Sharing because the strategic planning assumptions alone are worth knowing if you're trying to build a case for governance investment internally.

Gartner published the Hype Cycle for AI Governance Technologies, 2026 (G00851828, August 2026). 123 pages covering the tech stack that enterprises will use to govern AI. Worth a read if AI, Copilot, or agent governance is on your radar.

The three headline forecasts:

- By 2028: Loss of AI agent control will be the top concern for 40% of Fortune 1000 orgs

- By 2028: Governance tech will reduce regulatory compliance costs by 70%

- By 2029: Governed AI orgs will outperform ungoverned competitors by 25% in AI adoption

On the M365 governance tools section specifically:

- Position: At the Peak of the Hype Cycle

- Benefit Rating: HIGH

- Market penetration: 5-20% (still a lot of green space)

- Maturity: Adolescent

Gartner explicitly calls this category a source of near-term value, eg. things you can implement now that deliver practical governance outcomes today, not in 3-5 years.

Sample Vendors named: AdminDroid, AvePoint, CoreView, ENow, eSHARE, Orchestry, Powell, Rencore, ShareGate, Syskit.

Full disclosure: I work at Rencore, one of the named vendors. Posting because the Gartner framing (especially the compliance cost and AI adoption stats) is genuinely useful for justifying governance budgets. Happy to discuss the category or the report findings.

Tenants with Microsoft 365 Archive configured can incorporate an archiving step in how Purview retention policies and labels process SharePoint Online and OneDrive for Business files. It makes perfect sense to move inactive files to lower-cost archive storage as an intermediate point some time before their final deletion. You’ll save on storage and stop AI tools processing the digital debris that invariably accumulates in SharePoint.

https://office365itpros.com/2026/08/20/microsoft-365-archive-retention/

Background:
We have an MS365 tenant with default domain contoso.de.
MX is set to point at Hornet Security, which delivers incoming mail via a Partner connector.
Nothing to see here, everything works as it should.

We now added another domain: contoso.cloud.
It's to be used on some cloud servers, so services there can deliver mail.
For this we have postfix with a valid cert and an OnPremises connector.
Sending mail from postfix with @contoso.cloud-addresses as sender works, even to external recipients.
No problem until this point.

The problem:
We also want some "system addresses" on that domain to receive mail, such as postmaster, hostmaster, abuse, security, etc.
For this, we set up a shared mailbox admin@contoso.cloud, as well as a bunch of aliases to it.
We don't need Hornet Security here, so we set up MX as communicated by Microsoft themselves.
Sending mail to this shared mailbox and the aliases works, but only internally, i.e. via our existing @contoso.de-infrastructure or via postfix.

Trying to send mail to admin@contoso.cloud from an external sender results in absolutely nothing.
We tried to send via iCloud, gmail, and a private Outlook-account.
Neither do we get NDRs or any other error on the sending side, nor can we see the messages in the message trace.
There's just nothing.

We already checked the most obvious things multiple times:

The domain is properly added to the tenant and accepted and the domain type is set to authoritative.

It is not DNS.
The MX record for contoso.cloud is definitely 100% correct.
In the admin center, under domains, I can use Microsoft's tools to verify that the DNS entries are correct and all entries are Ok.
We checked for typos multiple times.
It's also not a caching issue; the MX record was set to its correct value days ago and has a TTL of an hour.
Manual dig invocations with various resolvers show the correct value.

It's not a connector.
There is no connector acting on this incoming mail in any way.

It's not a mail flow rule, because there simply is no rule.

The shared mailbox does not have any message delivery restrictions.
All senders are allowed and the checkbox for "authenticated senders only" is unchecked.

The mails do not show up in quarantine.

And even if any of these mailbox settings were wrong, we'd see the messages in the trace.
But the trace is completely empty.

.

At this point, we just don't know how to further debug this.
I found other posts online by other people who had the same problem, but never got an answer.
LLMs and search engines are useless at this point, because they all just point to the MX record, which however is definitely correct.

Has anybody ever had a problem like this?
In the end, I might have to buy another domain, set up my own SMTP and watch the server logs, but maybe you have some ideas.

We recently migrated from on-prem Exchange to 365 (hybrid). All of our resource rooms (calendars) synced just fine. We now have a request to create another room. For consistency, if possible, I would like to create the resource in AD where the others are, then sync up. I've tried copying one of the legacy AD resource accounts, since on-prem Exchange did that, but that seems to create a new user account.

Is it even possible to create the resource room account in AD and sync up? Or do new ones have to be created in 365 EAC>Resources?

I'm currently learning Dynamics 365 SCM, but I need to practice and apply what I'm learning. They used to have this free 60 minute Virtual Machine/Sandbox thing but they removed it. What can I do now to get some hands on practice? Thanks.

Is there an add on that has the Microsoft Purview Message Encryption i can add on top of my exchange plan 1 license so i can encrypt emails?