Microsoft estates grow by adoption rather than by design. Licences are extended, workloads move to Azure, Teams and SharePoint fill with content, and Power Platform apps appear across the business because the tooling makes that easy — which is a genuine strength and an accumulating liability at the same time.
What ties these together, and what most improvement programmes eventually collide with, is identity. Conditional access, privileged roles, guest access, service principals and permission inheritance determine what is actually possible in every one of those workloads, and in most estates that model has drifted well away from what anyone would design deliberately.