Shadow AI discovery in a Microsoft 365 tenant

Many AI tools sign a user in with their work account instead of asking for a separate one, which leaves a record in Entra ID. Microsoft's documented default lets all users consent to applications for permissions that do not require administrator consent. A user can consent to an app reading their mailbox, but cannot consent to unfettered read and write access to every file in the organisation. The admin centre carries three built-in positions. User consent can be disabled outright. It can be allowed only for apps from a verified publisher or registered in the tenant, and only for permissions an administrator has classified as low impact. Or it can be allowed for any permission that does not require admin consent, for any application. Which of the three a tenant runs is the first thing to read.

The grants themselves sit under Entra ID, Enterprise apps, All applications, Permissions, split across an Admin consent tab and a User consent tab. Read the requested scopes, because a productivity-sounding app name says nothing about what the app can reach. Permissions an administrator granted for the whole organisation can be revoked in the portal. The user consent grants cannot, and come out through Microsoft Graph or PowerShell instead. Revoking a grant does not stop the user consenting to the same permissions again, so a revocation without a change to the consent policy is undone at the next prompt.

The admin consent workflow turns a refused consent into a queued request. A user who cannot consent sends a request with a justification. Designated reviewers see it in the Microsoft Entra admin center, act on it, and the user is notified of the outcome. Turning the workflow on requires a Global Administrator. Reviewers can view, block or deny requests, and only Global Administrators can approve a request from an app asking for Microsoft Graph application permissions.

Consent records only cover what asked for a Microsoft sign-in. A tool used entirely inside its own browser tab, with its own account and its own password, leaves no consent grant and no entry under Enterprise apps.

Microsoft Defender for Cloud Apps runs discovery from the traffic end. Cloud Discovery analyses logs from a connected firewall, a secure web gateway or Defender for Endpoint. It matches each destination against the cloud app catalog, a list of over 31,000 discoverable cloud apps scored on more than 90 risk factors. The catalog sorts that score across four risk categories: general, security, compliance and legal. Three catalog categories exist for this problem. Generative AI covers cloud apps that generate text, images, video and other media using generative AI models. AI - Model Provider covers cloud platforms and APIs that deliver access to foundation models or large language models. AI - MCP Server covers public cloud services that implement the Model Context Protocol to coordinate interactions between AI agents and systems.

Microsoft's own deployment guidance for preventing data leak to shadow AI starts in the same place. Filter the cloud app catalog by app category, Generative AI, to identify the AI apps in use. Review the risk score and usage details for each discovered app. Tag each one Sanctioned or Unsanctioned against the organisation's policy.

Two limits come with the method. Defender for Cloud Apps does not discover apps that are absent from the catalog. A new or bespoke tool has to be added as a custom cloud app, or submitted to Microsoft for review, before it shows up. Cloud Discovery also reads only the traffic that reaches a connected source. A device outside Defender for Endpoint enrolment produces no log for it to analyse unless its traffic crosses a connected firewall or gateway. Traffic from a Windows or macOS device onboarded to Defender for Endpoint is reported on and off the corporate network, so a laptop on a personal hotspot stays in view. Microsoft's prerequisites for that integration cover Windows 10 version 1709 or later and Windows 11, and macOS where Defender for Endpoint runs version 20.123072.25.0 or higher with network protection turned on. An onboarded device outside that set produces no cloud discovery log.

Microsoft Entra Global Secure Access carries a network-based shadow AI discovery feature aimed at exactly that traffic. It inspects internet and Microsoft 365 traffic for connections to known generative AI applications, model provider APIs and SaaS MCP servers. It matches what it finds against the Defender for Cloud Apps cloud app catalog for categories and risk scores. The result surfaces in Application Usage Analytics under Global Secure Access, Applications, Insights and Analytics, and reading it takes the Global Secure Access Log Reader role.

That view carries the application inventory: which generative AI applications staff reach, which users reach them, how often, and how many bytes travel to each. Generative AI Insights is a separate logs page under Global Secure Access, Monitor, and Microsoft has it in preview. It uses TLS inspection to log prompt content for the generative AI applications Microsoft names as supported, and deep packet inspection to log Model Context Protocol operations. Prompt content appears only where TLS inspection is turned on and the destination is one of those applications. That turns an inventory of tools into a record of what staff put into them.

Coverage is the limit that applies to every traffic-based method. A review that connects one firewall, or one Defender for Endpoint policy set, sees the traffic crossing that vantage point and no other. A device that never touches a monitored path is invisible to consent grants and traffic logs alike. A discovery exercise has to state which devices and network paths it covered.

The discovery list becomes a position when each app is tagged. Each one gets Sanctioned or Unsanctioned in the catalog, and custom app tags group tools by business status or justification where several sit in the same category. A cloud discovery executive report, generated from the Cloud discovery page, puts the top potential risks in front of a reviewer who does not work in the portal. Microsoft removed the cloud discovery alerts data point from that report on 1 September 2025, so open alerts have to be read from Incidents and alerts in the Defender portal, filtered by policy type.

Marking an app Unsanctioned is the enforcement lever. With the Defender for Endpoint integration enabled, the domains used by unsanctioned apps propagate to onboarded devices and are blocked by Microsoft Defender Antivirus network protection. Microsoft puts the latency at up to three hours from the moment the tag is applied to the moment a device enforces the block. The block page can be pointed at a company URL that tells staff why the app is blocked and what the exception process is.

On the consent side, the OAuth apps page in Defender for Cloud Apps lists the user-installed OAuth applications with access to Microsoft 365 data. It carries a permissions level of High, Medium or Low, the number of users who authorised each app, and an app state an administrator sets to approved or banned. It identifies apps that request delegated permissions only. Banning an app carries an option to notify the users who granted it access, with a custom message.

New apps appear continually and staff keep adopting them, which makes this a standing review. Re-running the executive report and re-filtering the catalog to the three AI categories on a set cadence keeps the sanctioned list current.

The ACSC's Engaging with Artificial Intelligence was published 24 January 2024. Partners on it included CISA, the FBI and the NSA in the United States, the UK National Cyber Security Centre, the Canadian Centre for Cyber Security and further agencies. It covers what happens after a sanctioned decision. It asks organisations to grant privileges on the need-to-know principle and the principle of least privilege. That means limiting the number of accounts with access to an AI system's development and production environments, and to the repositories holding its training data. It also means revalidating privileged accounts routinely and disabling them after a set period of inactivity.

On logging, the guidance names one signal directly. High frequency, repetitive prompts can be a sign of automated prompt injection attacks. It asks for a baseline of the system's activity so that anomalous events can be recognised. For a third-party system, it asks organisations to understand whether their inputs will be used to retrain the model. It also asks them to consider private versions of the system where they exist.

The guidance also puts a training obligation on whatever ends up sanctioned. Staff who use an AI system are to be trained on what data can and cannot be input to it, personally identifiable information and the organisation's intellectual property specifically. They are also to be trained on the extent to which the system's outputs can be relied upon.

Each step narrows what the next one has to cover. The consent policy decides how much weight the grant review carries. The connected data sources decide how much of the network the traffic review can see.

The AI security assessment runs this sequence against a tenant's live consent grants and traffic logs. It hands back a written sanctioned-tools position, with an access boundary and a logging position for every tool that stays.