Microsoft 365 Shadow AI Controls: Defender Onboarding Limits Blocking

IBM's AI governance survey is real, but its "incidents" are not all breaches​

The numbers trace back to an IBM Institute for Business Value study released June 8, 2026. IBM and Oxford Economics surveyed 2,000 senior executives responsible for IT, technology or AI decisions, across 33 geographies and 19 industries, between January and April 2026. Besides the 77% governance figure, 70% of respondents said teams across the business deploy technology faster than IT can track it. About two-thirds said they are held accountable for AI systems they do not fully control.

AiThority describes the 54 incidents as "agent-related security incidents." IBM defines them more broadly. In its release, the surveyed organizations averaged 54 AI agent incidents in the past year, where an "incident" was any unintended or harmful occurrence that needed human correction. So an agent that produced a wrong output someone had to fix counts, as well as an actual breach. Respondents said 17% of those incidents were high severity, meaning they took more than four hours to contain. Within that high-severity group, 37% caused data exposure or security breaches, 33% caused cascading system failures and 17% led to compliance problems.

The readiness figure also needs a small correction. AiThority says "one in ten" executives feel ready. IBM's figure is 11% who say they are fully ready for the scale of agent deployment expected over the next year, while respondents expect the number of agents they run to grow 38% by 2027. IBM also found that 59% cite security and compliance as top barriers to scaling agents. By IBM's analysis, organizations that build controls into their AI systems have 25% fewer incidents than those that rely on manual governance. That comes from segmenting survey responses, so it shows a pattern, not a guaranteed result.

AiThority also says that 77% of CIOs and CTOs "have lost control" of AI usage. IBM doesn't say that. The 77% refers to organizations reporting that adoption is outpacing governance, which is a less dramatic claim. The survey also doesn't measure the specific shadow-AI routes AiThority describes, such as personal accounts or AI features appearing inside SaaS tools that were already approved. Those are plausible, but IBM's data doesn't show how common they are.

Microsoft Purview and Defender for Cloud Apps already reach beyond Copilot​

AiThority splits Microsoft's approach into two layers. Purview and Defender for Cloud Apps handle third-party AI discovery, and Copilot's admin controls cover only Copilot. That split is roughly right, but it undersells how much Microsoft documents. Microsoft Learn describes four separate discovery tools, each with its own scope:

Defender for Cloud Apps is the tool that deals with shadow AI most directly. Microsoft says its app catalog has a Generative AI category containing more than a thousand AI-related apps. Each app has a built-in risk assessment covering over 90 factors across security and regulatory compliance. Admins can sanction or unsanction apps. They can also write policies that keep finding AI apps based on risk score or daily user count, and unsanction the ones that meet those criteria automatically.

Purview DSPM for AI looks at how company data flows into AI tools. Microsoft says it provides deeper insight for Microsoft's Copilots and for third-party SaaS apps such as ChatGPT Enterprise and Google Gemini. It includes ready-made policies to stop data loss through AI prompts, plus risk assessments for oversharing. Once policies are deployed, generative-AI events show up in Purview's activity explorer and audit logs. These include user interactions with AI sites, DLP rule matches and sensitive information types detected in prompts.

Copilot's own reporting sits in a separate layer, Copilot Analytics. It combines operational reports in the Microsoft 365 admin center, adoption and impact reports in the Copilot Dashboard in Viva Insights, and per-agent analytics in Copilot Studio. These reports track adoption, licensing and business value for Microsoft Copilot, Copilot Chat and agents. They don't discover third-party AI tools, and they aren't meant to. Being accurate about Microsoft's tools means matching each one to its job, not treating them as a single platform that governs only itself.

Microsoft's AI app blocking depends on device onboarding​

None of this works automatically just because a tenant has the licenses. Microsoft's setup guidance for managing generative-AI apps lists prerequisites: Purview has to be configured, and Microsoft Defender XDR has to be set up, including Defender for Cloud Apps and Defender for Endpoint. Microsoft names Defender for Endpoint as the component that stops unsanctioned AI apps from running on onboarded devices.

That onboarding requirement sets the enforcement boundary. When an app is marked unsanctioned, Microsoft says it is blocked automatically on devices onboarded to Defender for Endpoint. Security teams can choose to warn and educate users instead of blocking. Purview has a similar condition: devices must be onboarded to Purview before it can monitor interactions with third-party AI sites. Microsoft notes that device onboarding is shared between Microsoft 365 (including Purview) and Defender for Endpoint, usually after the devices are enrolled in Intune.

The browser is the other gap. Microsoft recommends setting DLP policies for Microsoft Edge and blocking other browsers, so users can't reach unmanaged AI apps through unprotected browsers. In practice, a personal laptop, an unmanaged browser or a device that was never onboarded falls outside Microsoft's enforcement. That's the same shadow-AI route AiThority warns about.

Check Point's AI Network Firewall moves enforcement to the gateway​

Check Point released the AI Network Firewall on July 30, 2026, as part of its R82.20 firewall software. The product is intended to extend AI-related security controls through firewalls customers already use, rather than requiring separate infrastructure. IT Brief reports that it is designed to cover three main areas: employee use of AI applications and tools, including approved and unapproved services; oversight of Model Context Protocol communications used to connect AI systems with external tools and data sources; and protection for AI applications and large language models against prompt injection and other adversarial inputs.

On its R82.20 product page, Check Point says the firewall can control access to AI apps and tools and apply policy to prompts and uploads at the firewall. The R82.20 announcement on the company's community forum says the feature provides visibility and control across employees, applications, and AI agents, with no additional infrastructure or rearchitecting required. AiThority adds that the prompt inspection builds on technology from Lakera, an AI security startup Check Point bought in 2025.

AiThority calls this approach broader than Microsoft's or Zenity's because it doesn't matter which platform or agent framework the traffic comes from. The argument makes sense up to a point. A gateway sees traffic from unmanaged devices and non-Microsoft browsers that endpoint-based controls miss. But the capability claims come from Check Point, and independent coverage such as Cloud News repeats them as the company's statements. No published independent test shows how well the firewall catches leaks or blocks prompt injection. The release also came with Check Point's own research: IT Brief notes the company said it found weaknesses in 40% of the 10,000 MCP servers it reviewed.

The gateway approach has its own blind spot. It only sees traffic that passes through a Check Point enforcement point. A remote worker on home broadband who isn't routed through the corporate network or Check Point's SASE service is outside it. A general point, not specific to Check Point: reading the contents of prompts sent over HTTPS normally requires the firewall to decrypt that traffic. So organizations should expect TLS inspection policy, certificate deployment and licensing to shape real coverage, whatever "no new hardware" suggests.

Zenity's agent-first model, as AiThority describes it​

AiThority's third option is Zenity, which it describes as monitoring the places where employees build and run agents. That covers cloud AI platforms, SaaS platforms such as Copilot and ChatGPT, and individual endpoints. According to AiThority, Zenity's AI Security Posture Management inventories agents at build time, mapping their owners, configurations, permissions and connections. Its AI Detection and Response then watches access and runtime actions once agents go live.

AiThority's view is that Zenity catches agents employees build for themselves, which app catalogs can miss, but doesn't see AI use that doesn't involve agents. Treat that as AiThority's comparison, not the result of any head-to-head test. For Microsoft shops, it overlaps with Entra Agent ID, which Microsoft positions as a single directory of agent identities created in Copilot Studio and Foundry. Microsoft still labels Entra Agent ID a preview, and it covers only agents built on those two platforms.

What Microsoft 365 admins should do first​

Start with the tools you're probably already licensed for. Then add a network or agent layer where your inventory shows gaps. Before you block anything, find out which devices, browsers and network paths your controls can see. A block policy only covers onboarded devices and the traffic your gateway handles.

Inventory AI apps in Defender for Cloud Apps​

1. Sign in to the Microsoft Defender portal, expand Cloud apps, and select Cloud app catalog.
2. Set the Category filter to Generative AI and review the apps and their risk scores, noting any you might monitor or block.
3. Create a custom policy with no template, for example "New Generative AI Apps", with the condition Category equals Generative AI, applied to all continuous reports, so you get an alert when a new AI app appears.
4. To block an app, go to Cloud apps > Cloud discovery, open the Discovered apps tab, filter on Generative AI, and mark the app Unsanctioned. Enforcement applies on devices onboarded to Defender for Endpoint, and you can choose to warn users instead of blocking.

Turn on Purview and check agent identities​

1. Confirm devices are onboarded to Purview, which is shared with Defender for Endpoint onboarding, before relying on DSPM for AI to monitor third-party AI sites.
2. Activate DSPM for AI's one-click default policies, then check the activity explorer and audit logs for AI interactions and DLP matches.
3. Apply DLP policies in Microsoft Edge and restrict other browsers if unmanaged AI access is a concern.
4. In the Microsoft Entra admin center, go to Enterprise applications and set the Application type filter to Agent ID (Preview) to list the Copilot Studio and Foundry agents registered in your tenant.
5. For custom Azure AI apps, open Defender for Cloud's Cloud Security Explorer in the Azure portal and run the "AI workloads and models in use" query template.

Takeaways:

• IBM's 54 "AI agent incidents" include any unintended or harmful event that needed human correction, so don't read the figure as 54 breaches.
• Defender for Cloud Apps is Microsoft's shadow-AI discovery tool, with a Generative AI catalog of more than a thousand apps and per-app risk scores.
• Microsoft's blocking only reaches devices onboarded to Defender for Endpoint, so unmanaged devices and unprotected browsers stay outside it.
• Copilot Analytics measures Copilot and agent adoption, and it doesn't replace third-party AI discovery.
• Check Point's AI Network Firewall in R82.20 moves AI controls to existing gateways, but its effectiveness claims are the vendor's and it only covers traffic that passes through those gateways.
• Entra Agent ID is still in preview and covers only agents built in Copilot Studio and Foundry.

AiThority is right that no single control point covers everything. The better lesson for Windows shops is to work through the gaps in order. Most Microsoft 365 tenants already have app discovery and data-protection controls that go well beyond Copilot. Their limit is onboarding, so the first job is to find which devices and browsers are outside those controls. Once that's measured, you can decide on evidence whether a gateway product like Check Point's R82.20 or an agent-focused tool like Zenity fills a gap you actually have. IBM's respondents expect 38% more agents by 2027, so it's worth getting that coverage map right before the agent count grows.