What shadow AI is, and why it matters
Shadow AI is any AI tool your people use for work that the company hasn't approved or doesn't manage: a personal ChatGPT, Claude or Gemini account, a browser extension, or a free tool someone found last week.
The work itself is usually well meant. The problem is where the data goes. Contracts, client files and internal numbers end up in accounts outside your admin controls, retention policies and audit trail, often on plans the company pays for twice or not at all.
Blocking everything rarely works. People need an AI tool that is at least as good, already inside the apps they use, and approved.
Source: Microsoft Learn: Discover and manage generative AI apps
- No visibilityIT can't see which AI tools are used, by whom, or with what data
- No controlPersonal accounts sit outside your admin, retention and eDiscovery
- No audit trailWhen someone asks what was shared, there is no record to check
- Double spendTeams expense AI subscriptions on top of Microsoft 365
How we find, control and replace shadow AI
Three steps, using Microsoft tools most Microsoft 365 companies already license or can add.
Find it
Microsoft Defender for Cloud Apps lists the generative AI apps in use from its cloud app catalog. Microsoft Purview DSPM for AI shows visits to third-party AI sites such as ChatGPT and Gemini, and sensitive data sent to them, once the Purview browser extension is deployed.
Control it
Apps marked unsanctioned in Defender for Cloud Apps are blocked on devices onboarded to Defender for Endpoint. Endpoint DLP can stop people pasting or uploading sensitive data to AI sites. We start in simulation mode so nothing breaks on day one.
Replace it
We give people Microsoft Copilot, inside Word, Excel, Outlook and Teams, and rebuild the assistants they made elsewhere as Copilot agents. Copilot only shows people data they already have permission to see.
What the assessment shows you
Which AI tools are in use
Sanctioned and unsanctioned, from Defender for Cloud Apps and your spend records, including subscriptions paid by expense report.
What data is at risk
Where sensitive data is reaching third-party AI sites, from Purview DSPM for AI.
What people actually need
The tasks behind the shadow tools, so the approved replacement covers them.
What to switch on, and when
A dated plan for discovery, blocking, DLP and the move to Copilot, with simulation first.
Personal AI accounts vs Microsoft Copilot at work
The difference isn't how clever the assistant is. It's who controls the data.
| Topic | Personal AI account used for work | Microsoft Copilot with a work account |
|---|---|---|
| Who manages the account | The employee | Your Microsoft 365 admins |
| Company data it can see | Whatever the person pastes or uploads | Microsoft 365 data the person already has permission to see |
| Retention and eDiscovery | Outside your policies | Microsoft Purview; Copilot memory is searchable in eDiscovery |
| Data protection | Depends on the person's plan and settings | Enterprise data protection for work accounts |
| When someone leaves | The account and its history leave with them | Access ends with their work account |
Copilot memory is not covered by Purview retention policies, and custom instructions are not searchable in eDiscovery. If your retention rules are strict, we plan around that.
Six steps, nothing lost
Each step has an owner and a sign-off, so nothing quietly breaks along the way.
- AssessWe inventory who uses what: assistants, prompts, files, integrations and spend.
- MapEvery piece gets a home in Microsoft 365, or a reason to retire it.
- RebuildAssistants, connectors and prompt libraries are rebuilt and tested before anyone switches.
- PilotA small group works in the new tool first. We fix what they flag.
- TrainShort sessions built around your team's real tasks, the old way next to the new way.
- Switch overEveryone moves, chat history is archived, and old licenses are retired.
Questions we hear most
What is shadow AI?
AI tools people use for work without company approval or management, such as personal ChatGPT, Claude or Gemini accounts and AI browser extensions. The risk is company data leaving your controls.
How do we find out which AI tools our people use?
Microsoft Defender for Cloud Apps can filter its cloud app catalog to the Generative AI category to show what is in use. Microsoft Purview DSPM for AI can show visits to third-party AI sites and sensitive data sent to them when the Purview browser extension is deployed.
Can we block unapproved AI apps?
Yes. Apps marked unsanctioned in Defender for Cloud Apps are blocked on devices onboarded to Defender for Endpoint, and endpoint DLP can block pasting or uploading sensitive data to AI sites. We recommend simulation mode first, and an approved alternative before you block.
Isn't banning AI simpler?
It usually pushes the use further out of sight. Giving people an approved tool that works inside their everyday apps, and then blocking the rest, is what reduces the risk.
Does Copilot use our data to train its models?
Microsoft says prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation models used by Microsoft Copilot.
Is eMazzanti affiliated with OpenAI, Anthropic or Google?
No. eMazzanti Technologies is an independent IT services company and a Microsoft partner, and offers this service with Messaging Architects. Neither is affiliated with or endorsed by OpenAI, Anthropic or Google.
Who does the work
eMazzanti Technologies is an IT services company and Microsoft partner, and runs AI migrations together with Messaging Architects. A few things we have done before:
Microsoft partner
Named Microsoft's SMB Worldwide Partner of the Year, with Modern Work and Azure specializations.
A New Jersey Best Place to Work
Named one of New Jersey's Best Places to Work for 2026 by NJBIZ, based on a confidential survey of our own team.
We teach Copilot
eMazzanti runs Microsoft Copilot Master Classes for business teams. The training step of every migration comes from the same people.
The migration process was flawless, with zero downtime, and their cost-effective solutions have significantly enhanced our operational efficiency.
There's absolutely no hesitancy for me to recommend eMazzanti to anyone.
Keep reading
See your plan before you commit to anything.
The chat at the top builds a migration outline for your team in about two minutes. When you are ready, an eMazzanti migration lead walks through it with you.