Shadow AI: The Tools Your Team Already Connected to Your Files
TL;DR
– Shadow AI is the unsanctioned third-party AI tools that employees have already connected to a firm’s email, files, calendar, and identity — usually without anyone in leadership knowing.
– Most SMBs we assess discover between 10 and 20 active AI integrations in their tenant on the first inventory pass.
– Shadow AI is more consequential than shadow IT because the AI operates against the firm’s data on the user’s behalf, continuously.
– Inventory comes before policy. A policy written before the inventory is almost always wrong.
– For regulated firms (HIPAA, SOX, FINRA, FTC Safeguards), undisclosed shadow AI may already constitute a reportable disclosure of regulated data to an unvetted third party.
Most owners assume nothing has changed in their tenant since the last security review. Most owners are wrong.
“We have an AI policy” is becoming the most dangerous sentence in small-business cybersecurity. The policy exists. The inventory does not. The gap between the two is filled with browser extensions, marketplace plugins, OAuth grants, and Copilot add-ins that nobody at the executive level has ever seen.
This is shadow AI. It is the AI-era successor to the shadow IT problem that defined the last decade — except this generation of unsanctioned tools acts on the firm’s data, not just the user’s.
What is shadow AI?
Shadow AI is the practice — usually unintentional — of employees connecting third-party AI tools to a firm’s business systems without review by IT, security, or executive leadership. It is materially more consequential than shadow IT and harder to detect by traditional security controls.
Shadow AI takes four common forms in SMB environments:
- AI browser extensions — installed in Chrome, Edge, or Safari, often with permissions to read and modify every page the user visits, including the SaaS apps the firm depends on.
- Microsoft 365 and Google Workspace plugins — installed into Outlook, Teams, Gmail, and Drive via OAuth, granted scoped access to email, files, or calendar at the individual user’s consent.
- Standalone AI SaaS apps connected to the firm’s tenant — a meeting-summary tool that ingests calendar invites, a sales assistant that reads the CRM, a transcription service that records meetings.
- AI agents and automations — tools that not only read data but take actions on it (sending email, modifying files, posting messages), operating under the user’s identity.
Each of these is permitted, by default, in most SMB tenants. None of them require executive approval to install. All of them inherit the user’s existing access scope.
How is shadow AI different from shadow IT?
Shadow IT was a productivity problem with a security tail. An employee installed an unsanctioned Trello or Dropbox account because the IT-approved tool was slower. The data leak risk was real but bounded: only the data the employee chose to put into the unsanctioned tool was exposed.
Shadow AI is the inverse. The employee installs a tool that reads everything they already have access to, continuously, on their behalf. The data exposure is not what the employee chose to share. It is everything in scope.
The practical translation:
- An employee installing Dropbox without approval exposes the files they put in Dropbox.
- An employee installing an AI meeting assistant without approval exposes every meeting, every attendee, every shared file, every chat — including the ones the employee did not consciously decide to share.
This is why a shadow AI inventory is a different exercise from a shadow IT inventory. The question is not what software is installed. The question is what data is being read by something we did not approve.
What does shadow AI look like in practice?
The pattern repeats across verticals.
Construction. A project coordinator installs an AI meeting-notes plugin to summarize subcontractor calls. The plugin now ingests every project meeting on the calendar, including pre-bid strategy sessions and pricing discussions.
Healthcare. A practice manager installs an AI scheduling assistant that reads the EHR via API. The vendor has no Business Associate Agreement on file. PHI is being processed by an unvetted third party.
Legal. An associate installs a legal-research browser extension that reads every page open in the browser, including matters under attorney-client privilege and discovery materials.
Accounting. A tax preparer installs a “smart” document classifier that reads every client document uploaded to the firm’s portal during the busy season. The classifier sends extracted data to its cloud service for processing.
Manufacturing. A plant manager connects an AI inventory assistant to the ERP system via OAuth. The integration runs continuously, including overnight, with no audit trail of what it queries.
Financial services. An advisor installs a portfolio-analysis browser extension that reads every page in the custodian portal, including positions and personally identifiable client data.
None of these started with malice. All of them started with a user trying to be more productive. All of them now represent material data exposure the firm cannot describe accurately to a regulator, an insurance underwriter, or a client.
Where does shadow AI come from?
There are five entry points worth knowing.
- The Microsoft AppSource and Google Workspace Marketplace. Both allow users to install plugins into the productivity suite via OAuth consent. Vetting is minimal.
- The Chrome and Edge browser extension stores. Extensions often request “read and change all data on websites you visit.” Most users approve this without reading it.
- The ChatGPT plugin and GPT marketplaces, Claude integrations, and equivalent app stores. These platforms let users connect AI tools to work accounts directly.
- Embedded AI in SaaS tools the firm already uses. Many existing SaaS vendors now ship AI features that are enabled by default and may share data with the AI provider in ways the original contract did not anticipate.
- AI features in personal productivity apps used for work. A note-taking app, a calendar tool, or a meeting recorder installed for personal productivity that has been quietly granted access to work calendar and email.
The honest summary is that the perimeter has shifted. The perimeter is no longer the firewall. It is the consent screen.
How to inventory shadow AI
The first inventory takes about a week of focused work and produces results that are nearly always surprising. The structure we use:
- Enterprise Applications review (Microsoft 365 / Entra). Pull the full list of OAuth-integrated applications. Sort by recent sign-in. Anything granted access to Mail, Files, or Calendar that leadership cannot identify is a finding.
- Integrated Apps review. In the Microsoft 365 admin center, list all Outlook, Teams, and Office add-ins deployed. Flag every entry that does not match the firm’s approved tool list.
- Copilot Extensions review. If Copilot is licensed, review the connectors and plugins enabled across the tenant.
- Browser extension audit. Through endpoint management (Intune, Defender for Endpoint, or a similar tool), enumerate installed browser extensions across managed devices. Cross-reference against an approved list.
- SaaS tenant audits. For each major SaaS the firm uses (Salesforce, HubSpot, QuickBooks, Procore, Clio, Athenahealth), review the connected apps and integrations list inside that tool’s admin panel.
- Calendar and meeting recorder check. Search the calendar for recurring meetings with unfamiliar AI bot attendees. Many recorders auto-join under domains like
@otter.ai,@fireflies.ai,@fathom.video, or similar. - AUP reconciliation. Compare the actual inventory against any existing AI Acceptable Use Policy. The discrepancy is the gap that needs to close.
The output is a single spreadsheet with one row per discovered tool, columns for who installed it, what data it has access to, whether a vendor risk review or BAA exists, and a disposition (keep, restrict, remove).
Categories of shadow AI and how to govern each
| Category | Where it lives | How to detect | Disposition |
|---|---|---|---|
| OAuth-integrated SaaS plugin | Entra Enterprise Apps; Google Workspace API Controls | Admin center inventory | Require admin consent; remove unused |
| Outlook / Teams / Gmail add-in | M365 Integrated Apps; Google Marketplace admin | Admin center inventory | Approved tools list only |
| Browser extension | Per-device, browser store | Endpoint management enumeration | Allowlist; block by default |
| Embedded AI feature in approved SaaS | Vendor admin settings | Per-vendor review | Decide per data sensitivity |
| AI meeting recorder / bot attendee | Calendar invites | Calendar search for AI bot domains | Tenant-block unsanctioned bots |
| Personal-account AI tool with work-account access | OAuth grants across personal-tenant scope | OAuth audit | Tenant policy to restrict |
Shadow AI is not a tooling failure. It is a consent-architecture failure. The fix is governance, not procurement.
What to do once you have the inventory
The practical sequence is:
- Triage by data sensitivity. Any tool with access to financial, HR, legal, or regulated data goes to the top of the list. Anything operating only on already-public data goes to the bottom.
- Require admin consent for new OAuth grants. This is the single highest-leverage control. It does not remove existing shadow AI, but it stops the inflow.
- Block unsanctioned browser extensions through endpoint management. Per-device enforcement closes the most common entry point.
- Approve a short, named list of AI tools. Per the NIST Cybersecurity Framework’s asset-management category, you cannot govern what you have not enumerated. The approved list is the asset register.
- Remediate the discovered shadow AI. For each entry in the inventory, either bring it under sanctioned status (vendor risk review, BAA where applicable, data scope reduction) or remove it.
- Re-inventory quarterly. Shadow AI accretes. A one-time inventory becomes stale fast.
Microsoft documents the enterprise application management surface that makes step 2 enforceable in M365 tenants. CISA has published advisories on third-party software supply-chain risk that frame the broader category.
Common mistakes when addressing shadow AI
- Writing the AI policy before doing the inventory. The policy will contradict what employees are already doing.
- Assuming the firm’s MFA and SSO posture covers AI integrations. They cover login. They do not cover what an authorized integration does once logged in.
- Treating the inventory as a one-time project. Shadow AI re-accumulates within a quarter.
- Punishing employees who installed shadow AI. They were trying to be productive. The fix is governance, not blame.
- Skipping the BAA conversation. A vendor that has been processing PHI without a Business Associate Agreement is a HIPAA finding regardless of intent.
- Confusing tenant-level inventory with device-level inventory. Both are required. Tenant inventory catches OAuth; device inventory catches browser extensions.
Map Your Shadow AI Exposure →
Real findings. Plain language. No upsell.
A focused engagement that produces a single inventory spreadsheet of every AI tool currently connected to your tenant, what data each can access, and a recommended disposition. Most firms tell us this is the most useful first hour they have spent on AI governance.
About the author
Sebastian Abbinanti is the MSP Leader at The Isidore Group, a Chicago-based managed services and cybersecurity firm serving SMBs nationally. With 12+ years of experience in operational resilience, Microsoft 365 administration, and partner-managed tenant environments, Sebastian advises growth-stage organizations on AI services, operational maturity, and cybersecurity readiness.
Frequently asked questions
What is shadow AI?
Shadow AI is the practice — usually unintentional — of employees connecting third-party AI tools to a firm’s business systems without review by IT, security, or executive leadership. It includes AI browser extensions, Microsoft 365 and Google Workspace plugins, OAuth-integrated SaaS apps, and AI agents granted file or email access by individual users clicking through consent screens.
How is shadow AI different from shadow IT?
Shadow IT is unsanctioned software a user installs and uses themselves — a project management tool no one knows about. Shadow AI is unsanctioned AI that acts on the firm’s data on the user’s behalf. The risk is different: shadow IT typically affects only the user; shadow AI inherits the user’s access to email, files, and identity and operates against that data continuously.
How do I find shadow AI in my Microsoft 365 tenant?
Review three places in the Microsoft 365 admin centers: Enterprise Applications in Entra (lists every OAuth-integrated third-party application), Integrated Apps in the Microsoft 365 admin center (lists Outlook, Teams, and Office add-ins), and Copilot Extensions if Copilot is licensed. Most firms find more than they expected. The same review pattern applies in Google Workspace under Security and API Controls.
Is shadow AI a HIPAA or compliance violation?
It can be. If an unsanctioned AI tool has been granted access to PHI, financial records, or any data category covered by HIPAA, SOX, FINRA, FTC Safeguards, or state data privacy laws, the firm has effectively shared regulated data with an unaudited third party without a business associate agreement or vendor risk review. That is reportable in most frameworks.
What is the first step to bring shadow AI under control?
Inventory before policy. Most firms try to write an AI policy first and discover later that the policy contradicts what employees are already doing. The reverse order is better: run a one-week inventory of every AI tool currently connected to the firm’s tenants and SaaS systems, then write the policy against what was actually found.
Related reading:
– Custom AI Dashboards That Answer Plain-English Questions
– AI File Access Is the New Privileged Access
Frequently Asked Questions
What is shadow AI?
Shadow AI is the practice — usually unintentional — of employees connecting third-party AI tools to a firm’s business systems without review by IT, security, or executive leadership. It includes AI browser extensions, Microsoft 365 and Google Workspace plugins, OAuth-integrated SaaS apps, and AI agents granted file or email access by individual users clicking through consent screens.
How is shadow AI different from shadow IT?
Shadow IT is unsanctioned software a user installs and uses themselves — a project management tool no one knows about. Shadow AI is unsanctioned AI that acts on the firm’s data on the user’s behalf. The risk is different: shadow IT typically affects only the user; shadow AI inherits the user’s access to email, files, and identity and operates against that data continuously.
How do I find shadow AI in my Microsoft 365 tenant?
Review three places in the Microsoft 365 admin centers: Enterprise Applications in Entra (lists every OAuth-integrated third-party application), Integrated Apps in the Microsoft 365 admin center (lists Outlook, Teams, and Office add-ins), and Copilot Extensions if Copilot is licensed. Most firms find more than they expected. The same review pattern applies in Google Workspace under Security and API Controls.
Is shadow AI a HIPAA or compliance violation?
It can be. If an unsanctioned AI tool has been granted access to PHI, financial records, or any data category covered by HIPAA, SOX, FINRA, FTC Safeguards, or state data privacy laws, the firm has effectively shared regulated data with an unaudited third party without a business associate agreement or vendor risk review. That is reportable in most frameworks.
What is the first step to bring shadow AI under control?
Inventory before policy. Most firms try to write an AI policy first and discover later that the policy contradicts what employees are already doing. The reverse order is better: run a one-week inventory of every AI tool currently connected to the firm’s tenants and SaaS systems, then write the policy against what was actually found.
→ Read about our AI Solutions practice — governance assessments, secure Copilot deployment, private AI hosting, and on-premise LLM deployment for compliance-bound mid-market firms.
