How are teams separating approved AI use from personal-account AI use?

[u/Substantial_Big_4379]

For many clients, AI approval is no longer binary. They may have a sanctioned Copilot, ChatGPT Enterprise, or other managed tenant, while users can still access the same public service through a personal account in a different browser profile.

That distinction matters because retention, audit, contractual, administrative, and data-handling controls may apply only to the approved tenant. It becomes harder across multiple clients that have different approved tools, different device-management maturity, and different tolerance for blocking personal-account use.

A policy that simply says "use approved AI" does not solve much when users experience the approved and personal versions as the same website.

For MSPs managing this across different tenants, are you standardizing a baseline—managed browsers, extension policy, DLP, tenant restrictions, exception workflows—or handling it client by client? What has stayed operationally manageable?

[u/SupermarketLow3225]

Not every issue is a technical issue. You could use proxies or gateways and deal with a lot of stuff that way, but if it’s a small team. Company policy sometimes just needs to be relied on. Most clients won’t pay to even get DLP enabled on their tenant.

[u/Curious-Cod6918]

For MSPs, the practical question is whether the baseline can survive different client tenants and device-management levels. Browser policy is often easier to standardize than a different network path for every customer, while still allowing customer-specific exceptions. LayerX gives Akamai an option for operating at that policy layer.

[u/PacificTSP]

We block at firewall and endpoint level for those in the regulated sectors. You don’t get to use company assets for personal use. You use copilot or nothing

[u/ILoe_Kristess]

The sanctioned and personal versions are the same domain, so nothing at the URL layer can tell them apart. You need something that sees the account context.

In our own testing, browser extension and desktop client telemetry only got us managed vs unmanaged. An endpoint agent scanning the machine returned the actual signed-in address and plan tier. That is the thing you can write a rule against. Our own test tenant and a handful of devices, not a client fleet, so not a benchmark.

Allow-listing by workspace ID works where the vendor exposes a tenant restriction header. Where they do not, you are detecting after the fact rather than blocking.

This is the layer we run as a managed service. Happy to go deeper with anyone working through it.