M365 Dublin User Group - October 2025

Shadow AI is the New Shadow IT: Spot it, Stop it, Secure it

Presented at the M365 Dublin User Group - October 23, 2025

In this session, I explored the growing challenge of Shadow AI - the unmonitored and ungoverned use of AI tools within organisations, and how it mirrors the risks once posed by Shadow IT. As enterprises rapidly adopt AI and Copilot capabilities, understanding where data flows and ensuring security and compliance are critical.

I demonstrated how Microsoft’s security and governance ecosystem helps identify, manage, and protect data in AI-driven environments. The session covered practical approaches and tools, including:

• Data Security Posture Management (DSPM) and DSPM for AI to assess and reduce data exposure risks

• Copilot usage reports to monitor adoption and detect potential misuse

• Defender for Cloud Apps for discovering and controlling unsanctioned AI applications

• Intune policies to detect, block, or remove unauthorised AI apps

• Microsoft Purview DLP and Edge for Business for protecting data across browsers and network activities

• Network protection via Defender for Endpoint

• Power Platform data policies and governance settings for Copilot to maintain compliance

• Sensitivity labels, Insider Risk Management, and Communication Compliance for holistic data governance

The session provided attendees with actionable insights and real-world strategies to spot, stop, and secure Shadow AI - enabling organisations to adopt AI responsibly and securely.