Shadow AI: detecting hidden AI in Microsoft 365

An employee pastes a contract into the free version of ChatGPT. No alert is raised, and no Microsoft 365 log flags it by default. Three tools in the Microsoft security stack address this problem, but at different levels: the device, the user and the event. This article explains what each one sees, the licence to plan for, the prerequisites and the documented limits as of 20 October 2026.

Three tools, three levels of visibility

Discovering unauthorised AI (shadow AI) relies on Microsoft Defender for Cloud Apps, Global Secure Access (Microsoft Entra) and Microsoft Purview. The first two answer the question "which AI applications are being used?". Purview answers "what is happening in them?".

Criterion	Defender for Cloud Apps	Global Secure Access	Purview (DSPM for AI)
Level of visibility	Device or IP address	User, at network level	Activity, event by event
Data source	Defender for Endpoint, or firewall logs	Global Secure Access client's own traffic	Endpoint DLP and Purview browser extension
Question addressed	Which application, from which device?	Which user, which application?	Which prompts, which responses, which data?
Blocking	Entire application, via Defender for Endpoint	Web filtering at network level, per user	Data control (DLP), handled separately
Point of caution	Slow data refresh	Licence above E5	Pay-as-you-go billing for third-party AI

The first two tools share the same cloud app catalogue, an index of more than 35,000 SaaS applications and AI platforms maintained by Microsoft. Risk scores are therefore identical from one tool to the other.

Defender for Cloud Apps: device-level discovery

Defender for Cloud Apps is the oldest of the three tools. It is found in the Defender portal (security.microsoft.com), under Cloud Apps > Cloud Discovery. This area contains the discovery dashboard and the cloud app catalogue.

If Microsoft Defender for Endpoint is already deployed, discovery data is available without additional configuration. Without Defender for Endpoint, an integration with a firewall makes it possible to retrieve network logs.

To isolate AI, open the list of discovered apps and filter on three categories:

Generative AI: consumer or enterprise services whose main function is generative AI.
AI model provider: direct access to the models themselves, for example around GitHub Copilot.
MCP servers: Defender for Cloud Apps can also identify them.

Risk scores and app tagging

Each application in the catalogue has a risk score calculated from security and compliance criteria. You can weight these criteria according to your priorities. The filter on SAML support is a good example: an AI application adopted by teams and compatible with SAML justifies moving to its enterprise plan to control access.

From the side panel, you tag an application as sanctioned or unsanctioned. Blocking requires network protection to be enabled in Defender for Endpoint.

Blocking per device, not per user

Defender for Cloud Apps data is tied to the device or IP address. On a shared workstation, it is impossible to tell users apart. Blocking is also all or nothing: the application is allowed or denied in its entirety. The Microsoft Learn documentation adds that Defender for Cloud Apps session policies do not apply to ChatGPT, which is not a sanctioned enterprise application.

To work with these findings through scripting, our article on the PowerShell audit of unauthorised AI applications extends this discovery.

Global Secure Access: user-level discovery

Global Secure Access is the network (Secure Service Edge) component of Microsoft Entra. With the Internet forwarding profile, outbound traffic goes through the Microsoft service, which observes it and can filter it.

The dedicated feature is called Shadow AI discovery. According to the Microsoft Learn documentation, it analyses Internet and Microsoft 365 traffic to identify ChatGPT, Claude, SaaS MCP servers and model providers. The path is Global Secure Access > Applications > Insights and Analytics, with the filter "Generative AI apps and tools". Detected applications are compared with the Defender for Cloud Apps catalogue, hence the shared risk scores.

The licence changes the picture. According to the available information, this feature requires Microsoft 365 E7 or Microsoft Entra Suite: it is not included in E5. Check this point against your contract before planning.

What Global Secure Access adds

Per-user control: filtering applies to the identity, not the device.
Devices without Defender for Endpoint: shared devices or machines where the agent cannot be installed.
Faster data: data access is slightly faster than in Defender for Cloud Apps.

The coexistence documentation states that discovery is native, with no additional logs. On Windows and macOS, the Global Secure Access client and Defender for Endpoint are two separate clients: install both to combine the sources. On iOS and Android, the Defender for Endpoint app acts as the single client.

IPv6 and UDP traffic not evaluated

The documentation states that IPv6 and UDP traffic is neither acquired nor evaluated. An AI application that uses these protocols therefore escapes discovery. Take this limit into account in your coverage analysis.

Generative AI Insights, in preview

Global Secure Access also offers Generative AI Insights, flagged as a preview. This feature logs prompt content through TLS inspection for ChatGPT, Claude, Gemini, Copilot and other services. It also detects private or shadow MCP servers through deep packet inspection, without depending on the catalogue. Application discovery stays at the application level; Generative AI Insights goes down to the event level. A preview should not be deployed without prior legal validation, because it records the content of exchanges.

Purview: seeing the activity, not just the application

Purview does not try to list applications. It observes what users do. In the purview.microsoft.com portal, open Solutions, then the DSPM (Data Security Posture Management) solution, Discover and finally the activity explorer.

There you see interactions with consumer and enterprise ChatGPT, Gemini, Claude and other services, down to the user level, with requests and responses. The browser extension enables this granularity.

Prerequisites for third-party AI discovery with Purview

Devices onboarded to Purview (Endpoint DLP), simple if Defender for Endpoint is already in place
Purview browser extension deployed on Windows, mandatory for Chrome and for visits detected by Insider Risk Management
Edge configuration policy
Pay-as-you-go billing configured for AI applications other than Microsoft 365 Copilot

The "one-click" policies start in audit-only mode. They let you observe before enforcing.

DSPM for AI names and screens have changed

The Purview documentation states that the "classic" version of DSPM for AI is being replaced by a current version of Data Security Posture Management. Most new features only arrive in the latter. If your portal differs from these instructions, first check which version you are using.

Beyond Edge

Browser Data Security covers Edge, with support for consumer ChatGPT, consumer Copilot, DeepSeek and Gemini. For non-Microsoft browsers, APIs and add-ins, Network Data Security detects sensitive data shared with AI applications. It requires a SASE/SSE integration added manually in the DLP settings, and detection depends on the network partner's implementation.

Which tool for which scenario?

An organisation of a few hundred workstations, all managed with Defender for Endpoint, naturally starts with Defender for Cloud Apps: the data is already there. If part of the estate is shared or unmanaged, Global Secure Access fills the gap. Purview comes in as soon as the question becomes "what is leaking to these services?".

Strengths

Defender for Cloud Apps: data available as soon as Defender for Endpoint is deployed
Global Secure Access: per-user control and coverage of devices without a Defender agent
Purview: visibility into prompts and responses

Limitations

Defender for Cloud Apps: granularity limited to the device, slow refresh
Global Secure Access: licence above E5, IPv6 and UDP not evaluated
Purview: pay-as-you-go billing and browser prerequisites

Microsoft recommends keeping only one blocking mechanism between Defender for Cloud Apps and Global Secure Access: the two are redundant. Since Defender for Cloud Apps session policies do not cover ChatGPT, Global Secure Access offers finer-grained blocking.

A rule of thumb: seeing that a user visited an AI application does not tell you what they did there. Only the Purview layer comes close to answering that.

A four-step deployment

Microsoft publishes a four-step guide, "Prevent data leak to shadow AI". It combines Defender for Cloud Apps, DSPM for AI and Endpoint DLP.

Discover

Enable discovery and filter on the generative AI, model provider and MCP server categories.

Block unsanctioned apps

Tag the applications to be removed, then apply blocking through a single mechanism.

Block sensitive data to sanctioned apps

Apply data protection policies to limit what leaves for the approved services.

Govern

Review the findings regularly and adjust the policies.

Our articles on reducing the attack surface of AI agents and on the Security Dashboard for AI complement this governance approach.

Frequently asked questions

Is a specific licence required for Shadow AI discovery in Global Secure Access?

According to the available information, the feature requires Microsoft 365 E7 or Microsoft Entra Suite. It is not included in E5. Confirm your usage rights with your reseller before planning.

Can ChatGPT be blocked with Defender for Cloud Apps?

Yes, by tagging the application as unsanctioned, provided that network protection and cloud-delivered protection are enabled in Defender for Endpoint. Blocking applies to the entire application. Session policies do not apply to ChatGPT.

Can Defender for Cloud Apps and Global Secure Access block at the same time?

Technically yes, but the two mechanisms are redundant. Microsoft recommends choosing only one to avoid duplicates and behaviours that are hard to diagnose.

Is IPv6 traffic covered by Global Secure Access?

No. The documentation states that IPv6 and UDP traffic is neither acquired nor evaluated. This limit must appear in your coverage analysis.

Where to start

Start with what is already in place, then extend coverage according to your gaps.

Next actions

Open Cloud Apps > Cloud Discovery and filter on generative AI, model provider and MCP servers
Choose a single blocking mechanism: Defender for Cloud Apps or Global Secure Access
Check the Global Secure Access licence (E7 or Entra Suite) before any network project
Deploy the Purview browser extension and launch the one-click policies in audit mode
Identify the uncovered scope: shared workstations, IPv6, UDP

If your estate is fully managed with Defender for Endpoint, start with Defender for Cloud Apps, then add Purview for prompts. If a significant part of the estate is outside Defender for Endpoint, look at Global Secure Access first.