We take IT off your plate.
Discover leading Managed IT Service Providers across USA, Canada & the United Kingdom.
- 100s of leading MSPs
- Find a MSP near you
- Latest IT news for SMBs
How to Control Shadow AI with Microsoft Purview DLP | Sourcepass MCOE
Generative AI adoption is happening faster than many organizations can govern it. While security teams are still evaluating acceptable use policies and data handling requirements, employees are already using AI tools to analyze spreadsheets, summarize documents, review contracts, generate code, and create business content. The challenge is not necessarily the AI applications themselves. The bigger concern is that sensitive data may be copied, pasted, uploaded, or shared with AI services that have not been reviewed through established security, privacy, or compliance processes. Without visi
Generative AI adoption is happening faster than many organizations can govern it. While security teams are still evaluating acceptable use policies and data handling requirements, employees are already using AI tools to analyze spreadsheets, summarize documents, review contracts, generate code, and create business content. The challenge is not necessarily the AI applications themselves. The bigger concern is that sensitive data may be copied, pasted, uploaded, or shared with AI services that have not been reviewed through established security, privacy, or compliance processes. Without visibility into how AI is being used and what information is being shared, organizations can quickly find themselves exposed to data protection, regulatory, and governance risks. For organizations invested in Microsoft 365, Microsoft Purview provides a framework for discovering AI usage, understanding data exposure risks, and enforcing controls that protect sensitive information. The goal is not to slow AI adoption. The goal is to ensure employees can use AI productively without putting organizational data at risk. Why Shadow AI has Become a Data Protection Challenge Many organizations initially view shadow AI through the lens of application governance. The first questions are typically straightforward: Which AI tools are employees using? Have those tools been approved? Should specific applications be blocked? Does the vendor meet security and compliance requirements? These questions are important, but they only address part of the problem. Consider a few common scenarios: A user pastes customer information into ChatGPT to generate a report. A developer uploads proprietary source code to an AI coding assistant. A salesperson submits confidential pricing information to create a presentation. A legal professional uploads contract language for summarization and review. In each case, the primary risk is not necessarily the application itself. The risk is the information being shared. Effective AI governance requires organizations to answer two separate questions: Which AI applications are permitted? What information can be shared with those applications? Without both controls in place, organizations are only addressing half of the risk. Understanding the Difference Between Application Governance and Data Governance One of the most effective ways to approach shadow AI is to separate application governance from data governance. Application Governance Determines Whether the AI Tool is Allowed Application governance focuses on evaluating the AI service itself. This includes assessing how the provider handles data, whether the platform meets security requirements, how information is retained, and whether the application should be approved, restricted, or blocked. Organizations commonly evaluate factors such as: Vendor security controls Data retention policies Training data usage Regulatory compliance Contractual protections Data Governance Determines Whether the Information is Allowed Data governance focuses on the content users are sharing. Key questions include: Does the prompt contain confidential information? Is regulated data being uploaded? Does the activity involve intellectual property? Should the interaction be monitored, warned, or blocked? Application governance determines whether the platform is acceptable. Data governance determines whether the information being shared is acceptable. Organizations need both. Which Microsoft Security Tools Help Manage Shadow AI Microsoft provides several overlapping security capabilities, but three services play the most significant role in detecting and controlling shadow AI activity. Solution Primary Purpose Key Question Answered Microsoft Defender for Cloud Apps AI discovery and governance Which AI applications are being used? Microsoft Purview DSPM for AI Visibility and risk analysis How are users interacting with AI? Microsoft Purview Endpoint DLP Data protection enforcement What sensitive data should be monitored or blocked? Microsoft Defender for Cloud Apps Microsoft Defender for Cloud Apps helps organizations discover generative AI applications being accessed across the environment. Security teams can evaluate usage patterns, review risk information, and classify AI services as sanctioned or unsanctioned. A discovery-first approach provides visibility into existing AI adoption before enforcement controls are introduced. Microsoft Purview DSPM for AI Microsoft Purview Data Security Posture Management for AI helps organizations understand how AI interacts with business data. It provides visibility into AI activity, oversharing risks, missing controls, and potentially sensitive interactions. Rather than serving as an enforcement tool, DSPM for AI helps organizations understand where risk exists and where additional controls may be necessary. Microsoft Purview Endpoint DLP Endpoint Data Loss Prevention extends Microsoft Purview policies directly to managed endpoints. It can identify sensitive information being copied, pasted, uploaded, or transferred to supported AI applications and websites, allowing organizations to audit, warn, or block activity based on business risk. Together, these technologies allow organizations to discover AI usage, assess risk, and enforce controls where necessary. Common Shadow AI Risks Organizations are Discovering Many discussions around shadow AI focus exclusively on apps like ChatGPT. In reality, organizations are encountering several different categories of AI-related risk. Sensitive Information Shared Through AI Prompts Employees frequently use AI to speed up research, writing, and analysis. In doing so, they may unintentionally submit: Customer information Financial data Internal project details Contract language Employee records Source Code Exposure Developers often use AI assistants to troubleshoot issues, document applications, or improve code quality. Without appropriate controls, proprietary code can leave approved development environments and be submitted to external services. Unapproved AI Applications Business units frequently adopt AI tools without involving security, compliance, legal, or IT stakeholders. This creates visibility gaps and makes governance more difficult. Personal AI Accounts Even when approved enterprise AI tools are available, employees may continue using personal AI accounts because they are familiar or convenient. These environments often lack organizational controls and administrative oversight. AI Browser Extensions AI-powered browser extensions may appear low risk, but many can process copied text, uploaded files, webpage content, and user interactions. Without proper visibility, organizations may not realize how business information is being handled. The challenge is rarely a single application. The challenge is maintaining visibility as AI adoption continues to expand. How Microsoft Endpoint DLP Protects Sensitive Data in AI Applications One of the biggest advantages of Endpoint DLP is that it shifts the conversation from controlling applications to protecting data. Rather than attempting to block every AI tool, Endpoint DLP evaluates the information being shared and applies policy controls based on risk. Organizations can create policies based on: Sensitive information types Sensitivity labels Credential detection Financial data Personal information Custom classifications User risk indicators Device conditions Depending on policy configuration, organizations can: Audit activity Generate alerts Display policy tips Require business justification Block the action entirely An example might look like this: Scenario Recommended Action User submits public information to an AI tool Allow User uploads an internal business document Audit User submits regulated customer information Warn User uploads a highly confidential file Block This creates a far more flexible governance model than relying exclusively on application blocking. What to Validate Before Deploying Shadow AI Controls Before implementing policies, organizations should validate several foundational requirements. Devices are onboarded to Microsoft Purview Endpoint telemetry is reporting correctly Supported browsers are configured Required browser extensions are deployed Sensitive data classifications are defined DLP policies are running in audit mode Licensing requirements have been reviewed Skipping these validation steps often leads to incomplete visibility, inconsistent enforcement, and significant troubleshooting later in the deployment process. How to Take a Structured Approach to Controlling Shadow AI Organizations that successfully govern AI adoption typically follow a phased approach. Start by Discovering AI Usage Before deploying controls, establish a baseline understanding of: Which AI tools are being used Who is using them Which departments rely on them Whether sensitive information is involved Visibility should always come before enforcement. Identify and Classify Sensitive Information Determine which data categories require protection. Common examples include: Customer information Intellectual property Financial records Source code Credentials Legal documents Employee data Not every category requires the same level of enforcement. Deploy Policies in Audit Mode Audit mode allows organizations to understand user behavior before interrupting workflows. During this phase, review: False positives User activity Business impact Sensitive interactions This is typically where policy tuning occurs. Introduce User Education Through Policy Tips Many organizations find success by educating users before blocking activity. Policy tips create awareness, reinforce acceptable use guidelines, and reduce accidental policy violations. Enforce High-Risk Controls Once policies have been tested and refined, organizations can begin enforcing controls for the highest-risk scenarios. This commonly includes: Credential exposure Sensitive customer information Highly confidential documents Unauthorized uploads to AI applications Regulated information At this stage, controls become measurable, enforceable, and aligned with business risk. Common Mistakes Organizations Make When Managing Shadow AI Several challenges appear consistently across shadow AI initiatives. Treating AI Governance as Only an Application Problem Blocking AI websites alone does not prevent sensitive information exposure. Data protection should remain the primary objective. Moving Directly to Enforcement Organizations that skip auditing often create unnecessary friction and generate avoidable user frustration. Overlooking Browser Activity Not every browser, extension, or AI client behaves the same way. Validation is critical before assuming complete visibility. Overclassifying Data Broad classifications can generate excessive alerts and administrative overhead. Focus first on the information that creates the greatest business risk. Treating Governance as a One-Time Project AI adoption continues to evolve rapidly. Discovery, monitoring, and policy refinement should be ongoing operational processes rather than one-time implementation efforts. How Microsoft Purview Helps Organizations Govern Shadow AI Shadow AI is ultimately a data protection challenge, not simply an application governance challenge. While understanding which AI tools are in use remains important, the larger concern is knowing what information users are sharing and whether those interactions align with organizational policies. Microsoft Defender for Cloud Apps helps organizations identify AI usage. Microsoft Purview DSPM for AI provides visibility into how business data interacts with AI services. Microsoft Purview Endpoint DLP adds enforcement by monitoring and controlling sensitive information at the point of interaction. When combined, these capabilities provide an effective framework for adopting AI while maintaining visibility, governance, and control over the data that matters most. Find Out Where Shadow AI Already Exists in your Environment Most organizations already have employees using AI tools that security and IT teams have not reviewed. The question is how much sensitive information is reaching those tools today, and whether your current Microsoft 365 licensing already includes the controls to manage it. Sourcepass MCOE helps organizations find and govern shadow AI using Microsoft Purview, Defender for Cloud Apps, and Endpoint DLP. We can assess current AI usage, define which data needs protection, run policies in audit mode, and move to enforcement without disrupting how your teams work. Ready to get visibility into how AI is being used across your organization? Schedule a shadow AI assessment with Sourcepass MCOE to see which tools employees are using, what data is at risk, and which controls to put in place first.
Read full post on blog.sourcepass.com
MSPdb™ News
What Law Firms Need to Know About AI and Client Trust
Can AI keep client secrets? A practical guide to AI for North Carolina law firms, covering the ethics rules, safe uses, vendor vetting, and where attorneys must stay in charge.
Can AI keep client secrets? A practical guide to AI for North Carolina law firms, covering the ethics rules, safe uses, vendor vetting, and where attorneys must stay in charge.
Read full post on netfriends.com
Protecting Customer Outcomes in Volatile Times
In the AI Economy, technology value is shifting from what gets delivered to the measurable business outcomes those investments create.
In the AI Economy, technology value is shifting from what gets delivered to the measurable business outcomes those investments create.
Read full post on resources.compugen.com
AI Consulting in Chicago: What It Does and When You Need It
How Healthcare Data Privacy Changed, and What Security Risks Matter Most Today?
Healthcare data privacy has evolved from protecting physical medical records to securing electronic protected health information (ePHI) across a highly connected environment. While electronic health records made patient information easier to access and share for care, but digitization also expanded the number of systems where sensitive information can be exposed. The 2026 Verizon Data Breach Investigations Report found from 1,492 healthcare security incidents, including 1,438 confirmed disclosuresthat system intrusion accounted for 61% of healthcare breaches in its dataset, up from 53% in 202
Healthcare data privacy has evolved from protecting physical medical records to securing electronic protected health information (ePHI) across a highly connected environment. While electronic health records made patient information easier to access and share for care, but digitization also expanded the number of systems where sensitive information can be exposed. The 2026 Verizon Data Breach Investigations Report found from 1,492 healthcare security incidents, including 1,438 confirmed disclosuresthat system intrusion accounted for 61% of healthcare breaches in its dataset, up from 53% in 2025's report. Today, understanding how healthcare reached this point helps explain why protecting patient data now requires both HIPAA compliance and an active cybersecurity strategy.
Read full post on blog.centretechnologies.com
What Is Shadow AI? Where It Hides in a Small Business
Shadow AI is AI being used for work that the business never approved. Here are the four places it hides in a small business - personal sign-ups, features inside software you already own, meeting recorders and browser add-ons - and what to do about it, in order.
Shadow AI is AI being used for work that the business never approved. Here are the four places it hides in a small business - personal sign-ups, features inside software you already own, meeting recorders and browser add-ons - and what to do about it, in order.
Read full post on tvgconsulting.com
AI-Powered Sentiment and Priority Scoring: Stop Missing Urgent Client Requests
Every small business executive knows the feeling: a buried email from your best client that should have been escalated three hours ago. A Slack message marked “routine” that contained contract-threatening language. A support ticket that sat in the general queue while the client quietly shopped your competitor. AI-powered sentiment and priority scoring fixes this. Today.... <p>
Every small business executive knows the feeling: a buried email from your best client that should have been escalated three hours ago. A Slack message marked “routine” that contained contract-threatening language. A support ticket that sat in the general queue while the client quietly shopped your competitor. AI-powered sentiment and priority scoring fixes this. Today.... <p>
Read full post on xitx.com
Windows 10 ESU Year Two: How to Decide What Technology to Carry Into 2027
Every office has a few technology habits that nobody chose on purpose. A computer takes ten minutes to start, so its owner makes coffee while it loads. A spreadsheet copies data between two systems that were never connected. A device still runs an old operating system because it hosts one application nobody wants to touch.
Every office has a few technology habits that nobody chose on purpose. A computer takes ten minutes to start, so its owner makes coffee while it loads. A spreadsheet copies data between two systems that were never connected. A device still runs an old operating system because it hosts one application nobody wants to touch.
Read full post on kairosit.com
Co-Managed IT Services: What to Outsource When You Already Have an IT Team
Already have an IT team but need more capacity or specialist support? Learn what to delegate through co-managed IT services, what to keep in-house, and how to define responsibilities, handoffs and approvals before choosing a provider.
Already have an IT team but need more capacity or specialist support? Learn what to delegate through co-managed IT services, what to keep in-house, and how to define responsibilities, handoffs and approvals before choosing a provider.
Read full post on ctmsit.com
The Vendor Fraud Email That Already Knew Your Supplier's Name
The most convincing invoice fraud looks exactly like a normal bill. See how it works and the simple checks that keep the money where it belongs.
The most convincing invoice fraud looks exactly like a normal bill. See how it works and the simple checks that keep the money where it belongs.
Read full post on cnwr.com
When Everything Feels Like a Priority, How Do You Build an IT Budget?
If your roof is leaking and your kitchen is showing its age, both may need work. But only one of them is going to ruin your week. Your IT budget can put you in the same position. There may be plenty worth spending money on, but deciding what comes first isn’t always obvious. A few
If your roof is leaking and your kitchen is showing its age, both may need work. But only one of them is going to ruin your week. Your IT budget can put you in the same position. There may be plenty worth spending money on, but deciding what comes first isn’t always obvious. A few
Read full post on timefortitan.com
Just Added to MSPdb™
MSP Jobs
All Jobs
MSP Marketplace
View All
Popular MSPs
View All
