Microsoft 365 security failures are often blamed on a missing control, or feature, these matter, but they are rarely the root cause - the lack of governance is!