You can secure Microsoft 365 Copilot beautifully and still have a serious AI-data problem — because employees don’t only use the AI you sanctioned. They paste customer data into a free chatbot, run a document through an unvetted “summarizer,” or install a browser extension that quietly ships context to an external model. That’s shadow AI, and it lives entirely outside your Copilot boundary.

Ignoring it doesn’t make it safe. Controlling it starts with seeing it.

Discover before you police

The first move is visibility, not a ban. Microsoft Defender for Cloud Apps discovers the SaaS — including generative-AI apps — actually in use across your environment, scores each app’s risk, and lets you filter the catalog specifically for GenAI tools. Before you write a single policy, you learn which AI apps your people have already adopted and how risky each one is. That evidence also makes the eventual policy conversation far easier: you’re responding to real usage, not hypotheticals.

A layered policy beats a blanket ban

Here’s the uncomfortable truth: a policy that says “no external AI, ever” will be ignored if you can’t enforce it — and driving usage underground is worse than governing it. A layered model works better:

  • Sanctioned — Microsoft 365 Copilot and explicitly approved enterprise AI tools, with documented ownership, retention, and audit.
  • Tolerated with controls — selected AI services where the use case is bounded and you have guardrails: browser/endpoint DLP, network controls, or Purview data controls where supported.
  • Unsanctioned — services with poor contractual terms, weak enterprise controls, no approved retention path, or unacceptable data-routing behaviour.

Defender for Cloud Apps lets you formally sanction or unsanction an app, and on devices onboarded to Defender for Endpoint it can enforce those decisions — warning or blocking access to an unsanctioned AI site rather than just recording it.

Make enforcement graduated

The sequence I recommend:

  1. Discover and score the AI apps in use.
  2. Tag the obvious high-risk ones and start with warn (a coaching page) rather than an immediate hard block — it educates users and surfaces legitimate needs.
  3. Block the genuinely unacceptable ones on managed devices.
  4. Offer the sanctioned alternative at the same time. “Don’t use that; use this instead” lands far better than a dead end — and it channels demand toward the tools you actually govern.

Close the loop with the rest of your program

Shadow AI control isn’t a standalone product; it’s the “govern SaaS AI” edge of the secure Copilot launch. It pairs naturally with agent governance — both are ultimately about controlling where your data can flow once AI makes moving it effortless.

The organizations that handle this well don’t try to stamp out AI curiosity. They see it, steer it toward sanctioned tools, and block only the genuinely dangerous — turning shadow AI from a blind spot into a governed part of the program.

If you want help building a shadow-AI discovery and control program that people will actually accept, let’s talk.