What this check looks at
Finds AI assistants, writing tools and meeting note-takers (ChatGPT, Claude, Otter.ai, Fireflies.ai and others, by name and publisher) that hold permissions to mail, files, calendars or meetings, and whether an administrator approved them or people connected them on their own.
Generative AI tools ask for Microsoft 365 access in the same consent prompt as any other app. A chat assistant offers to “connect your OneDrive”, a writing tool to “work in your inbox”, a meeting note-taker to “join your calls”. One click from one person and the tool holds a delegated permission to that person’s files, mail, calendar or meetings, kept by its refresh token until someone removes it.
This check finds AI tools among the apps holding permissions in the tenant, by name and publisher: chat assistants such as ChatGPT, Claude, Gemini and Perplexity, writing tools such as Grammarly, and meeting note-takers such as Otter.ai, Fireflies.ai, Read AI and Fathom. A tool the list does not know, or one renamed, is not found; an unrelated app sharing a name could be, so the evidence names each app for the tenant to confirm. Microsoft’s own Copilot is never counted.
It fails when people connected an AI tool to company data for themselves, with no administrator’s consent for the organisation. It warns when every AI tool with access was approved by an administrator, so the business can confirm it still means to allow each one. It passes when no AI tool reaches more than someone’s name. When some app permissions could not be read, a tenant with nothing found is partly checked, not passed.
Why it matters
People connect AI tools to their mailbox, OneDrive or calendar in a couple of clicks, and the tool then keeps that access. Company mail, documents and meeting recordings can end up in a service the business never assessed, under terms it never agreed, often with no one in IT aware.
What goes into an AI tool goes to its provider: client documents summarised by a free chatbot, board meetings transcribed by a note-taker that then emails the transcript to every attendee, including guests. The business has agreed none of the provider’s terms, may not know where the data is stored, and cannot answer a client who asks.
Note-takers can spread on their own: once one person connects one, many join every meeting that person is invited to and invite the other attendees to sign up. A tenant can go from one note-taker to a dozen in a month.
Banning AI rarely works; deciding which tools are allowed, approving those for everyone with only the permissions they need, and blocking the rest does. ISO 27001 A.5.19 and A.5.15, NIST CSF 2.0 ID.AM-02 (an inventory of software and services) and the NCSC 10 Steps on supply chain security all expect the organisation, not each person, to decide which outside services hold its data.
How to fix it
Where: Entra admin centre → Identity → Applications → Enterprise applications
Before you start
- Ask the people who connected each AI tool what they use it for, and agree which tools the business allows before blocking any.
Step by step
- List the AI tools with the tenant. Open the evidence: each AI tool is listed with what it can reach, whether an administrator approved it or people connected it themselves, and how many people did; its publisher is in the export. Agree with the business which of them it uses on purpose.
- Decide the allowed tools. Write the decision into the acceptable use policy: which AI tools staff may use, with which data, and how to ask for another. A business with Microsoft 365 Copilot often allows that and blocks the rest.
- Block the tools the business does not allow. Tick them on this finding, or choose the tool once in Fix across tenants to block it wherever it has access (an approved change at each tenant, reversible), or block each on the tenant’s Apps page, or in the Microsoft Entra admin centre: Entra ID > Enterprise apps > the app > Properties > Enabled for users to sign in? > No > Save. Blocking stops the tool signing in for everyone; its permissions are kept, so unblocking restores it exactly.
- Approve the tools it keeps. For each allowed tool, have an administrator grant consent for the organisation (Enterprise apps > the app > Permissions > Grant admin consent) with only the permissions it needs, so it is a decision on record rather than a string of individual clicks.
- Stop the next one arriving unasked. Under Enterprise apps > Consent and permissions, allow user consent only for verified publishers and low-impact permissions, and turn on the admin consent workflow so people can ask for a tool rather than simply connect it. Re-run the assessment to confirm.
What users will notice
People lose the AI tools you block. A tool the business keeps carries on, approved by an administrator for everyone.
How to confirm it worked
Enterprise applications: every AI tool still enabled is one the business allows, consented by an administrator.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A4.a Supply chainB2.a Identity verification, authentication and authorisation |
| DSPT | Standard 10: Accountable suppliers |
| DORA | Art. 28 Management of ICT third-party risk |
| NIS2 | Art. 21(2)(d) Supply chain security |
| Microsoft Cloud Security Benchmark | IM-3 Manage application identities securely and automatically |
| Zero Trust | Applications |
| SOC 2 | CC6.3 Role-based access and least privilegeCC9.2 Assessing and managing risks from vendors and business partners |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.19 Information security in supplier relationshipsA.5.15 Access control |
| CIS Controls v8.1 | 5.5 Establish and maintain an inventory of service accounts (IG2) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of dutiesID.AM-02: Inventories of software, services, and systems managed by the organization are maintained |
| NCSC 10 Steps | Identity and access managementSupply chain security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Configure how users consent to applications (Microsoft Learn)
- Discover and manage generative AI apps (Defender for Cloud Apps) (Microsoft Learn)