Shadow IT used to mean someone expensing a project management tool the IT department never approved. Shadow AI is the same habit, except now the unapproved tool is asking for permission to read the mailbox, the calendar, and every file in OneDrive, and a lot of employees click "allow" without a second thought.
AI didn't invent shadow IT. It just gave it an API key.
Every AI note-taker that joins a Teams meeting, every writing assistant that plugs into Outlook, every browser extension that promises to "supercharge your inbox," asks for OAuth permissions during setup. Most employees click through that consent screen the same way they click through a cookie banner: fast, and without reading what's actually being granted. In a default Microsoft 365 tenant, users are often still allowed to consent to third-party app permissions themselves, which means an AI tool can end up with standing access to a mailbox or a calendar without anyone in IT or security ever seeing the request.
Why this is a harder problem than old-school shadow IT
A rogue project management tool is annoying. A rogue AI tool with mailbox and file access is a standing, authenticated connection into your environment that persists until someone actively revokes it, works quietly in the background, and in some cases processes the data it touches on servers you have no visibility into or control over. It doesn't need to be malicious to be a problem. A well-meaning AI meeting assistant with a weak security practice on the vendor's end is still a door into your tenant that nobody in IT knew was open.
What we find when we audit client tenants
- AI meeting bots with standing calendar and Teams access, added by one employee months ago and still joining every meeting on their calendar, including ones with clients and sensitive internal discussions.
- Writing assistants with mail read and send permissions, often requested far beyond what the tool actually needs to function.
- Browser-based AI tools used to summarize or rewrite content, with company data pasted directly into a public chat interface that has no contractual obligation to protect it.
- Personal AI tool accounts linked to a corporate email address purely for convenience, blurring the line between personal and company data completely.
Banning AI tools outright doesn't make shadow AI go away. It just makes sure you never find out which ones your team is actually using.
Getting control without pretending AI doesn't exist
- Restrict user consent for OAuth applications. Require admin review for any app requesting anything beyond basic sign-in permissions, through Entra's app consent policies.
- Run a periodic review of enterprise applications. The Enterprise Apps list in Entra shows exactly what's already been granted access, often with permissions nobody remembers approving.
- Put data loss prevention policies in front of AI tools, where supported, so sensitive content can't be freely copied into a public chat interface from a managed device.
- Give employees an approved option. A properly licensed and governed Copilot deployment gives people a reason not to go looking for a workaround in the first place.
- Train staff specifically on what not to paste into public AI tools. Client data, financial figures, and anything under an NDA should never go into an AI chat window that isn't covered by your organization's data boundary.
The goal isn't to lock AI out of the business. It's to make sure the AI tools your team is using were actually chosen, not just clicked through on a Tuesday afternoon.