Episode Details

(00:00:00) The Embodied Lie in AI Governance
(00:00:24) The Illusion of Control in Voice Assistants
(00:04:26) The Two Timelines of AI Systems
(00:07:40) Microsoft's Partial Progress in AI Governance
(00:11:13) The Missing Link: Deterministic Policy Gates
(00:14:53) Case Study 1: The Wrong Site Deletion
(00:18:49) Case Study 2: Inadvertent Disclosure in Meetings
(00:23:03) Case Study 3: External Agents and Internal Data Exposure
(00:27:23) The Event-Driven System Fallacy
(00:27:26) The Misunderstanding of Protocol Standards

In this episode of m365.fm, Mirko Peters breaks down one of the most critical and most underestimated problems in Microsoft 365 security: the permission problem. Who actually has access to your Microsoft 365 data? Who has power over your workspaces, your SharePoint sites, your Teams channels, your OneDrive files? In most organizations, the honest answer is: nobody really knows.

THIS EPISODE IS ESSENTIAL FOR MICROSOFT 365 SECURITY LEADERS

This episode is essential for Microsoft 365 security architects, IT compliance teams, CISOs, and any organization that needs to understand and control who has access to their Microsoft 365 environment. If you are responsible for Microsoft 365 security, governance, or compliance, this conversation will fundamentally change how you think about permission management and access risk inside Microsoft 365.

WHAT YOU WILL LEARN

• Why the Microsoft 365 permission problem is the root cause behind many security incidents and data exposure cases
• How permission sprawl develops silently across Teams, SharePoint, and OneDrive, and why it is so hard to roll back once it exists
• Why reactive access management and ad‑hoc permissions create compounding security risk in Microsoft 365 over time
• How external sharing and guest access in Microsoft Teams and SharePoint create hidden exposure far beyond what most reports show
• Why regular Microsoft 365 access reviews are not optional in a compliant environment
• How to design a permission governance model that actually works at enterprise scale
• What “ownership” means inside Microsoft 365 and why it must be explicit, not assumed

THE CORE INSIGHT

Most organizations approach Microsoft 365 security by investing in technology and configuration. They add Defender, configure Conditional Access, and enable MFA, but never consistently ask the most important question: who actually has access to what, and should they? Permissions in Microsoft 365 accumulate over time with every new Team, site, and workspace, and very few organizations have processes that reliably remove access when it is no longer needed. The result is permission sprawl – not as a failure of Microsoft 365 itself, but as a failure of governance and process design.

WHY PERMISSION GOVERNANCE COMES BEFORE SECURITY TOOLS

Microsoft 365 security starts with understanding that permissions are not a purely technical problem. They are a governance and ownership problem. Every workspace needs a defined owner, every access decision needs a lifecycle, and every external sharing action needs explicit accountability. Without these foundations, no security tool – however advanced – will protect you from accumulated access risk.

WHO THIS EPISODE IS FOR

• Microsoft 365 security architects and consultants
• IT compliance teams and CISOs managing Microsoft 365 environments
• Organizations preparing for Microsoft 365 security audits or compliance reviews
• Governance and risk management teams working with Microsoft 365
• Anyone responsible for Microsoft 365 access management, guest policies, or data protection

ABOUT THE HOSTMirko Peters is a Microsoft 365 expert, architect, and host of m365.fm. He works with organizations from small businesses to large enterprises on