📋 What is Shadow AI

Shadow AI refers to AI-powered tools and services used within an organization without IT's knowledge, approval, or security review. Unlike traditional Shadow IT — where the risk was primarily data storage or collaboration tools — Shadow AI introduces a qualitatively different threat: employees are actively feeding sensitive business data into models they do not control, hosted on infrastructure they cannot audit.

Common Shadow AI App Categories

⚠️ Risk Landscape

Not all Shadow AI usage carries the same risk. Your enforcement strategy should be tiered — block highest-risk scenarios entirely, monitor medium-risk with DLP, allow low-risk with logging.

Risk Tiers by Data Sensitivity

Top Shadow AI Regulatory Risks

🔍 Discovery with Microsoft Defender for Cloud Apps

Before you can block, you need to know what's in use. Defender for Cloud Apps (MDCA) Cloud Discovery ingests traffic logs from your network appliances and MDE-enrolled endpoints, then scores every app against 90+ risk factors.

Step 1 — Enable Cloud Discovery

Step 2 — Connect MDE as Log Source (Agentless)

If you already have Microsoft Defender for Endpoint deployed, you get Cloud Discovery data for free — no network log upload needed. MDE reports all app traffic per endpoint directly to MDCA.

Step 3 — Tag Apps and Set Enforcement

In the MDCA App catalog, filter by category "Generative AI" and "AI Assistant". For each app:

Create an Anomaly Detection Policy for AI Data Exfiltration

🌐 Microsoft Entra Internet Access (Global Secure Access)

Entra Internet Access (part of Global Secure Access) is Microsoft's Security Service Edge (SSE) solution. It routes all internet-bound traffic through Microsoft's cloud network, enabling you to apply identity-aware web filtering — blocking AI sites based on category, FQDN, or app risk — regardless of where the user is located.

Enable Entra Internet Access

Configure Custom AI FQDN Block List

The built-in category covers major AI sites. Supplement with a custom FQDN list for AI tools that appear after the category was last updated:

Entra Internet Access Security Profile

Assign Security Profile via Conditional Access

🔐 Conditional Access for AI Applications

Conditional Access controls access at the authentication layer. When a user tries to sign into a registered AI service (like the Microsoft-published ChatGPT Enterprise app, or a custom OAuth app), CA fires before the session begins — independent of network controls.

Policy 1 — Block Access to All External Generative AI Apps

Policy 2 — Session Control on Monitored AI Apps

For AI tools that are conditionally approved (e.g., ChatGPT Enterprise with a corporate account), enforce MDCA session proxy to inspect every interaction:

Policy 3 — Require Managed Device for All AI Access

App Governance — OAuth App Oversight

Users frequently grant OAuth permissions to AI apps from their personal Microsoft accounts. App Governance (built into MDCA) gives you visibility and control over every OAuth app that has been granted permissions in your tenant.

🛡️ Network-Level Controls

Network controls are your deepest enforcement layer — they apply even to unmanaged devices on your corporate Wi-Fi, and to API calls made by scripts and tools that don't trigger browser-level controls. This is the layer that catches developer direct API usage.

Layer 1 — DNS Filtering (Fastest, Broadest Coverage)

DNS-based blocking prevents name resolution for AI domains. Applies to all devices on-network. Works as a fallback even if other controls fail.

Layer 2 — Firewall FQDN Filtering with TLS Inspection

FQDN-based firewall rules block traffic even if DNS is bypassed (direct IP). TLS inspection is required to distinguish between allowed and blocked paths on CDNs (e.g., api.openai.com vs. openai.com/about).

Layer 3 — MDE Custom Indicators (Remote Users)

For remote users who bypass corporate network, MDE Network Protection enforces FQDN blocks directly on the endpoint — no VPN or proxy required.

TLS Inspection Considerations

📱 Intune App Protection & Device Compliance

Intune controls the device-side of Shadow AI. App Protection Policies (APP) block data from being pasted into unapproved apps. Compliance policies ensure only healthy devices can access corporate resources — including approved AI tools.

App Protection Policy — Block Copy/Paste to AI Apps

The most common Shadow AI data exfiltration vector: a user copies a confidential document paragraph, then pastes it into ChatGPT. APP blocks this clipboard transfer at the OS level.

Device Compliance Policy — AI Access Gate

Only compliant devices should be able to access even the approved AI tools. This ensures that if a user's device is compromised, AI access is revoked alongside other corporate resource access.

Windows Information Protection (WIP) — Legacy Fallback

Managed Browser Policy — Force Edge for AI Traffic

Require that all AI-related web browsing happens through Microsoft Edge (which supports Intune MAM policies), not Chrome or Firefox (which do not):

🏛️ Microsoft Purview — DLP for AI Traffic

Purview DLP adds a content-aware layer: even if a user reaches an AI site (because it's in the "monitored" tier), Purview can detect when they're attempting to upload or paste sensitive data and block that specific action — not the entire session.

DLP Policy — Block Sensitive Data Upload to AI Sites

Sensitivity Label Integration

If your organization uses Purview sensitivity labels, any labeled content pasted into an AI tool triggers DLP based on the label — even if the raw text doesn't match a sensitive info type pattern:

Adaptive Protection — Risk-Based DLP

Purview Adaptive Protection integrates with Insider Risk Management to automatically tighten DLP enforcement for users with elevated risk scores (e.g., users who recently resigned, failed phishing sims, or triggered multiple alerts):

🎯 KQL Threat Hunting — Shadow AI Detection

The following queries run in Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel. Use them to detect Shadow AI usage that bypassed controls, or to build detection rules.

Query 1 — AI Domain Access from Endpoints (MDE)

Query 2 — Large Data Uploads to AI APIs (Potential Exfiltration)

Query 3 — OAuth App Consent to AI Apps (Entra)

Query 4 — Sensitive File Access Before AI Domain Visit

Query 5 — MDCA Alerts for Shadow AI

Sentinel Analytics Rule — Shadow AI Exfiltration Alert

🏢 Governance Framework

Technology controls only work if there's an operational model behind them. Shadow AI governance requires a repeating cycle: new AI tools appear every week, employees will request exceptions, and your risk appetite for different app categories will evolve. Build this as a process, not a one-time project.

The Three-Tier AI App Classification Model

Exception Request Process

Roles and Responsibilities (RACI)

AI Policy Communication

Metrics to Track Monthly

✅ Implementation Checklist — Shadow AI Governance

• Enable MDCA Cloud Discovery — connect MDE as agentless log source
• Review Cloud Discovery dashboard — identify all AI apps in use across the organization
• Tag all apps in the AI catalog: Sanctioned / Monitored / Unsanctioned
• Enable App Governance — review OAuth consents to AI apps, revoke unauthorized
• Create MDCA activity policy for AI data upload events → alert on high severity

• Enable Microsoft Entra Internet Access (Global Secure Access) tenant-wide
• Deploy GSA Client via Intune to all Windows devices
• Create Web Content Filtering Policy — block "Generative AI" category
• Add custom FQDN block list (api.openai.com, claude.ai, etc.) to GSA policy
• Configure Azure Firewall / proxy FQDN filtering for on-premises AI block list
• Configure MDE custom indicators (URL/domain block) for remote user enforcement
• Enable MDE Network Protection in Block mode via Intune ASR policy

• Create CA policy: Block-External-AI-Apps (All Users, exclude AI-Approved-SG)
• Create CA policy: Session control on monitored AI apps (MDCA proxy)
• Create CA policy: Require compliant device to access any AI app
• Link GSA Security Profile to CA policy for internet traffic enforcement
• Run all new CA policies in Report-only mode for 2 weeks before enabling

• Configure Windows MAM App Protection Policy — block copy/paste to unmanaged apps
• Enforce Microsoft Edge as managed browser — restrict AI browsing to Edge
• Update device compliance policy — require Defender for Endpoint risk level ≤ Medium
• Configure custom block notification page — include approved AI alternative and exception request link

• Create Endpoint DLP policy targeting AI site FQDN list for file uploads
• Add sensitive info types: PII, credit card, health records, source code
• Add sensitivity label condition — block Confidential/Highly Confidential labeled content
• Enable Adaptive Protection — link IRM risk levels to DLP enforcement
• Set DLP alert notifications → route to Security Operations team

• Deploy Query 4 (correlated file access + AI visit) as Sentinel scheduled rule
• Create Sentinel workbook for Shadow AI usage trends (weekly/monthly)
• Set up monthly report: # of AI apps discovered, blocked, exceptions active

• Publish AI usage policy — define Tier 1/2/3 classification and employee expectations
• Create AI exception request workflow in IT portal (ServiceNow / Forms)
• Assign RACI — who reviews exceptions, who owns monitoring, who updates the block list
• Schedule quarterly review: re-evaluate all Tier 2 exceptions and app risk scores
• Add Shadow AI module to security awareness training (Defender for Office 365 / KnowBe4)