How to control shadow AI across your organization
Diesen Beitrag auf Deutsch lesen
Discover unapproved AI tools, assess their data access, assign ownership, and govern or retire them.
TL;DR
Review Entra ID enterprise applications, Copilot Studio and SharePoint agents, and licensed AI service members to find unapproved tools. Assess each tool's data reach, users and autonomy, then approve valuable tools under inventory, ownership and access review, or revoke consent and retire them. Repeat discovery on a fixed cycle.
Original by Rencore, on Rencore. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Makers: Check whether agents built in Copilot Studio or SharePoint have approval and an owner before using company data.
- Admins/CoE: Inventory Entra ID applications with Microsoft Graph or SharePoint permissions, tenant agents and licensed AI service members, then route findings to owners.
- Security/Compliance: Assess what each tool can read or change, especially ownerless applications with Graph permissions, because unmanaged access creates security and compliance exposure.
- Leadership/Business: Prefer approved enterprise routes over blanket bans, since blocking everything can push use to personal devices and accounts where visibility is lower.
Frequently asked questions
How can Entra ID reveal unapproved AI tools with Microsoft Graph permissions?
Entra ID lists enterprise applications that received consent, including their Microsoft Graph permissions, making ownerless access to company data visible.
What should happen to an unapproved Copilot Studio or SharePoint agent?
Assess its data reach and value, then approve it under governance or have its owner unpublish it and explain the decision to users.
Why can blocking every shadow AI tool increase governance risk?
A blanket ban can move usage to personal devices and accounts, reducing visibility; useful tools should instead be approved under controlled conditions.