You can show regulators and partners that you follow best practices.

Note: Automated enforcement does not replace human oversight. You still need people to review alerts, update rules, and improve your systems.

Continuous monitoring gives you confidence in your AI. You can trust your systems to work safely and follow your policies every day.

Steps for AI Governance Readiness

Policy Gap Assessment

AI risk audits

You need to start your AI governance journey with a clear understanding of your current state. AI risk audits help you find gaps in your policies and controls. You should review where your organization uses AI and check if you have the right safeguards. Look for areas where your data might be at risk or where you lack oversight. These audits help you see if your governance matches the speed of AI adoption. You can use these findings to build stronger policies and protect your organization as you increase adoption.

Improvement areas

After your audit, you will see where you need to improve. Focus on areas with weak controls or unclear responsibilities. You might find that some teams use AI without following any guidelines. You may also notice missing documentation or outdated risk models. Make a list of these improvement areas and set priorities. This step helps you build a roadmap for better AI governance and safer adoption.

AI-Specific Guidelines

Standards for use

You need clear standards for using AI in your organization. These standards help everyone understand what is allowed and what is not. Good guidelines cover fairness, transparency, privacy, and safety. They also explain how to handle data and how to check for bias. You should connect these standards to your existing governance policies. This approach supports responsible AI adoption and helps you avoid mistakes.

Here is a table that shows the essential components of AI-specific guidelines:

Component	Description
Governance Structure and Accountability	Define ownership, oversight roles, and decision rights for AI initiatives.
Risk Classification and Model Tiering	Identify high-risk use cases early and apply deeper review and controls.
Policies, Controls, and Documentation	Establish governance policies that require validation and clear standards for AI use.
Monitoring, Auditing, and Incident Response	Continuously review system performance and address issues proactively.

You should also focus on fairness, explainability, and data protection. These elements help you build trust and support strategies to increase adoption.

Roles and responsibilities

Assigning clear roles is key for strong AI governance. You need to know who owns each AI system and who checks for risks. Set up a team to review new AI projects and monitor ongoing use. Make sure every person understands their job and how they support safe adoption. This structure helps you respond quickly if something goes wrong.

Training Programs

Staff education

You must teach your staff about AI governance and responsible adoption. Training programs help everyone learn best practices and understand the risks. You can use workshops, online courses, or regular meetings. Staff should know how to use AI tools safely and how to spot problems early.

Here is a table that shows important parts of effective training programs:

Component	Description
AI Governance Frameworks	Help organizations learn, govern, monitor, and mature AI adoption. Establishes best practices and knowledge sharing.
Ethical Principles	Provide a decision-making framework around fairness, transparency, accountability, and responsible innovation.
Continuous Training and Upskilling	Essential for staff to recognize AI risks and understand the organization's approach to responsible AI use.

Ethical culture

Building an ethical culture supports safe AI adoption. You should encourage open discussions about fairness and responsibility. Set clear expectations for how to use AI in line with your values. When you focus on ethics, you help your organization use AI for good and avoid harm.

Tip: Regular training and open communication help you build a strong culture of responsible AI adoption.

Future of AI Governance

Emerging Trends

New regulations

You will see new regulations shape the future of governance. Governments around the world are introducing laws to manage how organizations use technology. The EU AI Act is one example. Other countries are creating similar rules. These laws set standards for safety, transparency, and accountability. You must follow these regulations to avoid penalties and build trust with your customers. As more countries adopt strict rules, you need to stay informed and ready to adjust your policies.

Intelligent compliance systems

Technology is also changing how you manage governance. Intelligent compliance systems use automation and machine learning to monitor your processes. These systems can check if you follow the rules in real time. They help you find problems quickly and fix them before they grow. You can use dashboards and alerts to keep track of your compliance status. This approach makes your governance more efficient and reliable.

Here is a table that shows some of the most important trends shaping the future of governance:

Trend	Description
Expansion of Regulations	The EU AI Act and similar laws are being adopted globally, influencing AI governance frameworks.
Need for Self-Governance	Organizations are adopting self-governance to align with ethical standards beyond regulatory requirements.
Demand for Skilled Professionals	There is a growing need for trained AI governance professionals to implement responsible practices.

Note: You should not wait for new laws to force change. Start building strong governance now to stay ahead.

Preparing for Change

Flexible frameworks

You need flexible frameworks to keep up with rapid changes in governance. Static policies will not work as technology evolves. Build frameworks that you can update easily. This helps you respond to new risks and opportunities. You should review your governance structure often and make changes when needed. Flexible frameworks support innovation while keeping your organization safe.

Staying ahead

To stay ahead, you must prepare your team and your organization for ongoing changes. Here are some steps you can take:

Encourage continuous upskilling for everyone in your workforce. This helps your team keep pace with new technology.
Evaluate your risk profile for each project. Look for potential biases and data privacy issues.
Align your AI strategies with your company’s main goals. This ensures that governance supports your business and keeps operations smooth.

You will see more demand for skilled professionals who understand governance. Training and education will help you build a strong team. By staying proactive, you can lead your organization through future changes with confidence.

Tip: Make governance a regular topic in team meetings. This keeps everyone aware and ready for new challenges.

You must rethink your approach to governance as AI brings new risks and opportunities. Update your policies, involve cross-functional teams, and focus on continuous learning. Use the table below to guide your next steps:

Key Takeaway	Description
Establish Clear Definitions	Define what AI means for your organization and its risks.
Maintain an Inventory	Track all AI systems for better oversight.
Revise Existing Policies	Update governance to address AI-specific challenges.
Foster Collaboration	Engage diverse teams for stronger governance.
Implement Monitoring	Regularly check AI systems for fairness and reliability.

Stay proactive and make governance a top priority for your leadership team.

FAQ

What is AI governance?

AI governance means setting rules and processes for how you use AI. You make sure your AI systems stay safe, fair, and legal. Good governance helps you avoid mistakes and build trust.

Why do traditional policies fail with AI?

Traditional policies move slowly. AI changes fast. Old rules cannot keep up with new risks. You need flexible policies that adapt to AI’s speed and complexity.

How can you start improving AI governance?

You can begin with an AI risk audit. Check where you use AI and look for weak spots. Assign clear roles. Update your policies to cover AI-specific risks.

What are the biggest risks of poor AI governance?

Poor governance can lead to:
Data leaks
Biased decisions
Legal trouble
Reputation loss

You protect your organization by closing these gaps.

How does Microsoft Copilot help reveal governance gaps?

Microsoft Copilot can surface information across your systems. You may find missing permissions or weak controls. This visibility helps you spot and fix policy gaps.

What should you include in AI training programs?

You should cover:

Responsible AI use
Data privacy
Spotting bias
Reporting problems

Regular training keeps your team ready for new challenges.

Do you need to follow global AI regulations?

Yes. Many countries have different rules. You must understand and follow all laws where you operate. This helps you avoid fines and keeps your business safe.

🚀 Want to be part of m365.fm?

Then stop just listening… and start showing up.

👉 Connect with me on LinkedIn and let’s make something happen:

🎙️ Be a podcast guest and share your story
🎧 Host your own episode (yes, seriously)
💡 Pitch topics the community actually wants to hear
🌍 Build your personal brand in the Microsoft 365 space

This isn’t just a podcast — it’s a platform for people who take action.

🔥 Most people wait. The best ones don’t.

👉 Connect with me on LinkedIn and send me a message:
"I want in"

Let’s build something awesome 👊

1
00:00:00,000 --> 00:00:05,760
Hello, welcome everybody to another edition of the M65FM show.

2
00:00:05,760 --> 00:00:13,120
So today we look a little bit about governance in the age of AI,

3
00:00:13,120 --> 00:00:16,080
rethinking Microsoft 365 policy.

4
00:00:16,080 --> 00:00:18,240
My guest is Christian Bakley today.

5
00:00:18,240 --> 00:00:20,960
He is an MVP, Rignel Director,

6
00:00:20,960 --> 00:00:23,480
a co-operation and governance expert,

7
00:00:23,480 --> 00:00:30,200
author, also oversized fiction book, ed, technology if I can just say this.

8
00:00:30,200 --> 00:00:35,640
Most organizations already have governance policies for Microsoft 365,

9
00:00:35,640 --> 00:00:41,320
but those policies are not designed for AI and

10
00:00:41,320 --> 00:00:46,280
that can record their content service, sensitive data,

11
00:00:46,280 --> 00:00:49,080
or take action on behalf of users.

12
00:00:49,080 --> 00:00:52,920
In this episode, Christian Bakley shares less than 30 years

13
00:00:52,920 --> 00:00:57,480
in collaboration, information management, and workplace productivity,

14
00:00:57,480 --> 00:01:02,680
exploring how governance must evolve to support secure and scalable AI

15
00:01:02,680 --> 00:01:05,320
adoption across Microsoft 365.

16
00:01:05,320 --> 00:01:07,640
So welcome Christian.

17
00:01:07,640 --> 00:01:09,480
This could be your tip.

18
00:01:09,480 --> 00:01:10,600
Thank you.

19
00:01:10,600 --> 00:01:15,880
Yeah, you've been involved in collaboration technology for more than 30 years.

20
00:01:15,880 --> 00:01:20,520
What organically draw you in this space?

21
00:01:21,160 --> 00:01:29,640
Yeah, I think it was one of my first jobs early in my career in the mid-90s.

22
00:01:29,640 --> 00:01:35,880
I had been, I went to, started a little tech company in '91, that got sold,

23
00:01:35,880 --> 00:01:42,200
went to, it went and did contract role with a couple different places,

24
00:01:42,200 --> 00:01:48,520
and then ended up working for the phone company, Pacific Bell in California,

25
00:01:48,520 --> 00:01:52,280
and moving back to where I was born and raised in San Francisco East Bay.

26
00:01:52,280 --> 00:01:56,520
And so it was exciting to move my little family had two kids at the time

27
00:01:56,520 --> 00:01:58,840
and two more along the way while working there.

28
00:01:58,840 --> 00:02:05,880
But I was given the task of building out,

29
00:02:05,880 --> 00:02:08,200
or helping build out.

30
00:02:08,200 --> 00:02:09,560
I didn't own all of it.

31
00:02:09,560 --> 00:02:14,600
I was a project manager, the intranet for our organization.

32
00:02:14,600 --> 00:02:18,040
We had about a 200 person organization in the very large

33
00:02:18,680 --> 00:02:21,080
tens of thousands of employees company.

34
00:02:21,080 --> 00:02:24,360
And we were a shared services IT team.

35
00:02:24,360 --> 00:02:31,880
And I built out, I was very, very involved in project management and methodology around that,

36
00:02:31,880 --> 00:02:34,280
and building out training systems.

37
00:02:34,280 --> 00:02:39,880
And we deployed things, and I was in charge of training people on business objects and

38
00:02:39,880 --> 00:02:42,200
other platforms in the mid-90s.

39
00:02:42,920 --> 00:02:49,080
But built out this automated intranet solution, which got me fascinated, of course,

40
00:02:49,080 --> 00:02:55,320
at the time, the later 90s, you started to see the rise of instant messaging,

41
00:02:55,320 --> 00:03:00,360
the various platforms, you know, AOL, where my college roommate went to work for AOL.

42
00:03:00,360 --> 00:03:04,760
I tried to convince me to move out to Virginia, nor the Virginia, and work for AOL.

43
00:03:04,760 --> 00:03:06,760
I'm like, no, I already hated AOL.

44
00:03:06,760 --> 00:03:12,120
He did very well there, which I would have done very well.

45
00:03:12,120 --> 00:03:13,160
Had I moved out there?

46
00:03:13,160 --> 00:03:21,400
No, but we incorporated chat capability into our solution, and it kind of grew from there.

47
00:03:21,400 --> 00:03:28,120
So building a custom chat platform for those that remember, those are the old-school

48
00:03:28,120 --> 00:03:32,520
collaboration folks. Remember when there was, you know,

49
00:03:32,520 --> 00:03:34,520
IcQ was acquired by AOL.

50
00:03:34,520 --> 00:03:37,960
You had like Yahoo, then you had, was it net meeting?

51
00:03:37,960 --> 00:03:40,120
Microsoft had a couple different versions.

52
00:03:40,120 --> 00:03:44,600
And with Windows NT, they had their net meeting, which was fantastic.

53
00:03:44,600 --> 00:03:51,960
But Yahoo Messenger was one of the, I think the first that was able to connect internet,

54
00:03:51,960 --> 00:03:55,640
like your chat to landline phones.

55
00:03:55,640 --> 00:03:59,560
So you could, through Yahoo, call landlines.

56
00:03:59,560 --> 00:04:07,160
So for example, when 9/11 happened, you didn't think we were going to go dark with 9/11, talk 9/11.

57
00:04:07,160 --> 00:04:15,320
I was in Japan working, and so I was able from my crappy hotel Wi-Fi connection

58
00:04:15,320 --> 00:04:24,360
on my laptop, through Yahoo, call my family in California, while all that was going on on 9/11.

59
00:04:24,360 --> 00:04:30,360
But yeah, it's, so that's what really kind of sparked it.

60
00:04:30,360 --> 00:04:35,560
And then got into, as also, I started a software company in 97

61
00:04:36,120 --> 00:04:41,320
during graduate school while working on my MBA, and my two co-founders and I,

62
00:04:41,320 --> 00:04:45,400
we were incorporating different tools into our solution.

63
00:04:45,400 --> 00:04:50,840
But we started to use it, if you remember this, we started using what's called Groove,

64
00:04:50,840 --> 00:04:56,920
or what was called Groove, which was Ray Ozzy's collaborative platform after Lotus Notes.

65
00:04:56,920 --> 00:05:02,120
We were sharing files with each other via FTP server.

66
00:05:02,120 --> 00:05:05,320
And we're like, this is an inefficient way to go in through this.

67
00:05:05,960 --> 00:05:09,720
You know, into share files and do all these things and publish things out.

68
00:05:09,720 --> 00:05:16,200
Blogs didn't exist. The Tant Log, we were publishing directly to our website.

69
00:05:16,200 --> 00:05:24,760
But via this FTP, writing HTML, and Groove came along, and so we started using that to collaborate.

70
00:05:24,760 --> 00:05:30,680
And then of course, Ray Ozzy went over to Microsoft in kind of that direction,

71
00:05:31,640 --> 00:05:38,280
which led to, and then I'll finish my story, led to learning about this new SharePoint thing.

72
00:05:38,280 --> 00:05:46,280
And it was back in the 2003 version of that. I was researching that.

73
00:05:46,280 --> 00:05:52,760
And again, having deployed in the PLM, PDM, so product lifecycle management, product data management

74
00:05:52,760 --> 00:05:58,840
space, there was a lot of this powerful but expensive collaborative solutions that were out there

75
00:05:58,840 --> 00:06:05,080
that I had been working with with another startup. And I read about, I found out about SharePoint,

76
00:06:05,080 --> 00:06:10,920
SAUS and Demo's from Microsoft People the Bay Area, wrote a white paper in early 2004,

77
00:06:10,920 --> 00:06:19,720
which got read by the product team up in Redmond. And I got invited up in August of 2004.

78
00:06:19,720 --> 00:06:27,000
I did a visit to Microsoft campus. And a year later was deploying SharePoint to a client,

79
00:06:27,880 --> 00:06:36,040
caught the bug. I finally, I got it, what they were trying to do. And in 2006, then went to work

80
00:06:36,040 --> 00:06:43,080
from Microsoft. So it's interesting from Internet and project management and collaboration and chat,

81
00:06:43,080 --> 00:06:50,840
all these pieces that kind of found my way into this space that I've just never left the collaboration

82
00:06:51,640 --> 00:07:00,600
technology space. Yeah, the most interesting point on SharePoint, 20 years they don't have

83
00:07:00,600 --> 00:07:08,760
renamed it by Microsoft. I think that it makes it really special. But what left from the early SharePoint

84
00:07:08,760 --> 00:07:16,440
years still applied today? Oh, I mean, so much of it. It's funny that one of the first conferences

85
00:07:16,440 --> 00:07:21,880
that I spoke at, like I was at Microsoft for three and a half years. One of the first conferences I

86
00:07:21,880 --> 00:07:30,600
spoke at was I think in early 2010, as a post Microsoft was KM World, so knowledge management.

87
00:07:30,600 --> 00:07:37,880
This is back in DC. And what was interesting was I did a little like one session

88
00:07:37,880 --> 00:07:45,000
and we were there for the company, the product company is working for, but having conversations with

89
00:07:45,000 --> 00:07:53,320
people that had PhDs in library sciences. And I was amazed at how much of what I learned

90
00:07:53,320 --> 00:08:00,920
back in my phone company days, building out the Internet, working with the technical writer teams,

91
00:08:00,920 --> 00:08:07,560
and building out like that content, how all of those rules of what you need to do to clean up

92
00:08:07,560 --> 00:08:13,560
your data and keep your data organized, like we're all still relevant. And even now, it's funny

93
00:08:13,560 --> 00:08:20,840
in the SharePoint space. Again, SharePoint just had its 25th birthday earlier this year. And

94
00:08:20,840 --> 00:08:26,360
and that's you know, as it was branded SharePoint, it had a life for a couple years, a year and a half

95
00:08:26,360 --> 00:08:34,840
before that, other names. But 25 years of SharePoint, it's those fundamentals. I just did a session in

96
00:08:34,840 --> 00:08:41,720
Orlando where I talked about the difference between foundational things versus basic things,

97
00:08:41,720 --> 00:08:47,000
basic things or move a file from here to there, that kind of stuff, easy stuff, foundational or

98
00:08:47,000 --> 00:08:52,600
generally harder things. They take time. They take effort, but are critical for things to

99
00:08:52,600 --> 00:08:58,760
perform well, naming conventions, lifecycle management of your content.

100
00:08:58,760 --> 00:09:05,240
Having, again, naming, labeling, classifications, having your information architecture,

101
00:09:06,120 --> 00:09:13,800
all figured out, all of that is remains crucial for SharePoint. And especially it's it's important for

102
00:09:13,800 --> 00:09:24,120
the AI world we live in. So this is interesting. You have say some interesting topics, what brings

103
00:09:24,120 --> 00:09:33,160
me to to governance. What governance mistakes do organizations keep repeating from your perspective?

104
00:09:33,960 --> 00:09:40,840
Yeah, I think that the biggest mistake organizations are making right now is there with a lot of

105
00:09:40,840 --> 00:09:47,640
this move towards agentic AI. And I understand, again, I'm out there doing trainings and doing

106
00:09:47,640 --> 00:09:53,400
deployments and things that working as a consultant. So I realize there's what's Microsoft is selling

107
00:09:53,400 --> 00:09:58,120
versus what people are buying and adopting and those kinds of things. So I think we're still

108
00:09:59,640 --> 00:10:05,480
the reality on the ground is a lot of organizations, while they're the license pickup is increasing,

109
00:10:05,480 --> 00:10:11,000
Microsoft is now saying what they they're claiming like to over 20 million licensed co-pilot

110
00:10:11,000 --> 00:10:19,800
users, paid licenses, not just using the free chat versions of those. But their organizations are still

111
00:10:19,800 --> 00:10:28,360
in the pilot phase, they're still in the growing. We're nowhere close to broad adoption of it.

112
00:10:28,360 --> 00:10:35,960
I think that the mistake organizations make is treating agentic AI like it's just another

113
00:10:35,960 --> 00:10:41,560
productivity feature or roll out. This isn't a new version of Word and PowerPoint. I mean, there's

114
00:10:41,560 --> 00:10:50,760
new features, AI features in all of the products, but it's not those things. And this is a governance

115
00:10:50,760 --> 00:10:58,200
and operational transformation issue as much as it is a technology issues. When you start talking

116
00:10:58,200 --> 00:11:04,760
about Microsoft co-pilot, co-pilot studio, autonomous agents which scare a lot of people,

117
00:11:04,760 --> 00:11:12,360
I think it's valid, valid concerns there. Don't deploy something if you don't have at

118
00:11:12,360 --> 00:11:18,920
least a fundamental understanding of it. But a lot of the workflow orchestration and other

119
00:11:18,920 --> 00:11:24,680
aspects of the AI systems that can actually take actions on behalf of users or departments,

120
00:11:25,800 --> 00:11:32,440
that is raising the governance sticks. Organizations are not ready to let go of that

121
00:11:32,440 --> 00:11:39,800
level of control. So, and I would say that they're smart to be wary of these things until they

122
00:11:39,800 --> 00:11:46,920
understand how they work. And so, you know, I think of, you know, for large enterprises, especially,

123
00:11:46,920 --> 00:11:54,440
I usually narrow the concerns down to three major areas that they have. I remember all three of

124
00:11:54,440 --> 00:11:59,320
them. I was just talking about them this morning in another show. But I mean, the first is,

125
00:11:59,320 --> 00:12:05,800
and this goes back to your like, foundational SharePoint question, is uncontrolled access

126
00:12:05,800 --> 00:12:13,000
to organizational knowledge. Who has access to what information, what data that's out there?

127
00:12:13,000 --> 00:12:21,080
And so, you most organizations already have permissions sprawl across SharePoint and Teams,

128
00:12:21,080 --> 00:12:29,080
OneDrive, Email, you know, all of the systems inside of Microsoft 365. The problem is that AI

129
00:12:29,080 --> 00:12:36,040
discovers all of them instantly. So, you know, an agent can aggregate information across all of

130
00:12:36,040 --> 00:12:42,600
those different systems, which is incredibly powerful. It's exciting. I love demoing on that. But it

131
00:12:42,600 --> 00:12:48,920
then shows you things in, you know, shows you access and things with that data in ways that people

132
00:12:48,920 --> 00:12:55,800
never anticipated. I always refer to it as, if you remember, Marco, the, the delve effect. Remember,

133
00:12:55,800 --> 00:13:01,720
when delve was rolled out, and people freaked out a little bit over like, like, I shouldn't be seeing

134
00:13:01,720 --> 00:13:08,360
this information. Yeah, you were obscuring the permissions, but you never fixed the permissions.

135
00:13:08,360 --> 00:13:16,040
So, you can't have security through obscurity. You weren't seeing it because the permissions were

136
00:13:16,040 --> 00:13:22,280
off, but your system was broken in a way that people weren't finding it. However, every employee has

137
00:13:22,280 --> 00:13:29,720
access to this information instead of a select group. So, AI discovers all of that instantly,

138
00:13:29,720 --> 00:13:37,720
and an agent can aggregate data across all of those, all of that data that people shouldn't see.

139
00:13:37,720 --> 00:13:44,280
So, asking who has access to this file, and then what agents can infer from it, what it can do,

140
00:13:44,280 --> 00:13:51,160
what it can summarize, connect to, all of that stuff. And this is why I talk about Microsoft is talking

141
00:13:51,160 --> 00:13:58,040
about AI-ready content. That was my session in Orlando at the N365 conference, was what does it

142
00:13:58,040 --> 00:14:06,600
mean to get, to have, you know, AI-ready content? And, and that just comes from governance maturity.

143
00:14:06,600 --> 00:14:12,440
It's the same things we've been talking about for 25, 30 years, clean permissions, lifecycle

144
00:14:12,440 --> 00:14:17,720
management, sensitivity labels, metadata, management, overall information, architecture,

145
00:14:17,720 --> 00:14:25,720
management, clear lines of ownership, all of that matters in an agentic world.

146
00:14:25,720 --> 00:14:32,440
Yeah, we have this, I think we have started on-prem, then we have the cloud area,

147
00:14:32,440 --> 00:14:40,760
now we have the AI area, and we get all, I think, a lot of tools like PUVU and so on.

148
00:14:41,080 --> 00:14:52,920
Is it, is it being harder to, today, to, to, to make, to make good governance compliance,

149
00:14:52,920 --> 00:14:58,920
or is it more simpler because we have all these awesome tools, Microsoft.

150
00:14:58,920 --> 00:15:04,920
I think it's a bit of both. I mean, you know, some part of my background, I mean, having worked

151
00:15:04,920 --> 00:15:11,560
for some of the larger ISVs in the space that, that, you know, I would work for AB point, which has

152
00:15:11,560 --> 00:15:19,080
fantastic products. I've worked with RENCORE, which I fan of their solution, partner with Orkestry,

153
00:15:19,080 --> 00:15:27,240
Sharegate, CIS Kit, I mean, there are some fantastic vendors. I would say that those are like my top five

154
00:15:27,240 --> 00:15:34,520
out there for different reasons and different strengths, you know, for each one of those. But it's,

155
00:15:34,520 --> 00:15:43,560
at the same time, you remember that purview, it, it wasn't one product, it is very complex. It was

156
00:15:43,560 --> 00:15:51,080
like a dozen different products that they rolled under the purview banner, and to some degree,

157
00:15:51,080 --> 00:16:00,120
they're still refining it kind of building that up. At the same time, you have how many Admin

158
00:16:00,120 --> 00:16:09,880
centers are there now? I know. 14, 16, and there's probably more than that. And so as Microsoft is

159
00:16:09,880 --> 00:16:16,760
doing better at consolidating around their solution and adding more and more, you've got the ISV,

160
00:16:16,760 --> 00:16:24,280
the partners out there with their solutions. And then you also have more and more robust reporting

161
00:16:24,280 --> 00:16:31,720
and capability around the Admin centers. What we don't have are superhumans who can understand,

162
00:16:31,720 --> 00:16:39,080
absorb all of that, and are experts in all of those things. It's, it's incredibly hard to go and do.

163
00:16:39,080 --> 00:16:45,960
But if, you know, the more that people are able to go and automate, and I think that constant

164
00:16:46,520 --> 00:16:53,880
consistent ask to Microsoft is to, as they're building out more and more in all of these areas,

165
00:16:53,880 --> 00:17:01,560
is to increase what the APIs can pull upon. And, and so that people could go and automate

166
00:17:01,560 --> 00:17:10,440
themselves or the third party tools become more powerful. I think, when we think about Admin center,

167
00:17:10,440 --> 00:17:18,280
and I find, I find it a little bit confusing because I think you can do in Admin center,

168
00:17:18,280 --> 00:17:27,080
user rights, but you can also do it in enter. What is the good architecture? And, and I don't know,

169
00:17:27,080 --> 00:17:34,600
what, yeah, I'm not the Admin center fan. So, I don't understand why we have these, all these

170
00:17:34,600 --> 00:17:42,680
options, true time is all three times. Well, so you know the classic, the answer to that is

171
00:17:42,680 --> 00:17:46,200
the answer that every consultant loves to say where it depends.

172
00:17:46,200 --> 00:17:52,360
You know, what, what you're trying to do, I mean, Microsoft has always been, I mean, famously,

173
00:17:52,360 --> 00:17:59,800
with their productivity solutions, Microsoft was known for like the battling business units.

174
00:18:00,760 --> 00:18:07,800
Sometimes having, you know, duplicate capabilities in different areas. And customers have always

175
00:18:07,800 --> 00:18:13,560
asked why. And so there's famously across Microsoft 365, as you know, there's this which tool do I

176
00:18:13,560 --> 00:18:23,400
use and when for some of that capability that carries over into the governance world, the Admin center

177
00:18:23,400 --> 00:18:28,760
world. There are multiple ways to do some things. And Microsoft's response to that is,

178
00:18:30,520 --> 00:18:36,040
what makes the most sense to your organization use that way. Now, for a company, the downside to that

179
00:18:36,040 --> 00:18:41,960
is if I go invest in building a bunch of things, relying on the API, build a bunch of custom things,

180
00:18:41,960 --> 00:18:48,520
leveraging the Admin center, and then Microsoft make changes the API. It breaks the things that I

181
00:18:48,520 --> 00:18:56,040
automated. I, my force to go through their Admin center, which is again, more manual or okay,

182
00:18:56,040 --> 00:19:02,840
than you're forcing me, even though I could do it myself just for ease of use. I'm going through a

183
00:19:02,840 --> 00:19:09,800
third party. So in, in, in some ways, Microsoft is forcing me to go pay more licensing to a third party

184
00:19:09,800 --> 00:19:18,840
solution that I can have a more controlled Admin panel across all of my systems. And so there's,

185
00:19:18,840 --> 00:19:25,000
I mean, there's not a straightforward answer for all those things. It would say it depends on what

186
00:19:25,000 --> 00:19:33,320
you're trying to do and what your focus is. And so some things where if your focus is on understanding

187
00:19:33,320 --> 00:19:39,240
the level of engagement, trying to improve adoption and things, I would say largely you can do that

188
00:19:39,240 --> 00:19:44,040
out of the box. You can use Admin center to use a report. There's guidance from Microsoft and how to

189
00:19:44,040 --> 00:19:52,440
go and do that. If you are trying to build a much more fluid, controlled, permissioning solution,

190
00:19:52,440 --> 00:19:58,600
where your organization is maybe largely teams is the front end. And a lot of the automation you're

191
00:19:58,600 --> 00:20:04,280
doing is from that perspective. I would say go take a look at Orkestry or maybe AppPoint

192
00:20:04,280 --> 00:20:13,880
for that to automate the provisioning process. And then leverage and build agents to fill in the gaps

193
00:20:13,880 --> 00:20:23,480
there. So it just depends. Yeah, I like use PowerShell and so on. And graph, I think it's all

194
00:20:23,480 --> 00:20:33,720
the good. But what traditional governance models are insufficiency with, well, for AI, why?

195
00:20:33,720 --> 00:20:41,560
I don't get, you know, I don't go much into specific models or methodologies. I mean, I look, there's a,

196
00:20:42,840 --> 00:20:48,280
you know, are there tools in their methods for different roles for different industries, all those

197
00:20:48,280 --> 00:20:53,880
kinds of things? Like I'm working with a client right now that works at more in the industrial sectors.

198
00:20:53,880 --> 00:21:01,160
So manufacturing, capital projects, utilities, airports, that kind of stuff. It's a SharePoint shop,

199
00:21:01,160 --> 00:21:09,480
building solutions, internet, inner box solutions for these industrial firms. And so the type of

200
00:21:09,480 --> 00:21:16,120
the governance pieces that their clients want are different than a, you know, I had a client,

201
00:21:16,120 --> 00:21:24,200
it was a school system. And, you know, it's primarily just a small IT team and then end users

202
00:21:24,200 --> 00:21:28,600
and admins. And so their requirements, what they're looking to automate, what they're looking to do,

203
00:21:28,600 --> 00:21:35,080
both of them had governance concerns, but they're just very different. So whereas the,

204
00:21:35,800 --> 00:21:41,800
the industrial clients want something that's very, they want a methodology, they want it refined.

205
00:21:41,800 --> 00:21:49,640
It's very much end to end their concern about that. The school system had some compliance things

206
00:21:49,640 --> 00:21:57,880
state and, and, and school system like compliance, but it was, it was more that the person who's

207
00:21:57,880 --> 00:22:04,280
running their IT comes from that background and knows that they need to do things in a clean way

208
00:22:04,280 --> 00:22:11,560
upfront that it can get messy. The size of an organization does not determine how complex

209
00:22:11,560 --> 00:22:15,480
your collaboration communication needs are. I've seen small companies with

210
00:22:15,480 --> 00:22:24,680
massively complex and messy collaboration platforms and could benefit from strong methodology.

211
00:22:24,680 --> 00:22:28,760
And then large enterprises that keep it very simple is they're like, "Now our needs are very

212
00:22:28,760 --> 00:22:35,560
straightforward." So can I just answer half the questions with it depends? Yeah, it depends.

213
00:22:35,560 --> 00:22:45,240
I wonder why our companies on the messing the risk of oversharing?

214
00:22:45,240 --> 00:22:55,800
Well, I mean, that is a, again, having control of your data is like one of the number one problems.

215
00:22:55,800 --> 00:23:01,960
I mean, it's, it's funny. You go back and my time spent, spent a little bit of time as an admin of

216
00:23:01,960 --> 00:23:08,760
SharePoint. I think a lot of us that have that have owned environments and the root of 99% of the

217
00:23:08,760 --> 00:23:13,480
issues were permission-based, you know, issues, somebody trying to do something that didn't have the

218
00:23:13,480 --> 00:23:17,880
right permissions for it or whatever. The problems are because they add too many permissions.

219
00:23:19,560 --> 00:23:26,600
And I think this is oversharing means that you don't have adequate control over it. You're not aware of

220
00:23:26,600 --> 00:23:35,800
who's in your system and what they're doing and what they have access to. And so while Microsoft,

221
00:23:35,800 --> 00:23:44,440
you know, back when they acquired Yammer, if you recall, so what was that 2013, 2014?

222
00:23:45,240 --> 00:23:51,560
They started incorporating that in. A lot of the SharePoint environments were very locked down,

223
00:23:51,560 --> 00:23:56,280
very controlled, because that was the only way that you could safeguard everything.

224
00:23:56,280 --> 00:24:03,160
And with the Acrocygian Yammer, which had a very flat architecture, the idea was that,

225
00:24:03,160 --> 00:24:13,640
well, with a flat architecture where you rely more on your labeling, your, the use of metadata,

226
00:24:14,200 --> 00:24:20,840
rather than folder and site structure and having all those the depth, that complexity meant that

227
00:24:20,840 --> 00:24:26,440
people were more engaged. The fewer restrictions that you have in the environment, the more people will

228
00:24:26,440 --> 00:24:33,800
use that technology. And that is just true. Like I always compare it to like when you're sent a survey,

229
00:24:33,800 --> 00:24:41,400
and when somebody sends you a survey, if there's 30 questions in the survey versus three questions in

230
00:24:41,400 --> 00:24:50,840
the survey, which are you more likely to answer? Yeah, the simpler. I take the three when,

231
00:24:50,840 --> 00:24:58,520
yeah, but the 40 also, when I get paid for a power, well, there's that, you know, that's again,

232
00:24:58,520 --> 00:25:02,600
you look at the motives of that. And then you all, I mean, there's other scenarios again,

233
00:25:02,600 --> 00:25:08,040
it's not a perfect example there. But the idea is, I mean, because there's other companies that

234
00:25:08,040 --> 00:25:13,800
I love their products and I'm happy to take their 30 question, you know, survey and give them more rich data.

235
00:25:13,800 --> 00:25:21,080
But the reality is that we want to keep things simple by, we want people to collaborate, but we want to

236
00:25:21,080 --> 00:25:33,560
do that within guard rails. So the more hidden you can make the controls, allows people just then to

237
00:25:33,560 --> 00:25:44,280
go and freely collaborate. So, for example, if, if you're a user in the company, I'm in IT, I've created

238
00:25:44,280 --> 00:25:52,600
10 different templates for SharePoint and Teams inside of our environment. And you don't have to

239
00:25:52,600 --> 00:25:59,720
ask permission to create a team in Teams or a SharePoint site. You just go in, you can only select from

240
00:25:59,720 --> 00:26:08,040
those templates, but you can create a way. And on my side, I love that model because I've already

241
00:26:08,040 --> 00:26:13,720
ensured that all of the classifications of labeling the lifecycle management, all of our backup

242
00:26:13,720 --> 00:26:19,320
procedures, lifecycle, but everything is already applied. You don't need to worry about it, you don't

243
00:26:19,320 --> 00:26:26,600
need to think about it. If you move the files into that project, metadata is picked up, associating

244
00:26:26,600 --> 00:26:32,200
with it with the project with the folder that said, again, all of that can be automated. You as a user

245
00:26:32,200 --> 00:26:36,280
never have to worry about it. All you know is that you need to collaborate, you create a team, you can

246
00:26:36,280 --> 00:26:43,640
go and do that. Now, in the system, if, if, let's say you, what you need to, maybe you need permission

247
00:26:43,640 --> 00:26:49,400
to create something with external users, you're working with outside partners. So there's a quick

248
00:26:49,400 --> 00:26:55,400
process within two hours to get approval is just to make sure that, you know, hey, this is a valid

249
00:26:55,400 --> 00:27:02,120
request or whatever, who are those external users? But I get set up a policy that says, you know, every 30

250
00:27:02,120 --> 00:27:08,920
days, you is the creator of that site with external users, you're the site owner, you get an email

251
00:27:08,920 --> 00:27:16,600
saying, "Mercow, here's a three people from this external partner that you let in. Is this still true?

252
00:27:16,600 --> 00:27:22,360
Are they still valid?" And if you went, "Oh, I completely forgot to boot two of those three people out."

253
00:27:22,920 --> 00:27:27,560
They no longer, they're no longer on the project. You can say yes to this one, no to the two others,

254
00:27:27,560 --> 00:27:34,280
and it then just makes the change. You get those reminders, but again, this is that, that, that

255
00:27:34,280 --> 00:27:41,000
world where there's guardrails that are up, allowing people to freely collaborate inside. That's,

256
00:27:41,000 --> 00:27:47,720
I think that's where organizations have gone need to go. Those that have not gone there yet.

257
00:27:47,720 --> 00:27:57,240
Awesome. If an organization and a pilot tomorrow, what's the first governance issue you will investigate?

258
00:27:57,240 --> 00:28:03,480
I mean, the first thing I would do is, you know, in the AI world, they're just in general.

259
00:28:03,480 --> 00:28:07,400
When they use co-pilot, when they start with co-pilot.

260
00:28:07,400 --> 00:28:15,640
Yeah, okay. Yeah, I mean, one, I would look at, well, it's like first, okay, in there, like, I walk

261
00:28:15,640 --> 00:28:20,360
into a client and they've got like a hot mess. I mean, because the first thing I would do,

262
00:28:20,360 --> 00:28:26,200
always do like that discovery, like, what is the sprawl situation? You've got now the new,

263
00:28:26,200 --> 00:28:31,320
the agent 365, you're able to go in there and see what have they been doing in the system.

264
00:28:31,320 --> 00:28:37,480
Microsoft is adding in, so at least you have that, that observability, you're able to see

265
00:28:37,480 --> 00:28:43,800
other third-party agents that are in there, not everything, they're adding more and more,

266
00:28:43,800 --> 00:28:51,560
that I just saw list this morning of like a dozen more that Microsoft is adding in to be able to support.

267
00:28:51,560 --> 00:28:59,400
So if I'm building things using GROC or CLOD or your Gemini or whatever, it's going to, if it's on

268
00:28:59,400 --> 00:29:09,640
our company system, then through agent 365, I should be able to see those. I can't manage them,

269
00:29:09,640 --> 00:29:18,200
but I can turn them off. I can shut them down. Or, which I would hope people go and do is to go and

270
00:29:18,200 --> 00:29:22,680
have a conversation with the creators of those models and understand what are you doing?

271
00:29:22,680 --> 00:29:28,280
What do you need to do? How can we support you? Are you trying to build something that should be

272
00:29:28,280 --> 00:29:35,560
built in a supported way using Copilot over here? Or is this a valid thing and what other protections

273
00:29:35,560 --> 00:29:41,720
could we put in place? That should be a conversation that's happening rather than just shut people down.

274
00:29:41,720 --> 00:29:48,280
Because if you try to shut people down, people are like, I always say that people are like water running

275
00:29:48,280 --> 00:29:51,960
down a hill. You put a rock in front of them. What does water do? It goes around.

276
00:29:51,960 --> 00:30:01,160
So yeah, that's the first thing I would do is check out the sprawl and then the two would be the

277
00:30:01,160 --> 00:30:11,560
cleanup of that sprawl. So I identify, do the cleanup, start putting the guardrails in place,

278
00:30:11,560 --> 00:30:19,240
and that depends on what they're doing out there. But I get this helps with your content cleanup

279
00:30:19,240 --> 00:30:26,840
as well as your agent cleanup. And when we look a little bit into LinkedIn, we have a lot of

280
00:30:26,840 --> 00:30:35,160
muscleroads, actually, one of this muscleroads, it's AI readiness. What do you do for

281
00:30:35,160 --> 00:30:43,720
you, AI readiness, actually mean? Yeah, that's for me, again, that goes to your content cleanup,

282
00:30:43,720 --> 00:30:50,360
your permissions, who has access to what? You know, people who are frightened by

283
00:30:52,840 --> 00:31:00,040
people building agents against all this content that's out there. My answer to that is build agents

284
00:31:00,040 --> 00:31:07,080
around SharePoint environments. Then you can strictly manage what is this agent C and not C.

285
00:31:07,080 --> 00:31:17,080
It's restricted to this SharePoint library, for example. So AI readiness would be the cleanup

286
00:31:17,080 --> 00:31:23,400
of your data, clean up of your permissions, and putting in place those guardrails. That is one, two,

287
00:31:23,400 --> 00:31:31,720
three. That's what I would do. Yeah. I think a lot of companies treat governance topics as an IT

288
00:31:31,720 --> 00:31:40,760
topic. So watch roles, I watch role plays leadership in governors. I mean, that's just a reality

289
00:31:40,760 --> 00:31:45,720
because a lot of this is coming from a technology standpoint and my IT is in the lead there and you

290
00:31:45,720 --> 00:31:51,640
might have other parts of the business. But I mean, this comes down again, if you spend any time

291
00:31:51,640 --> 00:31:58,200
in the SharePoint space and the information management space, we all know that who the actual owner

292
00:31:58,200 --> 00:32:06,120
is or driver of those systems are the departments that are using it. They need to take ownership of it.

293
00:32:08,360 --> 00:32:17,240
Those teams, those business units need to have basic understanding of how the technology works

294
00:32:17,240 --> 00:32:22,920
and what their responsibility is towards that. Someone in IT is not going to know,

295
00:32:22,920 --> 00:32:27,960
you know, the difference between our two skill sets and what you should have access to what I've

296
00:32:27,960 --> 00:32:33,000
access is, they're not going to understand that and then what agents should and shouldn't do.

297
00:32:33,960 --> 00:32:39,080
So there needs to be, there need to be, I'm a huge advocate for the champions model.

298
00:32:39,080 --> 00:32:46,280
So you can have even if the leadership of those business units doesn't understand it, you can

299
00:32:46,280 --> 00:32:52,280
have champions within all of these organizations of end users that are passionate about this that

300
00:32:52,280 --> 00:32:59,720
want to learn more about it and can be the representative for like best practices. If you've got a

301
00:32:59,720 --> 00:33:08,840
methodology of the AI readiness task force that is cross-departmental, but you can have those champions

302
00:33:08,840 --> 00:33:15,960
inside of each of those organizations and can really help move things a long way to clean up and

303
00:33:15,960 --> 00:33:24,280
truly get your content ready. We have so many AI tools in the Microsoft WorldBask.co.py,

304
00:33:24,280 --> 00:33:33,000
lots of co-pilot studio, AI found Grievous, all these Azure machine learning stuff.

305
00:33:33,000 --> 00:33:45,640
It's, I think, yeah, it's the governance strategy that one fits all or have that I need on that.

306
00:33:45,640 --> 00:33:51,320
That's never been true. Yeah, yeah, that's why I say that. You know, it's funny. I do a project

307
00:33:51,320 --> 00:33:56,680
management show with my good friend, fellow MVP, Sharon Weaver called Project Failure Files.

308
00:33:56,680 --> 00:34:06,760
We talk about not technology, but around the business issues around it. A lot of the failures

309
00:34:06,760 --> 00:34:13,400
that are around IT topics are management giving up over to others around it. There's a certain

310
00:34:13,400 --> 00:34:18,760
again, a certain amount of understanding that needs to happen. You think about information governance

311
00:34:18,760 --> 00:34:26,680
that is best managed at the point of entry and by the responsible parties. So if I'm in the marketing

312
00:34:26,680 --> 00:34:33,400
department, someone in marketing should understand our data, our structure, our metadata in the

313
00:34:33,400 --> 00:34:38,840
guardrails around that. Somebody that's in IT, somebody that's in sales in each of one of those things.

314
00:34:38,840 --> 00:34:48,120
Information governance is a diffused science that is, it's owned by each of the areas.

315
00:34:48,120 --> 00:34:54,760
It's also about risk management. If I'm in marketing, I'm going to better understand the risks of

316
00:34:54,760 --> 00:35:00,040
who external users internal like the permissions around those. Again, better than someone in IT.

317
00:35:00,040 --> 00:35:09,720
These if you think about these systems, SharePoint sits in the right in the middle between knowledge

318
00:35:09,720 --> 00:35:15,560
in action. And that's why the organizations that are really successful around governing their

319
00:35:15,560 --> 00:35:21,800
platforms right now. They're the ones that are in some ways they're slowing down a bit around

320
00:35:21,800 --> 00:35:28,680
like AI and looking at this and saying that we need to make sure is this the right structure for us.

321
00:35:28,680 --> 00:35:33,880
Are these the right policies or rules? What are the policies or rules? Are there compliant standards?

322
00:35:33,880 --> 00:35:40,440
Are there security risks that are unique? Yes to our company, but to our department,

323
00:35:40,440 --> 00:35:48,040
to these data types that we're working with, you might have like the sales and support organizations

324
00:35:48,040 --> 00:35:54,200
they're dealing with customer information. So they have policies that apply to them that somebody

325
00:35:54,200 --> 00:36:00,280
over in product, they're not customer facing like directly. It's through these other interfaces.

326
00:36:00,280 --> 00:36:04,120
I would hope your product team's customer. But just as an example,

327
00:36:06,200 --> 00:36:11,160
they're and so they're not handling that data in the same way and they don't have those same rules

328
00:36:11,160 --> 00:36:19,560
in their systems. And that's why governance could be slightly different even within one organization,

329
00:36:19,560 --> 00:36:26,200
one company. I know people that own this space you're thinking, wow, it's just really complex.

330
00:36:26,200 --> 00:36:32,280
I'm just telling you that like if you've got nothing, it's better to have one overlying system than

331
00:36:32,280 --> 00:36:39,880
nothing. But when you start realizing that there are differences that are new in business units

332
00:36:39,880 --> 00:36:46,360
and between projects in those business units, you start managing exceptions to those that

333
00:36:46,360 --> 00:36:53,640
one overlying. And so it starts to get very complex very quickly. And so that's why it's good to have

334
00:36:53,640 --> 00:37:00,520
your, you know, those those guard rails up as early as possible. So us as a company, I mean, great

335
00:37:00,520 --> 00:37:05,080
example, I went and did consulting for a company. It was the first company where I deployed sharepoint.

336
00:37:05,080 --> 00:37:13,640
So this is 21 years ago. But I was hired to do an audit of a number of their systems, but including

337
00:37:13,640 --> 00:37:19,240
all of their accounting systems. So it's all about PII and it was about, you know, the credit card company

338
00:37:19,240 --> 00:37:25,240
compliance, they were breaking rules. So they were already being fined. And I went in as an auditor of

339
00:37:25,240 --> 00:37:31,800
their systems and processes, redesigned things and say that people who didn't follow what was

340
00:37:31,800 --> 00:37:40,840
redesigned got fired. I sometimes tell the story. I felt really bad. Like I, I built a system. I

341
00:37:40,840 --> 00:37:48,120
tattled on, I had to tell on a couple of employees who then got fired immediately the next day,

342
00:37:48,120 --> 00:37:53,720
the next morning, because they broke the rules that we had just put in place and trained everybody

343
00:37:53,720 --> 00:38:00,520
on. And then they immediately broke the rules. And after the CFO had told all of the employees in a

344
00:38:00,520 --> 00:38:07,000
couple hundred people, zero tolerance, because they were getting fined tens of thousands of dollars.

345
00:38:07,000 --> 00:38:13,640
And they're like, well, this stops immediately. And so they made examples of a couple people that

346
00:38:13,640 --> 00:38:21,640
broke the policies. But again, that's what it, it, having those policies in place, you're deploying

347
00:38:21,640 --> 00:38:29,640
that and realizing that the rules that applied, we did company wide, but then most of those policies

348
00:38:29,640 --> 00:38:36,520
were really only in the, the accounting and finance teams. They worked the same rules for the support

349
00:38:36,520 --> 00:38:41,800
organization, for the IT organization, for the management team, the layers, the project managers,

350
00:38:41,800 --> 00:38:50,120
and up to the CEO, different rules applied. But we worked all of that out and deployed SharePoint to

351
00:38:50,120 --> 00:39:01,000
help with all of that. I think actually a lot of people hate high fuel cost, but

352
00:39:01,000 --> 00:39:09,240
think more people hate GRC. How can governance compliance and growth become an

353
00:39:09,240 --> 00:39:15,240
aimless extent of a blocker in that company? Well, I think that's, it's kind of what we've been

354
00:39:15,240 --> 00:39:21,160
talking about. You know, if you put the guard rails in place, you have to make sure that people

355
00:39:21,160 --> 00:39:26,360
understand the things that you're doing, you're not just putting bureaucracy in place for the sake of

356
00:39:26,360 --> 00:39:32,680
bureaucracy. If I go, one of my buckliisms, I say this all the time, is the more that you involve

357
00:39:32,680 --> 00:39:38,040
people with the process and the development of the process, the more likely they will support the

358
00:39:38,040 --> 00:39:43,400
process. So if you're doing things in a vacuum, as an IT team, as a leadership team, like we're

359
00:39:43,400 --> 00:39:49,160
locking this down, you can do this, you can't do these things, people rebel against that.

360
00:39:49,160 --> 00:39:55,480
They push back. They're trying to get their work done. But if you go in and explain, look,

361
00:39:55,480 --> 00:40:02,280
we're doing things this way and here's why we're getting fined, tens of thousands of dollars per month,

362
00:40:02,280 --> 00:40:10,200
we have to do it this way here. Then people are like, okay, I understand that. They'll adhere to that.

363
00:40:10,200 --> 00:40:15,560
You still need to guide them, but that's the beginning of your guard rails. What you want to do is you

364
00:40:15,560 --> 00:40:22,280
want to make a lot of those policies in the background, as many of them in the background as possible,

365
00:40:22,280 --> 00:40:27,320
so that you're not confronted. Like, when you had to go in, if you're up, I need to upload, I'm

366
00:40:27,320 --> 00:40:33,080
working on a file for this project and I upload it and there's a huge form, just to upload a word

367
00:40:33,080 --> 00:40:39,880
dock in the SharePoint, and there's a huge form that's asking me to apply metadata and all this

368
00:40:39,880 --> 00:40:46,760
kind of stuff and tag and all this, whatever, like that's broken. If I move the file in and it

369
00:40:46,760 --> 00:40:53,000
automatically applies all the essential metadata because of where I've placed it, that's the right way

370
00:40:53,000 --> 00:40:59,160
to do that. So, yeah, you just have to figure out what are the

371
00:41:00,760 --> 00:41:07,320
you know, hard and fast rules, those are your guard rails, and then lighten up about the majority

372
00:41:07,320 --> 00:41:15,880
of everything else where they don't, the rules don't actually matter. So, I think the risk profile,

373
00:41:15,880 --> 00:41:22,600
it's important to have those discussions, but you're not taking a risk, nobody's collaborating.

374
00:41:22,600 --> 00:41:28,360
My argument is that you have higher risk when you have that lockdown because what are people

375
00:41:28,360 --> 00:41:34,040
doing? They're sending those same files or several versions of it via email,

376
00:41:34,040 --> 00:41:38,280
unsecured, now you have zero control over it. They're putting things in Dropbox or something

377
00:41:38,280 --> 00:41:46,520
that you're not even monitoring. They're using Google Drive. Yeah. Yeah, Shadow IT. Yeah, Shadow IT.

378
00:41:46,520 --> 00:41:53,320
Yeah. What will be your 90-day AI governance action plan look like?

379
00:41:55,480 --> 00:42:06,280
Yeah, that's a great question. I think I mean, I kind of laid out the three steps. I mean, I would go in,

380
00:42:06,280 --> 00:42:15,480
do the assessment, look at the permissions, do your content discovery, who's out there, the permissions,

381
00:42:15,480 --> 00:42:21,240
clean up, put those fundamental guard rails in place. I think all of those things are, I think that,

382
00:42:21,240 --> 00:42:27,880
because the number one thing that you need to work on, you think of AI readiness is the sprawl,

383
00:42:27,880 --> 00:42:35,080
your content sprawl, your SharePoint sprawl. You need to look at your teams, if you're a Microsoft

384
00:42:35,080 --> 00:42:41,640
ecosystem, then teams is heavily used is your team's lifecycle management, all the content that's

385
00:42:41,640 --> 00:42:48,680
being created there. So, that includes your retention policies, your permissions, the compliance

386
00:42:48,680 --> 00:42:56,680
things, all the data classification. And then, on top of all of that is your external sharing.

387
00:42:56,680 --> 00:43:06,040
I think those are the topics that absolutely matter both in the information management side and

388
00:43:06,040 --> 00:43:14,680
the AI management side of things, all of those same rules apply. So, there's a, for organizations

389
00:43:14,680 --> 00:43:18,680
that are thinking, hey, look, we have a hot mess in our hands, like there are, you know, countless

390
00:43:18,680 --> 00:43:26,040
consultants that have good experience. Myself included can go in, help you clean all that up,

391
00:43:26,040 --> 00:43:31,560
get things organized so you can get on the right track and kind of establish those rules.

392
00:43:31,560 --> 00:43:38,440
And though, we all have best practices of governance policies and things and tools and kind of all

393
00:43:38,440 --> 00:43:45,720
of those different things. I mean, AI, you know, the agent world kind of changes some of the stakes

394
00:43:45,720 --> 00:43:50,600
there because you need to do all these same things to your SharePoint environment, to your data.

395
00:43:50,600 --> 00:43:56,440
I wouldn't even say just SharePoint, wherever your data is, those rules apply. You need to do those

396
00:43:56,440 --> 00:44:03,720
things. But now, you're not just storing and retrieving information. You actually have to think about

397
00:44:03,720 --> 00:44:10,440
how they're interpreting information, how they're making their recommendations, coordinating,

398
00:44:10,440 --> 00:44:17,960
like the workflows. It increasingly, you're moving the AI because you want it to take action

399
00:44:17,960 --> 00:44:25,880
against the data. So, if it's taking action against garbage data, you need to clean up your data.

400
00:44:27,080 --> 00:44:36,200
Christian, you are also a sci-fi outdoor. Yes. Well, you can predict the future. What will Microsoft 365

401
00:44:36,200 --> 00:44:44,280
governance look like in five years? Yeah, I have five years. I don't know. How can anybody predict

402
00:44:44,280 --> 00:44:51,000
five years out? I mean, I think even like 18 to 24 months out, they're still going to be dramatic.

403
00:44:51,000 --> 00:44:58,440
I mean, the rate of new that's coming out now is incredible. As an individual, you can't keep up.

404
00:44:58,440 --> 00:45:05,400
You have to watch, listen to podcast, watch shows. I have a list of regular people that I consume

405
00:45:05,400 --> 00:45:11,960
their content just so I feel like I'm keeping up in the areas where I have some degree of expertise.

406
00:45:13,560 --> 00:45:23,400
But I think there's a lot of, I think governance will continue to be a major concern. Again,

407
00:45:23,400 --> 00:45:30,520
as you said, GRC, it's not just governance. It's the risk, it's security around that.

408
00:45:30,520 --> 00:45:37,400
It's why you have a lot of companies that have reclassified themselves is collaboration and

409
00:45:37,400 --> 00:45:45,000
communication over into security. But what is it security for? Collaboration and communication

410
00:45:45,000 --> 00:45:50,840
systems. But yeah, it's an important part of that. I think we're going to see obviously with the,

411
00:45:50,840 --> 00:45:59,160
I think there will be a renaissance of, you know, agentic AI. There will be more and more semi-autonomous.

412
00:45:59,160 --> 00:46:06,760
I'm not quite as sold on fully autonomous. I think human in the loop, it will remain

413
00:46:07,480 --> 00:46:13,320
an imperative for organizations. If you're making plans and like we're just going to cut these

414
00:46:13,320 --> 00:46:19,960
real humans around this, I think it's a huge mistake. There's been articles out there. I was just

415
00:46:19,960 --> 00:46:24,840
reading something out on LinkedIn like a week ago. Maybe you saw this where they're, I wrote about,

416
00:46:24,840 --> 00:46:29,560
I blogged about this like a month and a half ago or something the same topic. So my ears kind of

417
00:46:29,560 --> 00:46:35,640
perked up when I saw this, heard this discussion going on is how junior roles are disappearing.

418
00:46:36,360 --> 00:46:42,280
And they're replacing these junior roles with AI. The mistake then is then there's nobody that's

419
00:46:42,280 --> 00:46:49,720
learning and moving up to become the senior roles. If you cut back to severely, relying on my senior

420
00:46:49,720 --> 00:46:55,960
people to be the glue in between the automation, you're not then developing young talent moving them up.

421
00:46:55,960 --> 00:47:04,040
They'll not have the same skills. They'll be overly, overly reliant on AI and they'll never be the

422
00:47:04,040 --> 00:47:14,280
same senior. Where was it despoiling our water supply? Yeah, the one secret from me,

423
00:47:14,280 --> 00:47:20,760
ice-grade, every linked and profile complete for every talk I do. Yeah.

424
00:47:20,760 --> 00:47:27,000
There's, you know, look, you asked somebody for advice or what their predictions are. I mean,

425
00:47:27,000 --> 00:47:31,480
you're going to get wild things out there. I mean, it's constantly we're being informed by what

426
00:47:31,480 --> 00:47:38,120
changes, what's actually happening on the ground. I think, again, there will be a rapid growth of

427
00:47:38,120 --> 00:47:45,000
like informational agents, those that are going in retrieving and doing these things, advisory

428
00:47:45,000 --> 00:47:54,840
roles of, you know, which are historically like intelligent chatbots, like truly having those.

429
00:47:54,840 --> 00:48:04,600
I think that's fantastic, but all of that requires still humans creating content. And I really believe

430
00:48:04,600 --> 00:48:11,960
that because if you have agent content, consuming agent content, it's this recursive

431
00:48:11,960 --> 00:48:19,480
whirlpool that sinks down the quality degrades rapidly. You need to have that original human thought

432
00:48:20,120 --> 00:48:26,600
in there. So content creators, I think that there's going to be a resurgent of the long form content.

433
00:48:26,600 --> 00:48:33,800
Not just because I'm a blogger because I write a lot. I truly believe that.

434
00:48:33,800 --> 00:48:39,640
So there'll be much more like smaller transactional agents.

435
00:48:39,640 --> 00:48:48,600
And this more of that will be autonomous, but it'll be, again, informational advisory and transactional.

436
00:48:48,600 --> 00:48:55,880
There'll be shorter sprints of AI. And I really think that is the future that we're going to see in

437
00:48:55,880 --> 00:49:02,920
the next three to five years. So we don't have the chance that AI will manage to governance itself.

438
00:49:02,920 --> 00:49:08,040
I don't believe so. I don't believe that'll, again, I just had this argument this morning. I don't

439
00:49:08,040 --> 00:49:14,200
believe that'll ever happen. That starts to get into my religious belief, you know, side of my

440
00:49:14,200 --> 00:49:23,880
persona too, but I just do like it can't create AI can't create life. Like it's it mimics, but it's not

441
00:49:23,880 --> 00:49:29,400
alive and it never will be. And what that actually means from a technology standpoint, it gets a deeper

442
00:49:29,400 --> 00:49:37,800
philosophical discussion, but I really believe that. Like it's, it's, it's, we're going to hit the limits

443
00:49:37,800 --> 00:49:42,120
and better understand the limits here. I think sooner rather than later.

444
00:49:43,160 --> 00:49:46,840
So then that's autonomous AI. It's still a password.

445
00:49:46,840 --> 00:49:55,720
Yeah, it is for now. And what that evolves into, I think it'll just, I would love to see the language

446
00:49:55,720 --> 00:50:02,280
get away from talking about it generically as, you know, AI and AI rendered us and just instead talk

447
00:50:02,280 --> 00:50:06,760
about what are we trying to automate where it gets more about the functional, but what we're doing.

448
00:50:06,760 --> 00:50:10,280
I think that the language needs to evolve and change around it.

449
00:50:12,200 --> 00:50:20,760
Who when you get the chance to say Microsoft one product that I showed long tomorrow, what product will it be?

450
00:50:20,760 --> 00:50:29,560
I think it launch anything. I want them to fix or fix cross product calendaring.

451
00:50:29,560 --> 00:50:37,400
For those of us that have multiple emails and calendars and we're constantly juggling and

452
00:50:37,400 --> 00:50:43,560
I use calendar and you know, the third party tools, which can do part of what I need, but not all of it.

453
00:50:43,560 --> 00:50:50,680
Like I want all of that fixed. I wish they would fix it. My two areas that are my kind of bugaboo,

454
00:50:50,680 --> 00:50:57,000
like I, I've been complaining about it. The other one is task management across the Microsoft ecosystem.

455
00:50:57,000 --> 00:51:04,600
It's still not entirely figured out. It's getting closer. But if you think about between like my tasks

456
00:51:05,240 --> 00:51:15,080
in planner and in teams and to do like they're getting close, but it's still their huge gaps.

457
00:51:15,080 --> 00:51:24,200
But calendaring and task management are my two, like I would love to be on an advisory board

458
00:51:24,200 --> 00:51:27,640
to Microsoft and just do nothing but give them feedback on those two.

459
00:51:27,640 --> 00:51:31,480
Yeah, if you're listening Microsoft. Yeah.

460
00:51:34,360 --> 00:51:41,560
And what is the most underrated Microsoft 365 feature? You see underrated feature.

461
00:51:41,560 --> 00:51:54,520
I mean, there's just so many powerful tools as much as I like I'm not in any way an expert on Excel,

462
00:51:54,520 --> 00:52:00,280
but I'm constantly amazed at some of the depth of what Excel could do. But as far as the

463
00:52:00,280 --> 00:52:07,080
feature and I do, because I do a productivity tips session on a regular basis. And I'm hoping to do one

464
00:52:07,080 --> 00:52:14,360
again in a conference here in the fall. And there's, and then refresh my list. But some of my go to

465
00:52:14,360 --> 00:52:21,560
productivity tips. I know that it's like the most. I mean, there's just a bunch of cool things.

466
00:52:21,560 --> 00:52:29,720
Like, I mean, here's one that I'm like a year ago someone showed me and I'm like, how did I not know

467
00:52:29,720 --> 00:52:34,520
this? Maybe you knew this Marco, but did you know, you know, the four the format brush?

468
00:52:34,520 --> 00:52:41,240
No. You know, in most of the, if you're if you're in editing Excel or word or or powerful,

469
00:52:41,240 --> 00:52:47,080
yes, yes, yes, format. Yeah. And did you know that if you double click on the format brush,

470
00:52:47,080 --> 00:52:53,560
then it holds it. So it's like, if you're changing, oh, this is when he pulls on a page,

471
00:52:53,560 --> 00:52:58,200
you don't have to do it one at a time. You double click and then just making the changes and then

472
00:52:58,200 --> 00:53:04,280
click one more time to undo the the format brush. Like, how did I never know that?

473
00:53:04,280 --> 00:53:10,760
It's kind of like a year ago. It's fantastic. And I use it almost every day now.

474
00:53:10,760 --> 00:53:16,760
It this is, uh, yeah, this is something that's that's called that. Copanico,

475
00:53:16,760 --> 00:53:24,040
do for you. So that's really really cool. Well, I love doing that. I do this like the top 20

476
00:53:24,040 --> 00:53:28,840
productivity tips. When I do that, it conferences, I mean, there's like every seed is taken.

477
00:53:28,840 --> 00:53:35,080
I did it in Vegas last time a year, a year ago. And there were 500 people in the room. It was

478
00:53:35,080 --> 00:53:39,800
standing in a room only. They closed the doors. They wouldn't let more people in there. It was a big,

479
00:53:39,800 --> 00:53:46,360
big room. And it's one of those where I go through 20 different productivity tips. And some things

480
00:53:46,360 --> 00:53:51,400
like that, there's some of the features that are newer, some of them in around for 20 plus years.

481
00:53:51,400 --> 00:53:56,920
But the whole point is that you might know most of them, but there's at least a couple that you've

482
00:53:56,920 --> 00:54:02,360
never seen before and will change your life. And so running through that and I'll have people going

483
00:54:02,360 --> 00:54:07,880
like, heart of this, heart of this. And then suddenly there'll be a gasp from a portion of the

484
00:54:07,880 --> 00:54:12,760
audience. And they're like, you've never seen this. How many show me hands? Who's never seen this

485
00:54:12,760 --> 00:54:18,360
before? Two thirds of the hands go up. I'm like, all right. Let me show you this. I love doing that

486
00:54:18,360 --> 00:54:23,480
session. It's a lot of fun. Yeah. Thank you. I think also for me has changed a lot of

487
00:54:23,480 --> 00:54:29,480
things this talk. I try about to next thing, but I knew after this record. Yeah.

488
00:54:29,480 --> 00:54:34,680
Anybody that's interested, if you go and search on my name, just go out to whatever browser,

489
00:54:34,680 --> 00:54:41,240
search on my name and M365 productivity tips, you'll find multiple sessions and webinars and

490
00:54:41,240 --> 00:54:45,880
things. There's a lot that's out there. You can scan through and look at what the tips are.

491
00:54:45,880 --> 00:54:51,160
You will find a guarantee. You will find some things where you're like, I've never heard of that before.

492
00:54:51,160 --> 00:55:00,120
Oh my gosh. It changes my life. And if there are one book that changed also your life,

493
00:55:00,120 --> 00:55:06,280
that all you can say, this is what, yeah, everyone should read and pick it.

494
00:55:06,280 --> 00:55:13,000
Yeah. I always saw before that, I say like my favorite science fiction book that, you know,

495
00:55:13,000 --> 00:55:17,720
huge. I mean, there's been some fantastic books that I've read like a pilgrim's progress by Paul

496
00:55:17,720 --> 00:55:27,320
Bunyan or John Bunyan. The like a doncahote was impressed upon me as a 15 year old when I read that

497
00:55:27,320 --> 00:55:33,720
love that kind of stuff, but I am a huge orsa Scott Card fan for science fiction. My absolute favorite

498
00:55:33,720 --> 00:55:39,480
if you want something that is moralistic and I'm an incredible science fiction, but just as the

499
00:55:39,480 --> 00:55:48,840
beautifully written book is The Worthing Saga. Love that. From a management perspective, I used to

500
00:55:48,840 --> 00:55:55,400
give it out to all of my direct employees, but there's a book called First Break All the Rules

501
00:55:55,400 --> 00:56:02,760
by Marcus Buckingham, who is with Harvard with I the Gartner. It did this research with hundreds of

502
00:56:02,760 --> 00:56:11,400
companies, and this the to sum it up that book is about managing to people's strengths, so identifying

503
00:56:11,400 --> 00:56:17,160
their strengths and managing to their strengths, and how you do that, and it's just it's just a great

504
00:56:17,160 --> 00:56:24,360
book. The other one that I highly recommend is Eli Goldrats, The Goal, and it's the it's a management

505
00:56:24,360 --> 00:56:31,080
book that was written like a novel, and so it's it's an easy read, but incredibly powerful management

506
00:56:31,080 --> 00:56:40,520
stories in it. From a technology standpoint, I actually, besides reading through guides and stuff,

507
00:56:40,520 --> 00:56:47,800
I don't read tech books. I read like, you know, use products, that's how I learn is by getting my

508
00:56:47,800 --> 00:56:52,760
hands dirty, playing with stuff, and then reading through the support documentation for those things.

509
00:56:54,600 --> 00:57:02,600
So I was just rereading last night a governance ebook that I wrote like seven or eight years ago,

510
00:57:02,600 --> 00:57:11,160
and how much of it is all still on spot on. So, but yeah, those would those would be the reads that I

511
00:57:11,160 --> 00:57:17,640
recommend. I highly recommend the one other book that I recommend and I used to give out to employees.

512
00:57:18,760 --> 00:57:26,760
Like I'm a big fan of Seth Godin, the purple cow is excellent, but the my favorite is all marketers

513
00:57:26,760 --> 00:57:31,640
or liars, which is great because I'm, you know, I'm marketing degree. So,

514
00:57:31,640 --> 00:57:40,040
but it's about it's, they're all about authenticity and the messaging and authentic using authentic

515
00:57:40,040 --> 00:57:45,320
voice and authentic messaging and what that means. So, I mean, just great books for,

516
00:57:46,840 --> 00:57:53,320
you know, leadership development, management books, rather than technology, but honestly, most

517
00:57:53,320 --> 00:57:59,560
technology people could strengthen their soft skills. I think those would be great books, those

518
00:57:59,560 --> 00:58:07,320
books would be great to start with. Yeah, they're, I think they're really, really good books out there.

519
00:58:07,320 --> 00:58:16,120
Yeah, so we, oh, we were running out of time. So, yeah, then my, my last, my closing question,

520
00:58:16,120 --> 00:58:23,800
if you could give one piece of advice to every Microsoft 365 admin preparing for the

521
00:58:23,800 --> 00:58:27,160
future of AI, what would be?

522
00:58:27,160 --> 00:58:36,120
Yeah, there's a, I mean, there's, yeah, there's so many aspects of that. It's the,

523
00:58:36,120 --> 00:58:44,680
just remember that the relationships that you have in your organization are more important

524
00:58:44,680 --> 00:58:51,320
than the rules and the policies and the structure. And so, by having conversations, which is sometimes

525
00:58:51,320 --> 00:58:57,800
harder to do, and that's why I said every tech person could use some development time of their

526
00:58:57,800 --> 00:59:08,680
soft skills. To better understand what it is that your leadership team and your end users are trying

527
00:59:08,680 --> 00:59:17,560
to accomplish with the technology, that will help you help guide you in the right technical

528
00:59:17,560 --> 00:59:25,240
solutions to provide and, and, and, and how to enforce the rules, the policies, the, the guard

529
00:59:25,240 --> 00:59:31,320
rails that you put around them. So, don't, don't go into it. You can't, you can't do these things in

530
00:59:31,320 --> 00:59:36,680
a vacuum. You need to be having conversations with people. And I would even argue, I used to do it.

531
00:59:36,680 --> 00:59:42,680
I may, my management style is I'm a managed by walk around guy. Like I sit and report, I can chat with

532
00:59:42,680 --> 00:59:49,880
people, but I prefer to get up when back when we were in the office space to walk around and talk

533
00:59:49,880 --> 00:59:54,280
to people like what's going on? What are your frustrations here? What else can I do? Is there a thing I

534
00:59:54,280 --> 01:00:01,960
can help with? How can I unblock you from what you need to accomplish this day? And have those

535
01:00:01,960 --> 01:00:09,560
conversations? If you're not having that level of conversation with your direct reports, but also

536
01:00:09,560 --> 01:00:18,200
with your customers, no matter what your role is, then I think you're failing. Awesome. So, thank you

537
01:00:18,200 --> 01:00:23,720
so much for, for being here. This was really, I really enjoyed it. This was a lot of fun and I have

538
01:00:24,600 --> 01:00:32,840
direct yogurt. Yeah. It's always great to be able to sit here and talk and answer questions

539
01:00:32,840 --> 01:00:38,040
rather than ask all the questions and listen all the time, but I know. I really appreciate

540
01:00:38,040 --> 01:00:43,400
the opportunity. Yeah. Thank you so much. I really enjoyed it. It was really fun to talk to you.

541
01:00:43,400 --> 01:00:50,920
And yeah, thank you so much for your time. This great being here. Yeah. Bye. Bye.

542
01:00:50,920 --> 01:01:11,920
Thanks for watching.

Mirko Peters

Founder of m365.fm, m365.show and m365con.net

Mirko Peters is a Microsoft 365 expert, content creator, and founder of m365.fm, a platform dedicated to sharing practical insights on modern workplace technologies. His work focuses on Microsoft 365 governance, security, collaboration, and real-world implementation strategies.

Through his podcast and written content, Mirko provides hands-on guidance for IT professionals, architects, and business leaders navigating the complexities of Microsoft 365. He is known for translating complex topics into clear, actionable advice, often highlighting common mistakes and overlooked risks in real-world environments.

With a strong emphasis on community contribution and knowledge sharing, Mirko is actively building a platform that connects experts, shares experiences, and helps organizations get the most out of their Microsoft 365 investments.

Christian Buckley

MVP, RD, Author, Podcaster

Christian is an award-winning product marketer and technology evangelist, a Microsoft Most Valuable Professional (MVP) and Regional Director (RD,) and an expert in collaboration, AI, workplace productivity, and governance. Christian's 30-year tech career has included Chief Marketing Officer and Chief Evangelist for several leading SharePoint ISVs, and he was part of the Microsoft team that launched SharePoint Online and Office 365. He has worked with some of the world’s largest technology companies to build and deploy social, collaboration, and supply chain solutions, and sold his first software startup to Rational Software in 2001. Co-author of books on both SharePoint and software configuration management (SCM) and one science fiction novel (The Circuit Dominion), Christian is one of the most widely published names within the Microsoft ecosystem, and can be found online at www.buckleyplanet.com and @buckleyplanet

Your Governance Policies Were Not Built for AI with Christian Buckley [MVP]