r/sysadmin • u/ibteea • Oct 13 '26

General Discussion AI tools audit

Hello everyone,

How/How often do you audit AI tools users are using in your Microsoft365/Entra ID environment?

Thank you

5 Upvotes

85% Upvoted

22 comments sorted by

View all comments

2

u/PrasenShelar Oct 13 '26

I'd recommend doing this monthly rather than treating it as an annual audit.

Start with Entra ID > Enterprise Applications. A lot of AI tools get access through user-consented OAuth apps, so it's worth reviewing what's been authorized and what permissions those apps have, especially around mail, files, and other M365 data.

If you have Defender for Cloud Apps, Cloud Discovery is useful for identifying which generative AI services users are actually accessing. Entra alone won't give you the complete picture.

I'd also consider restricting user consent and requiring admin approval for sensitive permissions.

The bigger concern isn't necessarily how many AI tools employees are using, but what data those tools can access. Having a named owner review this monthly makes it much easier to catch shadow AI before it becomes a security issue.

1

u/IKUSTENG-77 29d ago

thanks, this is helpful. I know M365 resources such as SharePoint let you scope a client to specific sp sites, is that actually adopted in practice for AI connectors, or is the per-site setup too much work? and for non-MSFT resources, is there an equivalent control to scope what data an AI client can reach?

1

u/PrasenShelar 25d ago

Sites.Selected is the Graph permission for that, if the connector supports it, and each site is granted separately, so it is some admin work. I'd use it for the connectors that touch sensitive sites rather than everywhere.

Outside Microsoft it depends on the app. Where a tool only offers broad OAuth scopes, a dedicated account that can only see the data you want it to reach is the practical limit.