2 variants
A2.1
Chat apps
Employees pick an AI chat app or desktop assistant.Data flow
- 1Employees use AI chat apps, desktop assistants and AI browsers for everyday work.
- 2MDM locks Claude Desktop to your company account, pushes browser policies and, where needed, your EDR vendor's AI extension, and blocks unapproved AI apps and AI browsers.
- 3MDM reports device compliance to the IdP, so only managed devices can sign in to the work AI tenant.
- 4SSO and a verified domain put work accounts in the company tenant. If you run Cloudflare or an SSE with TLS inspection, it adds tenant headers that block personal Claude and ChatGPT accounts in the browser. OpenAI doesn't document the header in its desktop apps.
- 5Approved use reaches the company tenant. The EDR AI extension or the proxy's DLP redacts or blocks sensitive data in browser prompts and reports AI use to your EDR console and MDR. Desktop app coverage is limited.
- 6Unapproved AI tools are found and blocked by MDM, the EDR module or the proxy. Personal accounts on approved sites need the proxy's tenant headers.
- 7Connectors let the assistant read and act in Drive, Slack and email with the user's own permissions.
- 8On Enterprise tiers, the vendor's audit or compliance API exports chats and admin events. ChatGPT keeps them 30 days, so pull at least weekly.
Chat apps: build or buy
Buy + glueWhat you can buy for each box in the diagram, the open source option, and the part you still build yourself.
Two ways to run it
1MDM plus your EDR's AI module
The default for most clients, including teams on Tailscale, which has no web proxy.
- Enterprise AI tenant with SSO and SCIM, and your domain verified
- Claude Desktop locked to your org through MDM
- ChatGPT desktop app blocked by MDM where you handle regulated data, allowed elsewhere
- Unapproved AI apps and AI browsers blocked by MDM
- Managed Chrome or Edge with approved extensions only, including your EDR vendor's AI extension
- AI tenant sign-in limited to managed devices in your IdP
- Covers
- Claude Desktop locked to your company account. Unapproved AI apps blocked. Sensitive data caught in browser prompts. AI use visible to your EDR console and MDR.
- Misses
- Personal accounts on approved AI sites, the ChatGPT desktop app, desktop app prompts on macOS, phones and unmanaged laptops.
- Effort
- 4 to 8 days
- Needs
- Claude Team or Enterprise for the desktop lock. SentinelOne AI Usage Control or CrowdStrike Falcon Guardian. Microsoft shops can use Defender for Cloud Apps.
2Add a web proxy
Clients already running the Cloudflare One client, or an SSE such as Netskope, Zscaler or Prisma Access.
- Everything in the first option
- TLS decryption turned on, with the root certificate pushed by MDM
- Tenant headers for Claude and ChatGPT, overwritten on every request
- Logged-out ChatGPT blocked
- Do Not Inspect rules for apps that break, and for Apple and Microsoft sign-in
- Covers
- Personal and logged-out Claude and ChatGPT accounts in the browser on managed devices, plus Claude Desktop.
- Misses
- ChatGPT desktop and mobile apps. OpenAI recommends excluding its domains from inspection.
- Effort
- 4 to 8 days, plus a 1 to 2 week pilot
- Needs
- Claude Enterprise and ChatGPT Enterprise for the headers. A Cloudflare Zero Trust plan with TLS decryption, or your SSE.
Components
| Component | Buy | Open source | You build | Maturity |
|---|---|---|---|---|
| MDM | Jamf Pro, Iru (formerly Kandji), Microsoft Intune | Santa for app blocking on macOS | Profiles for each AI app and browser, and a blocklist kept current as new AI apps ship | GA |
| EDR AI module | SentinelOne AI Usage Control (Prompt Security); CrowdStrike Falcon Guardian (replaced Falcon AIDR); Microsoft Defender for Cloud Apps | · | Which AI sites are allowed, what gets redacted, monitor mode before block | GA |
| Claude Desktop lock | Claude Desktop managed settings on Team and Enterprise | · | One profile per platform, tested on a pilot group | GA |
| SSO and domain | Okta, Entra or Google; Claude domain verification (claiming existing accounts needs Enterprise); ChatGPT Enterprise SSO | · | SCIM groups for who gets which tenant | GA |
| Enterprise AI tenant | Claude Enterprise or ChatGPT Enterprise. Team and Business lack the audit APIs and tenant restrictions. | · | · | GA |
| Browser policies | Chrome Enterprise Core (free), Edge for Business | · | Extension allowlist and AI site blocklist | GA |
| Web proxy (optional) | Cloudflare Gateway if you already run its client; Netskope, Zscaler, Prisma Access | · | Header policies, Do Not Inspect list, root certificate setup for developer tools | GA |
| Other prompt DLP | Chrome Enterprise Premium; Edge with Purview inline DLP (Intune-managed Windows, pay-as-you-go); Akamai Workforce Protector (formerly LayerX); Harmonic | · | Rules for your own data types | GA |
| Shadow AI discovery | Your EDR AI module; Valence and other SaaS security tools; Nudge Security; Google Workspace and Entra OAuth app reports | · | · | GA |
| Connectors (Drive, Slack, email) | Built-in Claude and ChatGPT connectors with admin allowlists | MCP servers | Security review of any custom MCP server | GA |
| Audit log API | Claude Compliance API (Enterprise); ChatGPT Compliance Logs Platform (Enterprise or Edu); Smarsh or Origin for Claude | OpenAI quickstart notebook | Scheduled puller into a bucket or SIEM | GA |
Configuration reference
| Control | Where you set it | Setting |
|---|---|---|
| Claude desktop app | MDM profile com.anthropic.claudefordesktop (macOS) or HKLM\SOFTWARE\Policies\Claude (Windows) | forceLoginOrgUUID set to your org ID. isDesktopExtensionEnabled and isLocalDevMcpEnabled off unless approved. Team and Enterprise plans. |
| CrowdStrike | Falcon browser extension, delivered by the Falcon sensor (7.39+ on Windows, 7.40+ on macOS) | Managed Chrome and Edge. Blocks or redacts prompts in the browser. Desktop apps are monitored on Windows only. Events go to Next-Gen SIEM. |
| SentinelOne | Prompt Security browser extension, pushed by MDM | Chrome and Firefox extensions are published. Policies redact or block prompts and block unsanctioned AI tools, managed in the Singularity console. |
| Microsoft Defender | Defender for Cloud Apps catalog, Generative AI category | Mark AI apps Unsanctioned to block them on devices onboarded to Defender for Endpoint. Takes up to 3 hours. |
| Chrome and Edge | Browser policies pushed by MDM | ExtensionInstallForcelist for your EDR's AI extension, ExtensionInstallBlocklist for unapproved AI extensions, URLBlocklist for unapproved AI sites. |
| AI apps and AI browsers | Iru Application Blocking, Santa or Jamf Restricted Software (macOS), Intune App Control (Windows) | Iru matches bundle ID or Developer ID, Santa matches Team ID, Jamf matches process name. |
| Claude in the browser | Proxy header on claude.ai, claude.com, anthropic.com and api.anthropic.com | anthropic-allowed-org-ids: your org UUID. Enterprise plans and Console orgs. Covers web and desktop. |
| ChatGPT in the browser | Proxy header on chatgpt.com | ChatGPT-Allowed-Workspace-Id: your workspace ID. ChatGPT Enterprise. Also block chatgpt.com/backend-anon/ to stop logged-out use. |
| Microsoft Copilot | Entra tenant restrictions v2 | Microsoft's documented control for personal account sign-in. Needs Entra ID P1 or P2. |
| Cloudflare Gateway | Zero Trust dashboard | Root certificate on devices, TCP proxy and TLS decryption on, an HTTP Allow policy that overwrites the tenant headers, the Do Not Inspect app type. |
Rollout steps
| # | Step | Who | Effort |
|---|---|---|---|
| 1 | Write an acceptable use policy and pick the sanctioned AI tool | Security lead | 2 to 5 days |
| 2 | Buy the tenant at the tier you need, then set up SSO, SCIM, domain verification, retention and the connector allowlist | IT admin | 2 to 5 days |
| 3 | Push the Claude Desktop profile, and block the ChatGPT desktop app where you handle regulated data | MDM admin | 1 to 2 days |
| 4 | Push browser policies and block unapproved AI apps and AI browsers | MDM admin | 1 to 3 days |
| 5 | Deploy your EDR vendor's AI extension to managed browsers in monitor mode | Security engineer | 1 to 3 days |
| 6 | Require a managed device to sign in to the AI tenant | Identity admin | 1 to 3 days |
| 7 | Review a few weeks of AI use with your MDR, then turn on redaction and blocking | Security engineer | 1 to 3 weeks |
| 8 | If you run Cloudflare or an SSE, turn on TLS inspection and tenant headers, then pilot for breakage | Platform engineer | 4 to 8 days plus a 1 to 2 week pilot |
| 9 | Build a scheduled job that pulls the compliance API into your log bucket or SIEM | Security engineer | 3 to 8 days |
What you still build
- MDM profiles for each AI app and browser on each platform, and a blocklist kept current as new AI apps ship
- EDR AI policies: allowed sites, redaction rules, and alerts your MDR acts on
- A compliance API puller with checkpointing. For ChatGPT it must run at least weekly because logs are kept 30 days.
- Proxy header policies, Do Not Inspect rules and root certificate setup for developer tools, if you run a proxy
Gotchas
- OpenAI documents managed configuration for ChatGPT Work and Codex, not regular chat, so there's no documented way to lock the ChatGPT desktop app to your workspace. Our default: block it with MDM where you handle PHI or other regulated data, and allow it elsewhere. Users there work in the web app, which the header covers.
- OpenAI recommends turning off TLS inspection for its domains and doesn't document header enforcement in its desktop and mobile apps. Count on the header for ChatGPT on the web only.
- Neither SentinelOne nor CrowdStrike documents blocking personal AI accounts. That takes a tenant header from a proxy.
- CrowdStrike sees desktop AI apps on Windows only, and only to monitor. On macOS, MDM is your desktop control.
- CrowdStrike replaced Falcon AIDR with Falcon Guardian in September 2026, and AIDR support ends November 30, 2026.
- SentinelOne doesn't publish a browser or OS support matrix for its AI module. Confirm Safari and Edge coverage before you rely on it.
- Claude Team can verify a domain and block new personal signups. Claiming existing accounts needs Enterprise.
- Anthropic tenant restrictions work only for Enterprise plans and Console orgs. OpenAI documents workspace blocking for ChatGPT Enterprise only.
- Tailscale has no web proxy or TLS inspection, so Tailscale-only teams rely on MDM and the EDR module.
- A Cloudflare setup used only for remote access may not send web traffic through Gateway. Check the client mode before counting on headers.
- Python, Node and some Electron apps use their own certificate stores and fail under inspection until you configure them. Pilot with developers first.
- Claude Team and ChatGPT Business have no compliance or audit log API, and ChatGPT keeps compliance logs for 30 days.
- No product reliably stops AI browsers from following instructions hidden in web pages. Block AI browsers with MDM unless you've approved one.
A2.2
AI inside your SaaS
AI features and agents inside the SaaS you already pay for: Microsoft 365, Slack, Zoom, Notion, the CRM, and the agents makers build in suites such as Copilot Studio or Agentforce.Data flow
- 1Employees use AI features and agents inside tools they already pay for: Microsoft 365 Copilot, Slack, Zoom, Notion, the CRM.
- 2Makers build and publish agents in low-code studios such as Copilot Studio or Agentforce, often with no security review.
- 3SSO groups decide who gets each AI feature or agent, where the product supports it. Many only offer a workspace-wide toggle.
- 4Prompts and content go to the vendor's model or its AI subprocessor, under the vendor's data terms.
- 5Governance lives in each vendor's admin plane: AI toggles, retention, excluded channels and spaces, DLP, connector allowlists and environment rules.
- 6The feature or agent answers with whatever the user can already reach, so old oversharing becomes instant exposure.
- 7Connectors let agents act in third-party systems, and can run on the maker's own credentials unless policy blocks it.
- 8Data governance labels sensitive content and removes broad sharing, so AI search can't surface it. Auto-labeling needs E5 or E5 Compliance.
- 9Notetaker bots your users install are blocked from auto-joining. Waiting rooms and authenticated join stop outside attendees' bots, and recording follows all-party consent rules.
- 10Vendor audit logs show AI feature and agent use, often on the top tier only. Microsoft 365 export is included; Salesforce needs a paid add-on. Export before the retention window ends.
AI inside your SaaS: build or buy
Mostly buyWhat you can buy for each box in the diagram, the open source option, and the part you still build yourself.
| Component | Buy | Open source | You build | Maturity |
|---|---|---|---|---|
| SaaS AI features and agents | Slack AI in paid plans, Zoom AI Companion in paid Workplace, Notion AI in Business and Enterprise; agent studios: Copilot Studio, Agentforce, ServiceNow Now Assist, Gemini Enterprise. | · | Maker intake and review before agents go org-wide. | GA |
| SSO, AI feature groups | Your existing Okta, Entra or Google; group gating only where each SaaS supports it | · | · | GA |
| Vendor admin plane | Built-in admin consoles in Slack, Zoom, Notion and the CRM; Power Platform data policies and Managed Environments (premium licenses), Microsoft Agent 365, Zenity; AppOmni or Obsidian to track settings drift. | Power Platform CoE Starter Kit | Per-app AI settings checklist, connector allowlist and a quarterly review. | GA |
| Vendor AI model or subprocessor | Vendor DPA and subprocessor list; Notion zero data retention needs Enterprise | · | · | GA |
| Your data and oversharing | SharePoint Advanced Management, Purview sensitivity labels (auto-labeling needs E5), Purview DSPM for AI (E5 or E5 Compliance), Varonis; Google Workspace and Microsoft 365 sharing reports, DoControl, Metomic. | PnP PowerShell, Microsoft Graph | Oversharing cleanup scripts on the Drive or SharePoint sharing APIs, and site-owner attestation. | GA |
| Connectors | Already owned. Third-party connectors carry their own OAuth scopes, and Copilot Studio and Power Automate connectors can run on the maker's credentials. | · | Connector allowlist and a policy that blocks maker credentials. | GA |
| Notetaker bots | Zoom Marketplace app controls, waiting room and authenticated join; Nudge Security for notetaker discovery | · | OAuth and calendar review rules | GA |
| Vendor audit log | Microsoft Purview Audit (Standard), Slack Audit Logs API on Enterprise+, Notion audit log on Enterprise, Salesforce Shield Event Monitoring, ServiceNow AI Control Tower. | SIEM connectors for the Office 365 Management Activity API | Per-app log puller into a bucket or SIEM. | GA |
Rollout steps
| # | Step | Who | Effort |
|---|---|---|---|
| 1 | List every SaaS app with AI features, and every agent and maker in each vendor admin console | Security engineer | 3 days to 3 weeks |
| 2 | Review each app's AI toggles, retention, excluded channels or spaces, and AI subprocessors | Security engineer | About half a day per app |
| 3 | Set tenant data policies: block non-business connectors, unauthenticated agents and maker credentials | SaaS admin | 1 week |
| 4 | Disable unapproved notetaker apps and set waiting room and authenticated join defaults for external meetings | IT admin | 2 to 5 days |
| 5 | Write a recording consent policy with counsel | Security lead with legal | 1 to 3 days |
| 6 | Find and fix oversharing on top sites, using restricted search on the worst ones first | Security engineer with site owners | 2 weeks at 50 people, 1-3 months at 200-500 |
| 7 | Publish a small set of sensitivity labels and apply them to top sites | Compliance or security lead | 1-2 weeks |
| 8 | Decide which apps are worth a tier upgrade for audit logs, then export audit events to a bucket or SIEM | Security engineer | 3 to 10 days |
| 9 | Add a lightweight maker review before agents go org-wide | Security engineer | 2 days |
| 10 | Re-check AI settings every quarter as vendors ship new features | Security engineer | 1 to 3 days per quarter |
What you still build
- A per-app AI settings checklist and a quarterly review, unless you buy an SSPM
- Audit log pullers for each app's API. There's no common schema across vendors.
- Oversharing scripts that find Everyone and org-wide links, remove them in bulk and ask site owners to confirm
- A cross-vendor inventory of agents and their owners
Gotchas
- Many SaaS products only offer a workspace-wide AI toggle, so SSO groups can't always gate who gets AI.
- Audit log APIs usually sit in the top tier: Slack Enterprise+, Notion Enterprise, Salesforce Shield. Microsoft 365 audit export is included.
- You can block notetakers your own users install. Bots brought by external attendees need a waiting room, authenticated join or manual removal.
- AI features and agents read whatever the user can already see, so old oversharing shows up in AI answers.
- Copilot Studio and Power Automate connectors can run on the maker's credentials, not the user's.
- Manual labels work on E3. Auto-labeling and DSPM for AI need E5 or E5 Compliance.
- Managed Environments needs premium Power Platform licenses for users in that environment.
- Vendor AI data terms vary by tier. Notion's zero data retention with its LLM providers is Enterprise only.
Common use cases
- Writing and research
- Meeting notes and summaries
- AI browsers acting on web pages
- Helpdesk and CRM agents built in Copilot Studio or Agentforce
Key risks
- Sensitive data pasted into personal accounts
- Shadow AI tools with unknown data terms
- AI features switched on by default in existing SaaS
- Notetakers recording meetings without consent
- AI browsers following instructions hidden in web pages
- Oversharing surfaced instantly by AI search
- Suite agents running on a maker's own credentials
Fast path
- KEEPEnterprise tenant with SSO and no training on your data
- KEEPMDM locks Claude Desktop to your org and blocks unapproved AI apps
- KEEPReview the AI settings in every SaaS admin console
- SIMPLIFYWritten acceptable use policy before a browser control
- DEFERProxy tenant headers and prompt blocking until a few weeks of monitor mode
- KEEPFix oversharing on top sites before turning on AI search or agents
- KEEPBlock maker credentials in suite connectors
- SIMPLIFYWeekly audit log export to a bucket