ChatGPT Enterprise and Claude Enterprise governance, from your Microsoft 365 tenant
ChatGPT Enterprise governance, like Claude Enterprise governance, means knowing who holds a seat, what each workspace shares and connects to, and what it costs, with each account matched to Microsoft Entra ID. Both are bought outside Microsoft 365 but can connect to SharePoint, so we govern them from your tenant, next to Microsoft Copilot (formerly Microsoft 365 Copilot).
AI assistants overview
- People on two or more assistants
- 172
- Custom GPTs
- 138
- Claude projects
- 265
- Apps with access to SharePoint
- 3
Seats and activity
| Assistant | Seats | Active, 30 days |
|---|---|---|
| Microsoft Copilot | 1,850 | 1,320 |
| ChatGPT Enterprise | 640 | 505 |
| Claude Enterprise | 290 | 226 |
Top findings
- High 10
- Medium 14
- Disabled in Entra ID, still has access 9 High
- Connector reaching every SharePoint site 1 High
- GPT shared with the whole workspace 14 Medium
Example data, for illustration only
The risks
Why ChatGPT and Claude need governing too
Both assistants are bought outside Microsoft 365, yet they rely on your people and, often, on your files. Five gaps tend to show up.
-
Accounts outside your directory
Each workspace keeps its own members, admins and roles. If nobody ties them to Microsoft Entra ID, a leaver can keep a seat, and no one can say which department a user belongs to.
-
Connectors into Microsoft 365
ChatGPT can sync SharePoint sites, and Claude can reach SharePoint, OneDrive, Outlook and Teams. Once an administrator consents, that reach is rarely looked at again.
-
GPTs and projects shared widely
Custom GPTs and projects get shared with colleagues, sometimes with the whole organisation, and outlive the work they were made for. Few have an end date or a regular review.
-
A short audit trail
ChatGPT Enterprise keeps its compliance logs for 30 days. A question from audit about last quarter needs a history that someone exported and kept.
-
Spend across three bills
Copilot, ChatGPT and Claude are often bought by different teams. One person can hold all three, and Claude usage is billed on top of the seat, so costs grow without an owner.
What we put in place
What does ChatGPT and Claude governance cover?
Five controls, run on a schedule by the governance tool that also covers Microsoft Copilot. We select it, put it in place and support it with your team.
One identity
Every ChatGPT and Claude account is matched to a person in Entra ID.
Each ChatGPT Enterprise and Claude Enterprise user is matched to their Microsoft Entra ID account, with department and country. Accounts that are disabled in Entra ID yet keep a seat are flagged, and seats, use and spend are read by department instead of by email address.
What it covers
- ChatGPT Enterprise and Claude Enterprise users
- Department and country from Entra ID attributes
- Accounts disabled in Entra ID that keep access
- Admins and owners of each workspace
- Single sign-on enforcement in Claude Enterprise
How we deliver it
- Your workspace owners enable each Compliance API for the tool.
- We check the match with Entra ID together with your identity team.
- Leavers are routed to your existing offboarding process.
Accounts matched to Entra ID
- Matched, active in Entra ID 901
- No Entra ID match 20
- Disabled in Entra ID, still has access 9
GPTs and projects
Every custom GPT and project is listed, with its owner and its audience.
One list holds the custom GPTs, projects and workspace agents in ChatGPT Enterprise and the projects in Claude Enterprise. For each one you see who made it, who it is shared with, which sources it reads and when it last changed. Codex tasks are listed with the repositories they reach.
What it covers
- Custom GPTs, with owner and sharing settings
- ChatGPT projects and the apps they connect to
- Claude projects, their visibility and collaborators
- Workspace agents and service accounts
- Claude projects not updated for 90 days
How we deliver it
- We run the first inventory and go through it with you.
- Owners confirm what stays shared and what should close.
- Your admins learn to filter and export the list themselves.
Shared GPTs and projects
| Item | Last change | Shared with |
|---|---|---|
| Bid writer (GPT) | 3 days ago | Whole workspace |
| Contract notes (Claude) | 5 months ago | Whole organisation |
| Sales playbook (GPT) | Last week | 12 people |
Connectors to Microsoft 365
See what ChatGPT and Claude can reach in Microsoft 365, and narrow it.
ChatGPT reaches SharePoint, and Claude reaches SharePoint, OneDrive, Outlook and Teams, through apps that an administrator approves in Microsoft Entra ID. We list those apps with the permissions they hold, next to every other app with standing access to your sites. Where a connector reads the whole tenant, we agree a narrower scope with the owner.
What it covers
- ChatGPT and Claude apps approved in Entra ID
- Permissions each app holds in Microsoft 365
- Apps used by each ChatGPT project
- Other apps with standing access to SharePoint
- Sites each connector can read
How we deliver it
- We review consent and assignment settings in Entra ID with your security team.
- Connector scopes are narrowed with the owner's agreement.
- Site sharing and labels follow the Copilot readiness work.
Apps with access to SharePoint
- ChatGPT SharePoint app 4 sites
- Claude Microsoft 365 connector Every user
- File sync connector Every site
Seats and spend
Seats and spend are read across Copilot, ChatGPT and Claude.
Seats on the three assistants are compared person by person, so people who hold two or three are easy to find. Claude spend is shown by department against the limits set in Claude Enterprise, and seats with no recent activity are listed before the next renewal.
What it covers
- Seats by assistant and by department
- People with seats on two or more assistants
- Claude spend by department, against its limits
- Seats with no activity in 30 days
- Cost by person and by department
How we deliver it
- We agree the activity thresholds with your licensing team.
- Reports go to IT and finance on a schedule.
- Seats are reclaimed through a documented process.
Claude spend against its limit
- Engineering 92%
- Marketing 64%
- Legal 38%
- Finance 21%
History and actions
Keep a year of activity, and act once the owner agrees.
ChatGPT activity is collected continuously and kept for 12 months, well past the 30 days of the native logs, including sharing changes and service account actions. When a finding needs action, sharing is removed first while the item and its owner stay in place. Deletion comes later, once the owner confirms.
What it covers
- ChatGPT activity kept for 12 months
- Sharing changes over time
- Actions taken by service accounts
- Removing sharing or an app's scope
- Deleting a Claude project, with or without approval
How we deliver it
- We agree with you which reports auditors need.
- Every action follows a runbook your admins keep.
- Decisions are recorded with each finding.
Actions this month
- Sharing removed 11
- App scope narrowed 3
- Waiting for the owner 5
Examples
Examples of ChatGPT and Claude rules we configure
| Rule | Why it matters | Typical severity |
|---|---|---|
| Account disabled in Entra ID that still has ChatGPT or Claude access | A leaver can still open shared projects, GPTs and past chats. | High |
| Connector app that can read every SharePoint site | Answers can draw on sites nobody meant an assistant to reach. | High |
| Single sign-on not enforced in Claude Enterprise | People can sign in without the policies you apply through Microsoft Entra ID. | High |
| Custom GPT shared with the whole workspace without review | Everyone can use it before anyone has checked what it reads and returns. | Medium |
| Claude project open to the whole organisation | Every member can read the files and instructions stored in it. | Medium |
| More Claude Enterprise admins than agreed | Each admin can change settings that apply to every member. | Medium |
| Claude project not updated for 90 days | Its files and connections stay available while nobody looks after it. | Low |
| Person holding Copilot, ChatGPT and Claude seats | Three AI seats for one person, often without a clear reason. | Low |
Examples. Rules and thresholds are agreed with your team.
Native tools
Native controls and what a governance layer adds
OpenAI, Anthropic and Microsoft all give admins controls. We configure them and add the cross-assistant view they leave to manual work.
| Native control | What it does | What a governance layer adds |
|---|---|---|
| ChatGPT Enterprise admin settings | Single sign-on, SCIM and roles. Admins decide who can share custom GPTs and projects. The Compliance API gives access to conversation logs and workspace metadata, and compliance logs stay available for 30 days. | Every GPT, project and app in one list with owner and audience, users matched to Entra ID, and activity kept for 12 months. |
| Claude Enterprise admin settings | Single sign-on, SCIM, roles and spend limits for the organisation, a group or a user. The Compliance API gives access to activity logs, chats, files and projects. | Checks on sign-on, admin counts and open projects, spend by department and removal of stale projects after approval. |
| Microsoft Entra ID | An administrator approves the ChatGPT and Claude apps. User consent settings and assignment decide who can connect them to Microsoft 365. | Those apps listed with their permissions, next to every other app that reaches SharePoint, and reviewed with an owner. |
| Microsoft Purview | Microsoft is adding connectors that bring ChatGPT Enterprise and Claude Enterprise prompts and responses into audit, eDiscovery and retention. | Owners, sharing, seats and spend for each assistant, alongside the records Purview keeps. |
Product names and features as of the last review date shown above.
How it works
How ChatGPT and Claude governance runs
The same approach as for Copilot: ready-made tooling, tested starting rules and runbooks your team keeps.
- Step 1
Connect
Your workspace owners enable the ChatGPT and Claude Compliance APIs for the tool. We review what the tool can see with your security team.
- Step 2
Match
Users are matched to Microsoft Entra ID. We go through the accounts with no match, and the leavers, with you.
- Step 3
Baseline
Rules run in report mode only. You see what would be flagged, and we adjust thresholds together.
- Step 4
Act
Owners are asked to confirm. Sharing is removed before anything is deleted, and each decision is recorded.
- Step 5
Report
Seats, spend and findings for IT, finance and audit, in the same dashboard as Copilot.
Scope
What the tool reads, and what it leaves alone
A governance tool needs enough access to answer who, what and how much. It does not need your conversations.
-
Metadata, not messages
Owners, sharing, dates, activity and spend. The text of chats, prompts, session transcripts and files is not read, stored or shown.
-
Enterprise plans
ChatGPT Enterprise and Edu, and Claude Enterprise. ChatGPT Business and Claude Team do not offer the Compliance API the tool relies on.
-
Not the developer platforms
The OpenAI API platform and the Claude Console that developers use are outside its scope.
-
One tool with Copilot
Copilot, ChatGPT and Claude share one inventory, one set of rules and one list of owners.
How Neptune delivers
From tool choice to day-to-day support
One team selects the tool, connects your workspaces and your tenant, trains your people and stays with you afterwards.
-
Select
We pick the governance tool that fits your tenant, your AI assistants and your licences. We work with several vendors, not one.
-
Implement
We connect each workspace and your tenant, set up starting rules and switch them on in waves, with owners informed.
-
Train
Admins learn the rules on their own data and keep runbooks they can reuse.
-
Support
We stay reachable after go-live, tune the rules and keep pace with changes at OpenAI, Anthropic and Microsoft.
FAQ
ChatGPT and Claude governance questions, answered.
What is ChatGPT Enterprise governance?
It is the set of rules and records that say who may use ChatGPT Enterprise, what custom GPTs and projects may be shared, which company data they may reach and who pays for each seat. Claude Enterprise governance asks the same questions. We answer them with one tool, from your Microsoft 365 tenant.
Which ChatGPT and Claude plans can be governed?
ChatGPT Enterprise and Edu workspaces, and Claude Enterprise organisations. The tool relies on each vendor's Compliance API, which ChatGPT Business and Claude Team do not offer. The OpenAI API platform and the Claude Console used by developers are not covered.
Does the governance tool read our conversations?
No. It works from metadata: users, owners, sharing settings, dates, activity events and spend. The text of chats, prompts, session transcripts and files is not read, stored or shown. If you need to search or retain conversations, that belongs in your compliance archive, or in Microsoft Purview as its connectors for these assistants arrive.
How do ChatGPT and Claude reach data in Microsoft 365?
Through apps an administrator approves in Microsoft Entra ID. Claude's Microsoft 365 connector needs one-time Global Administrator consent and only reaches what each user can already open in SharePoint, OneDrive, Outlook and Teams. ChatGPT's SharePoint app also needs admin consent; on Enterprise, admins choose which sites it syncs, and people only see files they can already open. In Entra ID, you can limit user consent and restrict each app to the users and groups you assign.
How long is ChatGPT and Claude activity kept?
ChatGPT Enterprise keeps its compliance logs for 30 days, so they need exporting continuously. The governance tool collects ChatGPT activity continuously and keeps it for 12 months, including sharing changes. Claude Enterprise owners can set their own retention period for chats and projects.
Can we see who holds Copilot, ChatGPT and Claude seats at the same time?
Yes. Because every account is matched to Microsoft Entra ID, seats on the three assistants are compared person by person and by department. People holding two or three seats are listed, with their recent activity, so a renewal can be sized on real use.
Is Microsoft Purview enough for ChatGPT and Claude?
Not on its own. Microsoft is adding connectors that bring ChatGPT Enterprise and Claude Enterprise prompts and responses into Purview audit, eDiscovery and retention. A governance layer answers different questions: who owns each GPT and project, how widely it is shared, what it connects to and what it costs. The two work side by side.
Does an inventory of AI assistants help with the EU AI Act?
The AI Act does not require a formal inventory, but you cannot train people on tools you do not know about. Organisations using AI are expected to take measures that support AI literacy among their staff, and the rules for high-risk uses will apply from 2 December 2027. Knowing who uses ChatGPT and Claude, and for what, is the practical starting point. No tool makes you compliant by itself: that assessment stays with your legal and compliance teams.
Related pages
More on Microsoft 365 governance
-
AI governance
Agents can appear without an owner, a review or an end date. We put an inventory, rules and owner reviews in place for Copilot and the agents your teams build.
-
Copilot readiness
Copilot only shows people what they can already open. The readiness assessment finds oversharing, missing labels and idle licences before rollout, then keeps checking.
-
Compliance
Policies on paper do not check the tenant. We turn them into daily checks across Microsoft 365, send findings to owners and export the evidence auditors ask for.
Insights
Further reading
Talk to us about ChatGPT and Claude governance.
Tell us which AI assistants your teams use today. We will explain how they can be governed from your tenant, next to Copilot, and how we would put it in place with your team.