Key points
- Shadow AI covers AI assistants, meeting note-takers, browser extensions and agents that people connect to work data without approval.
- It is an identity problem. The tools act through work accounts and OAuth grants, and those grants can outlast the person who gave them.
- No single source sees all of it. Sign-in logs, OAuth grants, email metadata and a browser extension each catch what the others miss.
- Decide on each tool with three questions. The answer is approve with an owner, replace, or block.
- A policy people follow names the approved tools and answers requests in days.
What is shadow AI?
Shadow AI is any AI tool people use for work without approval from IT or security. Shadow AI discovery is the work of finding those tools and the access each one holds. It usually turns up four kinds of tool.
- AI assistants that people sign in to with a work email or a personal account.
- Meeting note-takers that join calls and read the calendar.
- Browser extensions that read the pages people open, to summarize or rewrite them.
- AI agents connected through OAuth, acting in mail, files or tickets as the person who connected them.
The habit runs from the newest hire to the security team. In UpGuard's State of Shadow AI research, 81% of employees and 88% of security leaders reported using unapproved AI tools.
Shadow AI is one part of shadow IT. This article covers what is different about AI tools, and how to deal with them.
Why is shadow AI an identity problem?
Most AI tools reach company data through an identity. A person signs in with a work account, or approves an OAuth grant, and the tool acts as them.
- Broad grants. Hannah Brooks in sales signs in to an AI note-taker with her work account. It asks for Mail.Read, Calendars.Read and offline_access, and she clicks Accept. Microsoft's documentation says Entra ID lets users consent to permissions like these by default. offline_access lets the tool keep reading after she closes the tab.
- Data leaving. Whatever people paste or upload goes to the vendor, under terms nobody at your company agreed to.
- Accounts that outlive people. Riley Adeyemi, a contractor, signed up for an AI writing tool with a work email and a password. You disable the directory account when the contract ends. The AI account keeps working, with Riley's uploads still in it.
- Agents with standing access. An AI agent connected through OAuth is a non-human identity. It holds a token and acts with no person at the keyboard.
Tightening consent later does not clean up the past. Microsoft's guide to user consent settings says a change affects future consent only. Grants people gave before it stay in place.
Where does shadow AI show up?
Shadow AI shows up in four places you can read today. Each one sees part of the picture.
| Source | What it shows | What it misses |
|---|---|---|
| Sign-in logs | AI tools that use single sign-on, and who signs in | Tools reached with a password or a personal account |
| OAuth grants | Tools people let into their account, with the scopes each one asked for | Tools that never ask for company data |
| Email metadata | Sign-up confirmations, invites and invoices from AI vendors | What the tool can reach |
| A browser extension | AI sites people sign in to directly, with a password | Browsers you do not manage |
AI browser extensions are a case of their own. If you manage browsers centrally, the management console lists the extensions installed on each one and the permissions they hold.
Some use leaves no trace in any source. A personal account on a personal phone never touches your systems. Your policy has to reach those people, because your logs cannot.
Which AI grants should you look at first?
Look first at the grants that reach the most data, held by the most people. Sort the OAuth grants to AI tools by four things.
- What the scopes reach. Mail, files and calendars come first. Write access ranks above read access. offline_access means the access continues without the person.
- How many people granted it. One grant is a person trying something. Forty grants are a team workflow with no owner.
- Whether the publisher is verified. Microsoft recommends user consent only for apps from a verified publisher. An unverified AI tool with mailbox access goes to the top.
- Who granted it. A delegated grant acts with the person's own rights. A grant from an account with admin roles can reach more.
A note-taker that forty people allowed to read their mail outranks a writing tool one person tried with a basic sign-in.
How do you decide what to do with each AI tool?
Ask three questions about each tool, in order.
- Does a tool you already pay for do the same job? If yes, replace it.
- Can the vendor meet your data terms? Think retention, where data is stored, and whether your data trains their models. If not, block it.
- Will someone in the business own it? If yes, approve it with that owner. If nobody will, block it.
| Decision | What you do next |
|---|---|
| Approve | Name the owner, record the scopes you accept, and set a review date |
| Replace | Point people to the tool you pay for today, give them a date, then remove the old grants |
| Block | Revoke the grants, stop new consent to the app, and tell people what to use instead |
Blocking takes more than one click. In Entra ID, you revoke grants that users gave through Graph or PowerShell, because the admin center cannot. Microsoft also notes that revoking a grant does not stop a person from consenting again. UpGuard's press release for its research makes a related point: people find ways around blocked apps. A block works best with a named alternative.
What should an AI tool policy say?
A policy people follow is short, names real tools, and gives a faster answer than a workaround. Put these six things on one page.
- The approved tools, by name, and what each one is for.
- A request path that answers within a few days.
- Data rules. Say what never goes into any AI tool: customer records, credentials, source code, or whatever your data classes call restricted.
- A connection rule. No AI tool gets access to mail, files or calendars without review. Set user consent in your identity provider to match.
- An owner for each approved tool, who answers for it at review.
- A leaver step. AI accounts and grants come off at offboarding, like any other app.
Awareness is the weak point. UpGuard's press release for the research says 52% of employees are familiar with their company's AI usage policy. Link it from the request form. In Entra ID, the admin consent workflow turns a blocked consent into a request.
How EnscureX Discover finds AI tools
Discover reads email metadata, OAuth grants from Entra ID, sign-in logs and a browser extension. Its discovery catalog flags AI tools. When someone grants an AI tool access, Discover catches the grant as it happens, with the scopes it asked for. See shadow AI for how a grant is read.
Each application gets a risk score from 0 to 100. In the app catalog, each one carries an owner and a status: sanctioned, under review or blocked. The AI tools nobody approved page shows the whole path.
Whatever you use, start with this week's OAuth grants. They show which AI tools reach your data today.
Frequently asked questions
Is ChatGPT shadow AI?
It depends on how people use it. A company workspace you approved, with an owner, is sanctioned. The same tool on a personal account, holding company data, is shadow AI.
How often should you look for new AI tools?
Watch OAuth grants as they arrive, because a grant is access from the moment someone clicks Accept. Review the full list of AI tools each month, and each approved tool at its review date.
Are AI features inside approved apps shadow AI?
Not in the same way. The app has an owner and a contract. Ask the owner to check what the new feature does with your data, and record the answer at the next review.
Who should own shadow AI?
Security owns discovery and the policy. Each approved tool needs a business owner who decides who uses it and answers for it at review.