Your IT team is being asked to do something structurally impossible.
Your IT Director is firefighting endpoints, identity, Teams governance and security incidents all at once. The perimeter now includes every device, identity, SaaS app and BYOD phone, and you are paying several vendors for overlapping services with no one owning the user experience. Copilot licences were bought and nothing changed. And cyber insurers and supply-chain questionnaires are asking for evidence of controls you cannot currently produce.