Most organisations are not building agents yet. They are rolling out Copilot, standing up an enterprise Claude or ChatGPT tenant, and quietly discovering how much shadow AI is already in use.
Those are three different problems with three different answers. Ranked by what you actually hold: with Copilot you have a control, with sanctioned enterprise chat you have a contract, and with shadow AI you have nothing at all.
Copilot
Inside the tenant. Nothing leaves — but everything the user can read is now findable.
Copilot inherits the user’s permissions. A decade of ‘anyone with the link’ sharing becomes a search index.
DETECT
Oversharing report on SharePoint and OneDrive — files on org-wide or anonymous links
Purview audit of Copilot interactions
DLP alerts on prompt and response content
PREVENT
Remediate permissions before rollout, not after
Restricted SharePoint Search as a fence while you clean up
Sensitivity labels on HR, finance, legal and M&A sites
Sanctioned enterprise chat
Claude or ChatGPT on a commercial tier. Data leaves, under contract.
Terms govern training, retention, region and subprocessors — but only if the tenant setting matches the contract.
DETECT
Read the agreement: training use, retention, subprocessors, region
Screenshot the live tenant setting beside the contract clause
Connector and integration inventory; egress DLP on the API path
PREVENT
Commercial or enterprise tier only — never a consumer tier for business data
Configure region and retention before first use
Connector allow-list; disable file upload where not needed
Shadow AI
Personal accounts on managed devices. Data leaves, with no contract at all.
Consumer terms commonly permit training on inputs. There is no DPA, no retention control and no audit trail.
DETECT
Proxy, DNS or CASB: traffic to consumer AI domains from managed devices
Entra app-consent and OAuth grants to unsanctioned AI apps
Expense reports — individual subscriptions charged to a card
PREVENT
Give people a sanctioned tool first; blocking without an alternative fails
Block consumer AI domains at the proxy once the alternative exists
Browser policy against pasting labelled content into unmanaged sites
The takeaway
Copilot does not leak data — it finds the data you already over-shared. Permission remediation is the control, and it is work you owed anyway. For the other two channels the test is just as blunt: if the contract clause and the live tenant setting disagree, you do not have a control — you have a promise. And shadow AI has neither.
A four-week runbook
What to actually do, in order, with a test at the end that gives an unambiguous answer.
Week 1
Measure before you enable
Run the oversharing report across SharePoint and OneDrive
Pull 90 days of proxy or CASB data for consumer AI domains
List every AI tool already in use, including ones bundled into existing licences
OUTCOMEA number you can show leadership. Expect thousands of over-shared files.
Week 2
Remediate the crown jewels
Remove org-wide and anonymous links on HR, finance, legal and M&A sites
Apply sensitivity labels to those sites, not to individual files
Name a data owner per site — remediation without an owner does not stick
OUTCOMEThe files that would end a career are no longer reachable by search.
Week 3
Fence the rest and give people a path
Restricted SharePoint Search scoped to remediated sites only
Provision the sanctioned enterprise tier and tell everyone it exists
Verify the vendor tenant setting matches the contract clause; screenshot both
OUTCOMEA sanctioned route exists, so blocking the unsanctioned one becomes reasonable.
Week 4
Try to break it
As a pilot user with ordinary permissions, ask for ‘salary bands’ and ‘termination letters’
If either returns, stop the rollout and go back to week 2
Only then block consumer AI domains at the proxy
OUTCOMEAn unambiguous pass or fail that a non-technical executive can understand.
Then keep it closed — five standing controls
Monthly delta
Oversharing report re-run monthly. Track the trend, not the absolute number.
Alerts to the owner
Route DLP alerts to the named data owner, not only to IT. IT cannot judge whether a file is sensitive.
Annual re-verification
Re-check every vendor tenant setting against the contract, and after any vendor migration.
One written rule
What may never leave: CUI, PHI, privileged material, source code, unreleased financials.
Records coverage
Retention, legal hold and eDiscovery extended to prompts and responses, not just files.
Order matters
Do not block first. Blocking consumer AI before a sanctioned tool exists moves the traffic to phones and home laptops, where you cannot see it at all. Sanction, then fence, then block — in that order.
References
Primary guidance
Careful Adoption of Agentic AI Services — ASD’s ACSC, CISA, NSA, the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK, 30 April 2026. The first coordinated Five Eyes guidance on agentic AI; source of the five risk categories and the system diagram. cisa.gov · full PDF
Industry research
Cloud Security Alliance, AI Safety Initiative — research notes on the joint guidance and the 2026 agentic identity survey: 82% of organisations have found unknown AI agents in their environment, 65% had an agent security incident in the past twelve months, and 21% have a formal agent decommissioning process. labs.cloudsecurityalliance.org
Frameworks used for mapping
OWASP Top 10 for LLM Applications — source of the OWASP identifiers on every risk row. The guidance also cites OWASP Top 10 for Agentic Applications (2026), worth reviewing alongside it.
MITRE ATLAS™ — Adversarial Threat Landscape for AI Systems; source of the AML.T identifiers, and named in the guidance as a recommended threat-modelling taxonomy.
NIST AI Risk Management Framework — source of the GOVERN / MAP / MEASURE / MANAGE subcategory references. Those mappings are our derivation, not an official crosswalk.
Also cited in the guidance
NIST SP 800-207 Zero Trust Architecture · CISA 2025 Minimum Elements for a Software Bill of Materials · CISA AI Cybersecurity Collaboration Playbook · NCSC-UK Guidelines for Secure AI System Development · MIT STAMP / STPA-Sec materials
Verification note. OWASP and MITRE ATLAS identifiers change between published versions — check both against the current release before using them in an assessment. The NIST AI RMF subcategory mappings are our derivation; NIST has not published a crosswalk at this granularity. Products named throughout are examples of a control category, not recommendations or an endorsement.
On the product names. Feature names reflect Microsoft 365 and major AI vendor offerings at time of writing. Tiers, names and availability change; verify in your own tenant before relying on any of it.