Over the past few months I've seen the same thing happen again and again. Users try out generative AI tools on their own, usually outside anything IT has approved. Sensitive data goes in, the output gets pasted back into documents, and the security team only finds out afterwards. That's why shadow AI discovery is now a fixed part of my tenant reviews. You can't manage what you can't see, and you can't block something you never noticed in the first place.

Cloud Discovery lays the foundation for shadow AI discovery

Defender for Cloud Apps, integrated with Defender for Endpoint, finally gives us the visibility that was missing. Cloud Discovery automatically analyzes outbound traffic from enrolled Windows devices and shows the results in the Defender portal, so you get an actual view of shadow AI usage. It covers every device that has Defender for Endpoint onboarded and Cloud Discovery enabled. You need an E5 or a suitable security add-on licence, and network protection should run in block mode if you want the full effect. In practice, a lot of the tenants I look at are still in audit mode or are only now finding out what's already in use. The setup is described in the official Cloud Discovery documentation.

The Cloud App Catalog filters generative AI apps by risk

Most of the daily work in shadow AI discovery happens in the Cloud App Catalog (Defender portal → Cloud apps → Cloud app catalog). Filter by the "Generative AI" category and you see right away which AI tools your users are reaching, whether that's chatbots, image generators or small niche SaaS products. Every app has a calculated risk score based on security, compliance, certifications and any reported incidents. This is the routine that has worked for me in customer tenants:

  • Filter the app catalog by "Generative AI"
  • Sort by risk score, highest first
  • Look for apps discovered in your tenant ("Discovered" column)
  • Prioritize unknown or suspicious tools
  • Open the app details to see who uses them, how often and from which locations

Working through it in this order keeps the security team focused instead of buried in detail. Don't be surprised if a few AI tools don't show up. Microsoft updates the catalog regularly, but what you see always depends on your endpoint signals and how well Cloud Discovery covers your devices. The complete governance and discovery workflow is in the official documentation.

Unsanctioned apps end up on the Endpoint Network Protection block list

When you've found the high-risk tools, mark them as "Unsanctioned" in the Defender portal (Cloud app catalog → right-click or app details). These apps then sync automatically to the Endpoint Network Protection block list, provided network protection is enabled and Defender for Endpoint is integrated with your tenant. From that point users can't reach those AI services on their devices, and this kind of technical barrier holds up well. In my experience, though, blocking too much backfires fast. Business units start working around you, or forbidden tools end up whitelisted anyway. So I always recommend marking the approved AI apps that fit the business as "Sanctioned" too. Both the security team and the users then know where they stand.

The Mermaid diagram below shows the path from Cloud Discovery and the app catalog through to endpoint blocking and risk review:

flowchart TD
    DefenderEndpoint["Defender for Endpoint"] --> CloudDiscovery["Cloud Discovery"]
    CloudDiscovery --> AppCatalog["Cloud App Catalog"]
    AppCatalog --> RiskAnalysis["Risk analysis"]
    RiskAnalysis --> Unsanctioned["Mark as Unsanctioned"]
    Unsanctioned --> NetworkProtection["Endpoint Network Protection"]
    AppCatalog --> Sanctioned["Mark as Sanctioned"]

Figure: Shadow AI discovery and control with Defender for Cloud Apps and endpoint network protection.

Purview DSPM for AI adds data context and compliance

Blocking AI apps only solves part of the problem. Whenever the licence is there, I bring in Microsoft Purview DSPM for AI as well. DSPM (Data Security Posture Management) looks at which data AI applications actually process, which gives you a realistic measure of your shadow AI risk. You can see which data stores and user groups are most exposed and aim your DLP and access policies at them. The integration doesn't run smoothly in every tenant, but together with network protection it tells you far more about the real risk. The technical details are in DSPM for AI in Purview: Visibility and control over AI use.

My tip: Cloud Discovery, risk-based sanctioning and DSPM for AI work very well together, as long as your endpoint integration is solid and you review the block lists regularly.

Shadow AI is manageable now, but it does not run on autopilot

Old-school proxies and firewall logs aren't enough to find and control shadow AI. Every security team should now be using Defender for Cloud Apps with Cloud Discovery, the generative AI app catalog and endpoint network protection. Purview DSPM for AI then shows which data is actually at risk. The biggest gap is still on the organizational side, but with these tools shadow AI stops being a blind spot and becomes a risk you can manage. For more technical detail on endpoint network protection, see my deep dive: Network protection Defender via Intune: block mode in practice.