Shadow AI is the use of AI assistants, AI websites and AI agents that IT has not approved, often with personal accounts and company data. Microsoft security and compliance tools can find much of it, depending on your licences. Reducing it takes more than a block list: an approved option people prefer, clear data rules and short training.
People rarely turn to an unapproved AI tool to cause harm. They want a faster draft, a summary or a second opinion, and the tool their employer offers is missing, hard to reach or unknown to them. Treat shadow AI as a signal of demand as much as a risk.
This guide follows five steps: find, decide, offer, protect and train. When the approved option includes ChatGPT Enterprise or Claude Enterprise, our page on ChatGPT and Claude governance from your Microsoft 365 tenant shows how those workspaces are governed next to Microsoft Copilot (formerly Microsoft 365 Copilot).
What counts as shadow AI?
Shadow AI covers any AI tool that handles company data without an approval, an owner or a record. In a Microsoft 365 tenant, it usually takes five forms:
- Personal accounts on consumer AI sites, such as the free versions of ChatGPT or Claude
- Team subscriptions paid by card, with accounts that live outside your directory
- AI apps that people connect to their mailbox or files by giving consent themselves
- Desktop assistants and coding agents installed on laptops, outside any software catalogue
- Agents and connectors built inside Microsoft 365 that nobody has reviewed
Text pasted into a consumer site leaves the tenant, often with no record of what went or who sent it. Accounts created outside Microsoft Entra ID survive a leaver's departure. And nobody can tell an auditor which AI tools process customer data.
Why does blocking shadow AI alone not work?
Blocking only reaches the devices and networks you manage. In Microsoft Defender for Cloud Apps, marking an AI app as unsanctioned blocks it on devices protected by Microsoft Defender for Endpoint, or shows a warning instead if you prefer, as Microsoft explains in governing discovered apps with Defender for Endpoint. Blocking this way needs Microsoft Defender for Cloud Apps and Microsoft Defender for Endpoint licences, or Microsoft 365 E5.
Microsoft's own guidance on data leaks to shadow AI states the limit plainly: people can still reach a blocked AI app from a personal device.
A block list on its own moves the use rather than ending it: the same draft simply gets written on a phone. Block what you must, once people have somewhere better to go.
How do you find which AI apps people use?
Start with the data Microsoft tools already collect, then add what only people can tell you.
1. Filter cloud discovery on generative AI
Microsoft Defender for Cloud Apps can list the generative AI apps people use. Its cloud app catalogue has a Generative AI category: filter your discovered apps on it, and set an alert policy for any new generative AI app that appears, as described in managing generative AI apps in Microsoft 365. Apps in the catalogue carry a risk score, which gives your first review a sensible order.
2. Add Microsoft Purview for AI sites
Microsoft Purview Data Security Posture Management (DSPM) can show which AI sites people visit and when sensitive data goes into them, once devices are onboarded, the browser extension is installed and pay-as-you-go billing is enabled (see Purview for other AI apps). Plan the onboarding with your endpoint team before anyone is promised a report.
3. Review apps connected through user consent
Some AI tools never need a website: they reach Microsoft 365 through an app a user approved. In Microsoft Entra ID, admins can block or limit user consent to apps, and people can ask for admin approval instead. Settle this early: the next AI connector then becomes a request you can decide on.
4. Look for AI agents on laptops
Microsoft Defender for Endpoint can find AI agents installed on employees' computers, as Microsoft documents in local AI agent discovery. Discovery needs Defender for Endpoint Plan 2, which Microsoft 365 E5 includes; risk ratings for these agents, and blocking unapproved ones through Intune, need Agent 365 or Microsoft 365 E7. Our article on Microsoft Agent 365 and what it covers explains the registry and who needs a licence.
5. Ask people, and keep the answers
Tools see traffic, not motives. A short survey or a few conversations with heavy users show which tasks drive the use, and that shapes the approved option. Keep the results in an AI inventory. The EU AI Act does not require a formal AI inventory, but keeping one is the practical way to know which tools are used and who needs training.
How do you decide which AI tools to allow?
Decide by situation, not by brand. The same assistant can be fine for rewording a public web page and wrong for a customer file. The table gives starting decisions; adjust them with your security, legal and data protection teams.
Shadow AI situations and starting decisions
Generic examples, to adapt to your licences.
| Situation | Risk | Decision | Control |
|---|---|---|---|
| Staff paste customer data into a consumer AI site with a personal account | Data leaves the tenant without a record, and sensitivity labels do not apply on the site | Not allowed for company data; people are pointed to the approved assistant | App marked unsanctioned or monitored in Defender for Cloud Apps; endpoint DLP or Edge for Business rules on paste and upload |
| A team pays for its own ChatGPT or Claude plan by card | Accounts sit outside your directory, and leavers keep access | Move the team to an approved enterprise plan, or to Microsoft Copilot | Single sign-on and SCIM from Microsoft Entra ID on ChatGPT Enterprise or Claude Enterprise |
| Someone connects an AI app to their mailbox or OneDrive | The app keeps standing access to company files | Admin approval before any connection | User consent limited in Entra ID, admin consent workflow, and Assignment required on the app |
| People use a public AI tool to reword text that is already public | Low, as long as no internal data goes in | Allowed, within the data rules of your AI policy | Monitored tag with a warning, plus training |
| A developer installs a desktop AI agent | The agent acts on local files and code | An approved list of agents, decided tool by tool | Local AI agent discovery in Microsoft Defender for Endpoint; blocking through Intune with Agent 365 or E7 |
| A maker connects a Copilot Studio agent to an unapproved service | Company data flows to a service nobody has assessed | Review before the agent is shared | Power Platform data policies on connectors and knowledge sources |
Shadow AI is not only outside the tenant: in the Power Platform admin center, data policies for Copilot Studio control which connectors and knowledge sources agents may use.
What should the approved AI option look like?
The approved option has to be easier than the unapproved one. For most Microsoft 365 organisations, it starts in the tenant. Copilot Chat is included for work accounts on eligible plans, and Copilot grounded in your work data needs a Microsoft Copilot licence, as Microsoft explains in managing Microsoft Copilot. Copilot only shows people content they can already open, according to Microsoft Copilot privacy, so overshared content becomes easier to find: tidy permissions before you widen access.
Teams that ask for ChatGPT or Claude can have them on the enterprise plans. ChatGPT Enterprise supports domain verification, single sign-on and SCIM from Microsoft Entra ID, with custom roles for synced groups. Claude Enterprise supports single sign-on and SCIM directory sync from Microsoft Entra ID, with roles mapped to your groups.
Before you name a tool as approved, check it against this list:
- People sign in with their Microsoft Entra ID account, not a personal one.
- Accounts are created and removed from your directory, so leavers lose access with everything else.
- Connectors to Microsoft 365 go through admin consent. Claude's Microsoft 365 connector needs one-time Global Administrator consent, and ChatGPT's SharePoint app needs admin consent in Microsoft Entra ID.
- Sharing is under your rules: in ChatGPT Enterprise, roles decide who can use, share and publish plugins, and admins choose which plugins the workspace offers.
- Activity can be kept as long as you need it. On ChatGPT Enterprise, compliance logs stay available for 30 days, so they need exporting continuously. On Claude Enterprise, the Compliance API lets your tools read activity logs, chats and files.
- The tool has a named owner and a budget, and it appears in your GDPR record of processing activities, since processing through AI assistants belongs there.
Microsoft Purview is adding connectors that bring ChatGPT Enterprise and Claude Enterprise prompts and responses into audit, eDiscovery and retention, as described for ChatGPT Enterprise in Purview and Claude Enterprise in Purview.
How do you keep sensitive data out of unapproved AI tools?
Protect the data at the point where it leaves: the browser and the device. Sensitivity labels are not supported on third-party AI sites, so the controls sit in app tags and data loss prevention.
- App tags. Mark the AI apps you do not allow as unsanctioned in Defender for Cloud Apps, or as monitored when a warning is enough.
- Endpoint DLP. On onboarded Windows devices, Microsoft Purview endpoint DLP can warn or block when someone pastes or uploads sensitive data to an AI site.
- Edge for Business. Microsoft Edge for Business can block sensitive text or files from being sent to consumer AI apps, the consumer version of ChatGPT among them, on Intune-managed Windows devices. This protection is billed pay-as-you-go (see data loss prevention in Edge for Business).
- Other browsers. A Microsoft Purview browser extension extends these controls to Google Chrome; check the current Chrome documentation before you plan on it.
Start in warning mode where you can. A warning, backed by a message that names the approved tool, teaches more than a silent block, and gives you time to adjust the rule before you tighten it.
What should your AI rules and training say?
A generative AI policy works when people can remember it. One page is enough:
- Which AI tools are approved, and for what kind of work
- Which data never goes into any AI tool that is not approved, with two or three plain examples
- How to ask for a new tool or connector, and who answers
- That AI answers are checked before they reach a customer or a regulator
- How to report a mistake, such as a file pasted into the wrong tool, without fear of blame
Training carries the policy. AI literacy obligations have applied since 2 February 2025. The EU amended the AI Act in July 2026 (the "AI Omnibus"), and organisations using AI are expected to take measures that support AI literacy among their staff, as the European Commission's note on the AI Omnibus confirms. Short sessions that show the approved tools on real tasks can do more for shadow AI than a block list. Our article on an AI governance framework for Microsoft 365 places these rules within the wider set of owners, records and reviews.
How Neptune helps
Neptune is an integrator. We select the tools that fit your tenant and your licences, put them in place with your team, train your admins and support you once they run.
Finding AI websites and stopping sensitive data on its way out are security controls: Microsoft Defender for Cloud Apps and Microsoft Purview, owned and run by your security team. Our work is governance, and it complements theirs. In Microsoft Entra ID, we review user consent and assignment settings with your security team, so an AI app reaches Microsoft 365 only after an administrator approves it, and only for the users and groups you assign (access management for apps). In the Power Platform admin center, we configure the data policies that decide which connectors and knowledge sources agents may use.
The governance tool we put in place covers what sits inside and around Microsoft 365. Agents built in Copilot Studio and from SharePoint sites are listed with their owner, their audience and the connectors they use, and agents without an owner or shared too widely are sent for review. Apps with standing access to SharePoint are listed with the permissions they hold, the ChatGPT and Claude connectors among them. For ChatGPT Enterprise and Claude Enterprise, every account is matched to Microsoft Entra ID, projects are listed with their owner and audience, workspace agents and plugins are listed too, and seats and spend are read next to Copilot. The tool works from metadata, not from the text of conversations.
Rules start in report mode, owners are asked before anything changes, and each decision is recorded. See our approach to AI governance in Microsoft 365 for agents and Copilot.
Sources
- Microsoft Learn: Govern discovered apps using Microsoft Defender for Endpoint
- Microsoft Learn: Step 2: Block access to unsanctioned AI apps, Prevent data leak to shadow AI
- Microsoft Learn: Manage generative AI apps for your organization
- Microsoft Learn: Cloud app catalog and risk scores
- Microsoft Learn: Use Microsoft Purview to manage data security & compliance for other AI apps
- Microsoft Learn: Configure how users consent to applications
- Microsoft Learn: Local AI agent discovery with Microsoft Defender for Endpoint
- Microsoft Learn: Discover local AI agents with Microsoft Defender for Endpoint
- Microsoft Learn: Configure data policies for agents
- Microsoft Learn: Manage Microsoft Copilot Chat
- Microsoft Learn: Data, privacy, and security for Microsoft Copilot
- Microsoft Learn: Learn about Endpoint data loss prevention
- Microsoft Learn: Learn about Data Loss Prevention for Cloud Apps in Edge for Business
- Microsoft Learn: Microsoft Purview and Google Chrome
- Microsoft Learn: Use Microsoft Purview to manage data security & compliance for ChatGPT Enterprise
- Microsoft Learn: Use Microsoft Purview to manage data security & compliance for Anthropic Claude (Enterprise)
- Microsoft Learn: Manage access to apps
- OpenAI Help Center: SCIM provisioning and management
- OpenAI Help Center: Single sign-on (SSO) setup for OpenAI products
- OpenAI Help Center: OpenAI Compliance Platform for Enterprise and Edu customers
- OpenAI Help Center: Admin controls, security, and compliance for plugins and apps
- OpenAI Help Center: SharePoint app in ChatGPT
- Claude Help Center: Set up JIT or SCIM provisioning
- Claude Help Center: Access the Compliance API
- Claude Help Center: Set up the Microsoft 365 connector
- EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- European Commission: AI Omnibus enters into force
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
