Shadow AI Is Already in Your Clients' Tenants. Here Is How to See It.

Tell an MSP "your clients' users are pasting corporate data into AI tools nobody manages" and nobody argues. They just had not looked yet.

That is the Shadow AI problem in one sentence. It is not a future risk. It is happening today, quietly, in every tenant you manage — and the detection layer is probably already in your clients' licensing.

What shadow AI actually looks like#

Picture an accounting employee at one of your clients trying to get a proposal out the door. Personal Gmail open in Chrome, new tab, claude.ai with a personal account, upload the draft. The proposal has client names, contract values, and internal pricing.

She is not trying to cause harm. She wants to finish faster. But within 30 seconds that data has left the security perimeter, processed on a server nobody vetted, through an account you have zero visibility into. No alert fires. No ticket gets created. Unless you go looking, you will never know it happened.

And this is not just ChatGPT and Claude. Microsoft's cloud app catalog now tracks over 1,000 generative AI applications — transcript tools, writing assistants, coding tools, meeting summarizers — and the list grows every week as SaaS products bolt AI onto their platforms.

What you need before detection works#

Microsoft ships a native detection layer inside Defender for Cloud Apps. If your clients run Business Premium, they likely already own it. No third-party agents, no extra tooling. Two boxes need checking:

1. Licensing. Microsoft 365 Business Premium or higher (E3/E5 with Defender for Cloud Apps also qualifies). Business Standard and Basic do not include this — flag it during security assessments.
2. Device enrollment. Devices must be enrolled in Microsoft Defender for Endpoint or Defender for Business. The discovery engine reads traffic from managed endpoints, so anything not enrolled is invisible. That caveat matters in mixed environments.

Once both conditions are met, Defender for Cloud Apps starts collecting passively. No policy to write, no switch to flip.

Note: Defender for Business is the SMB version of Defender for Endpoint and is included in Business Premium. Business Premium plus enrolled devices means you are already collecting.

Where to find it in the portal#

Head to security.microsoft.com (opens in new tab) and navigate to Cloud Apps → Cloud Discovery → Discovered Apps. Filter by category and select Generative AI.

You get every generative AI application accessed from managed devices in that tenant, ranked by user count. Sort by users, devices, or traffic volume. The breadth surprises people more than the volume — it is rarely just ChatGPT and Claude, though they usually carry the biggest footprint.

Click into any app for the detail view: total users, total devices, traffic in and out, and the list of individual users. Bytes uploaded is the number to watch. That is data leaving the environment. You cannot see what was uploaded, but you can see that it happened and who did it.

Each app carries a Risk Score out of 10 based on data handling, compliance certifications, and security posture. Below 5 flags red. That does not mean the app is malicious — it means it has not passed enterprise-grade scrutiny, and that is the conversation to have with your client.

For developers: Microsoft has added cloud app discovery data to Microsoft Graph via a beta endpoint. The cloudAppDiscoveryReport and discoveredCloudAppDetail resources under the /beta security namespace let you query discovered apps, pull user lists, and build multi-tenant reporting without screen-scraping the portal. It is in preview as of June 2026 — prototype now, do not ship to production yet.

Three things to know before you start#

Discovery is not enforcement. This shows you what is happening; it does not block anything. Blocking unsanctioned AI apps takes additional Defender for Cloud Apps policy configuration, available in E5 or the Defender Suite add-on for plans like Business Premium. Visibility first, enforcement second.

Personal accounts are a blind spot. A user on claude.ai through personal Gmail on a managed device shows up as traffic to claude.ai — Defender cannot tell you it is a personal account from this view alone. The data is still leaving. Keep that framing with clients. There are ways to lock this down with Claude specifically; that is its own article.

The 90-day window. Cloud Discovery retains data for 90 days by default. Build the check into your QBR rhythm so the window never closes without a baseline captured.

The MSP problem: the data lives in 20 portals#

The detection works. The problem is operational: the data lives in a separate Defender portal for every client. Logging into 20 portals to understand Shadow AI exposure across your book of business is not a workflow, it is a punishment.

That is exactly what we are solving at CloudCapsule. The Shadow AI Report — part of the holistic security assessment, in early access now — pulls Defender for Cloud Apps generative AI discovery across all your tenants into a single view: which clients have the most exposure, which AI apps are most prevalent, and where to start the conversation.