M365 Governance Lessons from Microsoft 365 Ottawa 2026

Microsoft 365 has become central to how organizations collaborate, manage information, and adopt AI. But as these environments grow, an important question becomes harder to answer: how can organizations give people the tools they need while keeping their data and access secure? 

Peter Baddeley, Director of GTM Sales & Client Solutions at SnapOn Software, explored that question at Microsoft 365 Ottawa 2026 in his session, How ISO 27001 Transformed the Way I Think About Microsoft 365. 

The journey began in November 2021, when ProvisionPoint, now part of SnapOn Software, started building its information security program. The organization achieved ISO 27001 certification in March 2024 and was recertified as SnapOn Software in September 2026. Along the way, our approach to Microsoft 365 changed. Instead of asking only, "What can this feature do?" we began asking, "What risks come with using it?" 

We also learned that ISO 27001 is not simply about passing an audit, locking things down, or reaching a finish line. It is about understanding risk, putting the right protections in place, and continually looking for ways to improve. 

The potential impact of poor security and data management can be significant. Regulations including GDPR, Quebec's Law 25, and the EU AI Act continue to raise the importance of protecting information and managing technology responsibly. Recent security and technology incidents also demonstrate how quickly problems with data, access, and AI can have real-world consequences. 

Here are five key Microsoft 365 governance lessons from the session. 

1. Every Microsoft 365 decision comes with risk 

A strong governance approach means looking beyond what a feature can do and considering what could go wrong, how likely it is to happen, and how serious the impact could be. 

Consider three everyday Microsoft 365 scenarios: 

• External sharing: sensitive information could be shared with the wrong person. 
• Enabling Copilot: older or poorly managed information could lead to inaccurate results. 
• Workspace creation: different teams could create workspaces with inconsistent names, settings, or security. 

Risk does not only come from new features. Changes to settings, policies, teams, business processes, and the wider business environment can all affect an organization's security. 

At SnapOn Software, we make risk part of the change process and track it through a formal risk register. Our register currently includes 50 risks, with 41 being actively addressed and 9 intentionally accepted. We also track incidents, actions taken to address problems, and third-party suppliers. 

2. Security is everyone's responsibility 

Security is not only an IT responsibility. Everyone who works with company information has a role to play, including leadership, data owners, and site owners. 

That is why security awareness needs to be an ongoing process rather than a one-time training session. At SnapOn Software, our program includes: 

• AI acceptable use training 
• New starter training 
• Annual refresher training 
• Role-based training 
• Policy awareness campaigns 

Training also needs to be tested in practice. Phishing simulations, knowledge assessments, tabletop exercises, and internal audits help identify where additional education may be needed. 

Building a strong security culture means making information security part of everyday decision-making across the organization. 

3. Know who has access, and why 

Sharing information in Microsoft 365 can take seconds, but access can remain in place for much longer. Over time, employees can accumulate access to sites, files, and other information they no longer need. 

Regular access reviews help organizations understand who can access information and whether that access is still appropriate. 

Data classification is another important part of this process. At SnapOn Software, we use three sensitivity labels: Public, Internal, and Confidential. Legal, HR, finance, and client information are generally treated as Confidential, operational information as Internal, and sales and marketing information as Public. 

The goal is not to restrict access unnecessarily. It is to make sure information receives the right level of protection based on its sensitivity and business needs. 

4. AI will make data management more important 

Microsoft Copilot does not create poor data management, but it can make existing problems much easier to see. 

Information that is poorly organized, incorrectly classified, or kept longer than necessary can become easier to find when AI tools are introduced. Informal boundaries do not necessarily protect information either. If a user has access to a file, AI may be able to use that information when responding to a request. 

AI also introduces new considerations around how employees use and share information. Inappropriate use of AI can create security and privacy risks, even when there is no traditional data breach. 

For organizations introducing Copilot, data management and access reviews should be part of the preparation process. AI readiness starts with understanding the information that AI will be able to access. 

5. Treat governance as an ongoing process 

Achieving ISO 27001 certification is not the end of the process. Our approach is simple: progress over perfection. 

SnapOn Software's latest audit found zero major and zero minor issues, along with five observations for improvement. These observations provide opportunities to strengthen our processes even when there are no major problems to address. 

The same principle applies to Microsoft 365. Organizations should regularly review their environment and measure their progress. Regulations change, Microsoft 365 continues to evolve, and new technologies such as Copilot introduce new considerations. Good governance needs to evolve with them. 

Governance should enable innovation 

Good governance is not about restricting access to Microsoft 365 features or preventing people from using them. It is about understanding the risks involved and putting the right controls in place so organizations can use Microsoft 365 securely and confidently. 

When Microsoft 365 is well governed, external sharing can support secure collaboration, Copilot can help employees find information and work more efficiently, and self-service workspaces can reduce the workload on IT. 

At SnapOn Software, we view governance as an opportunity to help organizations get more from Microsoft 365 while maintaining the security, visibility, and control needed to manage risk. Understanding the environment, reviewing access, protecting data, and continuously improving governance creates a stronger foundation for collaboration and innovation. Tools like ProvisionPoint help support this by giving organizations greater control and visibility over how Microsoft 365 workspaces are created, managed, and governed.