Microsoft Investing Little on AI in Its Own Management Services

• Although Microsoft promotes AI, including upsells in the form of Copilots, Azure AI, and the Microsoft 365 E7 suite, the company remains cautious in terms of AI investments within its own hosted governance, risk, and compliance (GRC) services.
• All signs continue to point to customers increasingly being required to use and pay for Security Copilot and its consumption-based licensing.
• Organizations should carefully analyze the ROI of this Security Copilot–based infrastructure over time to ensure the benefits outweigh the added costs.
• Microsoft’s limited investment in AI within its GRC services provides a useful indicator that AI needs to be scrutinized, particularly when it comes to critical management and infrastructure roles.

The set of compliance, identity, security, and management services included in Microsoft 365 are intended to help organizations achieve their governance, risk, and compliance (GRC) objectives, as well as identity and device management needs. Although Microsoft aggressively promotes its AI technologies like Copilots to customers, Microsoft’s investments to deeply integrate AI technology into the Microsoft 365 GRC services have been limited. In addition, these AI investments seem to have decreased over the last 12 months, and Microsoft’s messaging promoting Security Copilot has generally become less bold than when the tool was first announced. However, Security Copilot effectively remains the sole AI investment across Microsoft’s management tools and now underpins numerous AI-accelerated tasks across Microsoft’s Defender, Purview, Entra, and Intune services, among others.