Filed under: it’s already in your tenant, and half of it is a browser extension.
Let me guess how the AI conversation went in your org. Leadership said “we need an AI strategy,” a committee was formed, a pilot was scoped, and everyone agreed to move carefully and thoughtfully over the next few quarters.
Meanwhile, your actual employees started pasting customer emails into a free chatbot eight months ago to help them write replies faster, and they haven’t stopped since.
That’s shadow AI, and it’s the same story as shadow IT, just faster and with worse data-exposure consequences. Nobody’s being malicious. People found a tool that made their job easier, and they used it, exactly as humans always do, without waiting for a policy. The difference from the Dropbox-in-2013 era is what’s flowing into these tools: source code, customer records, financials, contract text, half-written strategy docs. Straight into a third party you have no agreement with, no visibility into, and no ability to get the data back from.
Here’s the good news, and it’s why this is a Modern Managed post rather than a doom post: if you’re a Microsoft shop, you almost certainly already own the tooling to find all of it and govern it, and most people just haven’t turned it on. Let me walk the whole loop. Discover, assess, decide, enforce, monitor.
Step 1: Discover what’s actually being used
You can’t govern what you can’t see, and guessing is pointless because you will guess wrong. The tool for this is Microsoft Defender for Cloud Apps, specifically Cloud Discovery.
Cloud Discovery analyses your network traffic logs and shows you the cloud apps your people are actually reaching. Filter that catalogue by the Generative AI category, and you get the thing everyone should want, but few have looked at: a real inventory of every AI tool in use across the org, ranked by how much traffic and how many users each one has. Not the tools you sanctioned. The tools people are genuinely using.
Fair warning: run this for the first time and the list is longer than you expect. It’s never just ChatGPT. It’s a dozen writing assistants, a handful of “free” summarizers, code helpers, image generators, and three things nobody on the security team has ever heard of. That first export is usually the moment the AI-governance conversation stops being theoretical and gets a budget.
Step 2: Assess the risk, don’t just react to it
The instinct after that first list is to block everything. Resist it for a moment, because a blanket block just pushes shadow AI further into the shadows (personal phones, home laptops) where you have zero visibility. Assess first.
Defender for Cloud Apps gives every discovered app a cloud app risk score from 0 to 10, built from four dimensions: general information like the vendor and where data is hosted, the security controls the app supports (encryption, MFA, data classification), its compliance alignment (the frameworks that matter to you), and its legal and data-handling terms, including the big one, whether it trains on your data or retains it. Microsoft is refreshingly blunt that these scores are indicators, not verdicts. They’re a starting point for a human decision, not the decision itself.
This is where you triage. A well-governed enterprise AI vendor with a proper data agreement and a high risk score gets treated very differently from a random free tool hosted who-knows-where that reserves the right to train on everything you feed it. The score sorts your list into “probably fine,” “needs a proper look,” and “absolutely not,” fast.
Step 3: Decide, and give people somewhere to go
Governance that’s only ever “no” fails, because the underlying need doesn’t disappear; it just routes around you. Before you block anything, do the unglamorous but decisive step: figure out why people reached for these tools and give them a sanctioned alternative that does the same job.
Nine times out of ten, the honest answer is “it helped me write faster” or “it saved me an hour on that summary,” and the sanctioned answer is Microsoft Copilot or another tool you can actually stand up with a real data-protection agreement behind it. When you block the risky tool and point people at an approved one in the same breath, you’re solving their problem, not just policing it. That’s the difference between a governance program people cooperate with and one they quietly defeat.
Step 4: Enforce the decision
Once you’ve decided a tool is out, Defender for Cloud Apps lets you mark it as unsanctioned, and that tag can become a real block rather than a strongly-worded email. The enforcement flows through the endpoint stack you probably already run, so the pieces need to line up:
Cloud protection needs to be enabled in Microsoft Defender for Endpoint, network protection has to be on (it’s the component that actually enforces the block at the network layer), and for anyone not using Edge, the Microsoft Defender browser protection extension needs to be deployed to Chrome and Firefox so the block follows them off Microsoft’s own browser. Get those three in place and marking an app unsanctioned means users are actually prevented from reaching it on managed devices, not just advised against it.
Edge, being a Microsoft browser, gives you extra levers here for managed enterprise browsing, which is one of the quiet arguments for standardising on it in an AI-governed environment. And for the tools you do sanction, this is where Purview DLP earns its place, stopping sensitive data (labelled documents, sensitive information types) from being pasted into even the approved AI tools. Discovery finds the apps; DLP governs what data is allowed to flow into the ones you keep.
Step 5: Keep watching, because the list changes weekly
Shadow AI is not a project you finish. A new tool launches every week, and your first clean inventory is out of date within the month. So the last step is making discovery continuous rather than a one-off panic.
Set up app discovery policies in Defender for Cloud Apps that alert you when a new generative-AI app crosses a usage threshold or when a risky one shows up, so you learn about the next big thing from your own dashboard instead of from a breach report. And if you’re licensed for it, Purview’s Data Security Posture Management for AI gives you an ongoing, AI-specific view of how data is moving in and out of these tools across the tenant. The goal is a standing capability: a new tool appears, you see it, you assess it, you decide, all as routine, not as a fire drill.
The Monday-morning version
Turn on Cloud Discovery in Defender for Cloud Apps and filter for generative AI. Sit with the list, because it will be longer than you think. Score and triage it rather than blanket-blocking. For anything you’re cutting off, stand up a sanctioned alternative in the same move so you’re solving the need, not just denying it. Enforce the blocks properly through Defender for Endpoint’s cloud and network protection, with the browser extension for non-Edge users. Then wrap Purview DLP around the tools you keep, and set discovery policies so the whole thing keeps running without you.
And notice what this whole exercise is, underneath. It’s shadow IT governance, the discipline you’ve run for a decade, pointed at a new category of app. New tools, same playbook: see it, assess it, sanction the good, block the bad, give people a safe path, keep watching. AI didn’t hand you a brand new problem here. It handed you the old problem at higher speed and higher stakes, which is exactly the thing that finally makes you go turn the discovery on.
Your users aren’t the enemy in this story. They found something useful and reached for it, same as they always have. Your job is to make sure the useful thing is also the safe thing. Microsoft’s already sold you the tools to do it. Go see what’s in your tenant.
Jay Ralph is a Technical Principal Consultant at Bridewell, with 20 years in IT and security and most of the last decade leading cloud transformation. He also serves as a Special Inspector with Avon and Somerset Police. He writes at modern-managed.com about the practical end of AI, security and Microsoft cloud, with the occasional bad joke.
Want a hand turning this into a real, facilitated session for your team, tuned to your environment? That’s a genuinely good use of an afternoon and I’m up for it. Say hello.
Further reading: