Confidential Sites Pilot
Find who can reach your confidential sites, label the content inside them and test the enforcement.
See the engagementSHADOW AI
Find the AI your people already use. Then decide, app by app.
Someone on your team pasted client work into an AI tool nobody approved, and you cannot name the tool. We read what your managed devices already know and get security, legal and the business to sign one app list. Then we test a scoped block in your change window, before anyone is surprised.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Confirm licensing, named accounts and the managed pilot devices, and record the coverage gaps before anything is blocked.
- Collect the Cloud Discovery data and check which devices and people it actually covers.
- Security, legal and the business sign one list, sanctioned, monitored and unsanctioned, with an exception owner on it.
- Test a scoped warning or block in your change window, validate the approved tool and the exception path, and hand over the evidence.
WAYS TO START
The fixed engagements behind this page.
Client Data and AI Pilot
Trace where client data actually goes before the first enforced block lands on it.
See the engagementGoverned AI Briefing
Security, legal and the business leave with one question, the pilot that answers it and the scoping call booked.
See the engagementTHE PROBLEM
Why can nobody name the AI tools in use at your firm?
Because they arrive as browser tabs, extensions and free accounts under personal logins, and the only inventory is what people admit to. The discovery data in your own Microsoft 365 already holds the names; nobody has read it with a decision in mind.
An app block without a coverage statement disrupts approved work while the unobserved use carries on. The pilot starts by writing down which devices and people the discovery actually sees. The first list says what it covers and what it does not, and the block is scoped to what was tested.
THE MICROSOFT INSIGHT
What does your Microsoft 365 (your tenant) already know about the AI apps in use?
Microsoft Defender for Cloud Apps lists generative AI apps as a category, and an app tagged Unsanctioned is blocked on devices onboarded to Microsoft Defender for Endpoint, with up to three hours of propagation.
Microsoft Defender for Cloud Apps lists generative AI apps as a category, and an app tagged Unsanctioned is blocked on devices onboarded to Microsoft Defender for Endpoint, with up to three hours of propagation. (Microsoft Learn, checked Oct 31, 2026)
Tag the app after the signed decision and the block is a control with a propagation time and an exception owner. Write a memo instead and the block is a request.
THE METHOD
What happens in the four weeks?
Discovery, a signed decision list, a scoped test and a handover, each ending in a record you review before acceptance.
- Week 0: confirm licensing, the named accounts your team creates and the managed pilot devices.
- Week 1: collect the Cloud Discovery data and check coverage. By the end of the week you hold a dated AI app inventory, with device coverage and the gaps.
- Week 2: security, legal and the business approve the app decision list: sanctioned, monitored, unsanctioned, with an exception owner.
- Week 3: test a scoped warning or block in a change window you choose, on the pilot device group.
- Week 4: validate the approved tool and the exception path, then hand over the runbook, the test record and the access closeout.
THE NEW REACH
What about agents running on laptops, not in a browser tab?
Since October 2026 Microsoft Defender for Endpoint discovers local AI agents and their configured MCP servers on onboarded Windows and macOS devices and lists them in the AI agent inventory. So the decision list can include the agents a developer installed, not only the sites a browser visited.
Since October 2026 Microsoft Defender for Endpoint discovers local AI agents and their configured MCP servers on onboarded Windows and macOS devices and lists them in the AI agent inventory and advanced hunting. (Microsoft Learn, checked Nov 4, 2026)
Read that inventory in week one and the local agents are rows on the decision list with an owner. Skip it and the first one you hear about is the one in an incident report.
WHAT IT IS NOT
Does a block fix the data problem?
No. This pilot decides which apps may be used and proves the block and the exception path. What people put into the approved apps is the Client Data and AI pilot. Unmanaged and mobile devices are outside this scope and recorded as gaps.
Coverage needs licensed Microsoft Defender for Cloud Apps and devices onboarded to Microsoft Defender for Endpoint Plan 2 or Defender for Business. Network protection and the integration between them must be on. The first review records the gaps before any warning or block, and Microsoft licenses and consumption are separate from the engagement.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold a dated AI app inventory with its coverage limits and the gaps named.
- Security, legal and the business have signed one list, sanctioned, monitored and unsanctioned, with an exception owner.
- A scoped warning or block has run in your change window on managed devices, and the approved tool and the exception path were tested.
- You hold the runbook, the test record and the access closeout, reviewed before acceptance.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not see traffic from devices you do not manage. Microsoft Entra Internet Access, in the Microsoft Entra Suite or standalone with Entra ID P1 or P2, includes prompt injection protection, shadow AI discovery, TLS inspection and data loss prevention for web traffic, and its network controls for agents need a Microsoft Agent 365 license. (Microsoft Learn, checked Nov 4, 2026) Where Microsoft Entra Internet Access is in place, its shadow AI discovery and prompt injection protection cover the network path as well, and its agent network controls need a Microsoft Agent 365 license; the pilot reads that discovery too, and the gaps that remain are written down.
It does not cover unmanaged or mobile devices, or what people type into the approved tools. Those are recorded as gaps and belong to the Client Data and AI pilot.
It does not ask for Global Administrator. We use named accounts in your own Microsoft 365 with Defender and Intune roles that carry only what the task needs. They are activated through Privileged Identity Management in agreed change windows and removed at closeout.
THE ONE THING TO REMEMBER
One approved AI app list with tested exceptions.
Said another way: discover, decide, block, with an exception owner on every line.
Said a third way: a block you tested in a change window is a control; a block you announced is a slide.
SHOW YOUR WORK
See the control path on a fictional bank.
Shadow AI at the first gate
Hartwell Trust Bank checks an outside AI use case with fictional data.
Coming
See every demonstrationDIRECT ANSWERS
Questions before you decide.
What do we need to have in place?
Managed Windows devices onboarded to Microsoft Defender for Endpoint Plan 2 or Defender for Business. Microsoft Defender for Cloud Apps, with network protection and the integration between them switched on. Where any of those is missing, the first review records it as a coverage gap instead of pretending the list is complete.
Who makes the app decisions?
Security, legal and the business, in week two, in writing. Nothing is tagged sanctioned or unsanctioned without the signed list. The approved tag changes are made by your own Cloud Discovery administrator; our accounts can inspect discovery but cannot tag or sanction an app.
Will the block disrupt work?
It is scoped on purpose. A warning first, or a block on the pilot device group, in a change window you choose. The exception path is tested before anything widens. The exception owner is named on the list before the first block runs.
Is this the same as Copilot governance?
No. Copilot governance is about what an approved assistant can see. This is about which tools may be used at all and what happens when one is not approved. The policy builder on this site writes the clause about finding what is in use. This pilot is the discovery, the list and the block behind that clause.
How is it priced?
Quoted after a scoping call. The engagement is four weeks, read-only until the list is signed, and scoped separately from the Client Data and AI pilot. No price appears on this site.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.