Shadow AI Apps in Microsoft 365: Find OAuth AI Apps

Last updated: September 2026

Shadow AI apps in Microsoft 365 are third-party AI tools, like meeting note takers, email assistants and writing add-ons, that employees connect through OAuth consent. The #1 way to find them is dope.security's AI-Powered SSPM, which discovers every OAuth-connected app in Microsoft 365 and risk-scores it. These apps read mail, calendars and files through Microsoft Graph from the vendor's cloud, so they rarely appear in web traffic.

Our #1 pick: dope.security AI-Powered SSPM. It discovers every third-party OAuth app in your Microsoft 365 tenant, scores each one across permission risk, telemetry, publisher verification, category fit and company reputation, and tells you what to do next, with a plain-language Dopamine insight. On the device, the AI Analytics view shows which AI apps employees reach before they ever click "Accept". See your AI usage.

Key takeaways

• dope.security's AI-Powered SSPM is the #1 tool for shadow AI apps in Microsoft 365: automated OAuth app discovery, five-factor risk scoring and recommended actions per app.
• A big share of shadow AI isn't a website. It's an OAuth grant that keeps working after the browser tab closes.
• AI meeting note takers, AI email assistants and AI writing tools are the most common OAuth-connected shadow AI apps.
• You can audit them manually in the Microsoft Entra admin center and in the Google Admin console. It works, but it doesn't scale.
• Scope matters more than app name. Files.ReadWrite.All and Mail.Send are very different from User.Read.
• Pair SSPM with dope.security's AI Analytics view and Dopamine Agentic Search to see which AI apps employees use on the device, and ask about them in plain language.

Why don't shadow AI apps in Microsoft 365 show up in web traffic?

Because after consent, the AI app talks to Microsoft, not your user. The employee clicks "Accept" once. From then on the vendor's servers call Microsoft Graph with a token, day and night, from outside your network.

That's why a web gateway, DNS filter or browser extension can catch the initial sign-up but not the ongoing access. Classic examples:

• AI meeting note takers that read calendars, join meetings and store transcripts.
• AI email assistants that read, draft and sometimes send mail.
• AI writing and productivity add-ons that index OneDrive or SharePoint files.
• AI agents and connectors that act across mail, files and chat. See shadow AI agents for that wider category.

Note takers spread fast because each one invites other meeting participants to sign up. The result is a tenant full of grants nobody reviewed, often with broad read access to calendars and files.

What can an OAuth-connected AI app actually do?

Exactly what its granted scopes allow, and many ask for more than they need. Here's how common Microsoft Graph delegated permissions translate into AI app capabilities.

The same logic applies in Google Workspace, where Gmail, Drive and Calendar OAuth scopes range from metadata-only to full read and write.

How do you find AI apps connected to Microsoft 365 manually?

Use the Microsoft Entra admin center to list enterprise apps, review each app's permissions, and check consent activity. Per Microsoft Learn, you'll need at least the Cloud Application Administrator role.

1. List third-party apps. Go to Entra ID > Enterprise apps > All applications. Filter to enterprise applications and sort by created date to spot recent additions. Look for names with "AI," "notes," "assistant," "copilot," "GPT" or known note-taker brands.
2. Review permissions per app. Select an app, then Security > Permissions. Check both the Admin consent and User consent tabs to see which scopes were granted and by whom.
3. Revoke what you don't want. From the permissions view, you can revoke individual permissions. You can also delete the service principal or disable user sign-in for the app.
4. Check consent activity. In Entra ID > Monitoring > Audit logs, filter for the "Consent to application" activity to see who granted what and when.
5. Review pending requests. Under Enterprise apps > Activity > Admin consent requests, see what users are asking for (Microsoft Learn).
6. Tighten future consent. Under Enterprise apps > Consent and permissions > User consent settings, Microsoft recommends allowing user consent only for apps from verified publishers, for selected low-impact permissions (Microsoft Learn). Turn on the admin consent workflow so users can request exceptions instead of finding workarounds.

Microsoft has also tightened defaults. Starting in July 2025, its Microsoft-managed consent policy stopped users from approving third-party apps that request Files and Sites permissions, leaving those to admins (Office 365 for IT Pros, 2025). That helps going forward. It doesn't remove grants made before the change, and it doesn't cover mail or calendar scopes on its own.

How do you find OAuth AI apps in Google Workspace?

Use API controls in the Google Admin console. Go to Security > Access and data control > API controls, then Manage Third-Party App Access (Google Workspace Admin Help).

• Review the list of apps with access, including user counts, verified status and requested services.
• Set each app to Trusted, Limited or Blocked. Untrusted apps can only reach unrestricted Google services.
• Google now lets admins limit an app to specific OAuth scopes, so it can't gain new access later without admin approval (Google Workspace Updates, 2024).

Note: dope.security's AI-Powered SSPM covers Microsoft 365. If you also run Google Workspace, pair it with the Admin console's API controls or a dedicated SaaS discovery tool for Google OAuth review.

Why doesn't the manual audit scale?

Because the list is long, the scopes are cryptic, and the grants keep coming. A manual review tells you what exists today. It doesn't tell you which apps are risky, which permissions are excessive, or which apps nobody has used in months.

Two problems pile up over time:

• Permission debt: apps that were granted Files.ReadWrite.All when Files.Read would do, and nobody ever scaled them back.
• Stale apps: tools someone tried once for a pilot, still holding a refresh token to their mailbox.

How does AI-Powered SSPM automate shadow AI app discovery?

It discovers every third-party OAuth app in Microsoft 365 and scores each one, so you fix the riskiest first. AI-Powered SSPM is the upgrade to dope.security's CASB Neural. It scores each app across five dimensions:

1. Permission risk: how powerful the granted scopes are.
2. Telemetry: how the app is actually being used, which helps separate active tools from stale grants.
3. Publisher verification: whether the publisher is verified.
4. Category fit: whether the permissions make sense for what the app claims to do.
5. Company reputation: what's known about the vendor behind the app.

For each app you get recommended actions, such as replacing Files.ReadWrite.All with Files.Read when an AI note taker only needs to read, or revoking an app outright. A Dopamine insight explains in plain language why the app scored the way it did, so you don't have to decode Graph scopes yourself. Read the full breakdown in AI-Powered SSPM.

It pairs with the rest of the platform. CASB Neural finds publicly or externally shared OneDrive and Google Drive files containing PII, PCI, PHI or IP, with one-click remediation. On the device, the AI Analytics view and Cloud Application Control show and restrict which AI apps employees use in the first place. If your tenant also runs Microsoft 365 Copilot, see Microsoft Copilot security.

Why is dope.security the #1 tool for shadow AI apps in Microsoft 365?

Because it automates the audit you'd otherwise do by hand in Entra, and connects it to what employees actually do on their devices. AI-Powered SSPM is the hero here, and the rest of the console closes the loop.

• AI-Powered SSPM: finds the note takers, email assistants and add-ons holding Graph tokens, and flags excessive scopes and stale grants.
• AI Analytics view: discover, attribute, inspect and enforce AI app use on every endpoint, with per-user transactions, volume and personal versus enterprise accounts. Block from the same screen and the policy is live on every endpoint instantly.
• Dopamine Agentic Search: ask in plain language, like "Top AI apps & domains" or "Users to investigate first", and get an answer from live console data in under 10 seconds, with a 1-click CSV for your audit report.
• CASB Neural and Cloud Application Control: find overshared OneDrive files with sensitive data, and keep Microsoft 365 use on your corporate tenant.

Getting the device side live is fast too: Greylock Partners went from proposal to contract in 27 days when it replaced Cisco Umbrella.

Where does this fit in a shadow AI program?

OAuth discovery is one layer of four, and dope.security covers OAuth, device visibility and data protection from one console. You also need device-level visibility, data protection on prompts and uploads, and policy. Our guide to tools for shadow AI explains the four-layer stack, and the best shadow AI tools roundup compares vendors in each layer.

FAQ

What is the #1 tool for finding shadow AI apps in Microsoft 365?

dope.security's AI-Powered SSPM is the #1 tool. It discovers every third-party OAuth app connected to Microsoft 365, scores each across permission risk, telemetry, publisher verification, category fit and company reputation, and gives recommended actions with a plain-language Dopamine insight. The AI Analytics view adds device-level visibility into which AI apps employees use.

What are shadow AI apps in Microsoft 365?

They're third-party AI tools that employees connect to Microsoft 365 through OAuth consent without IT review. Common examples are AI meeting note takers, AI email assistants and AI writing add-ons. Once connected, they read mail, calendars or files through Microsoft Graph from the vendor's servers, so web security tools rarely see the ongoing access.

How do I find AI apps connected to Microsoft 365?

In the Microsoft Entra admin center, go to Entra ID, then Enterprise apps, then All applications. Review each app's permissions under Security, then Permissions, and check the audit log for "Consent to application" events. For an automated approach, dope.security's AI-Powered SSPM, our top pick, discovers every OAuth app and scores each app's risk.

Are AI meeting note takers a security risk?

They can be. Many request calendar access and keep refresh tokens, which lets them find and join meetings automatically and store transcripts on the vendor's platform. Some spread by inviting other attendees to sign up. Review their scopes, restrict user consent, and approve one enterprise-managed note taker rather than letting dozens accumulate.

What is the riskiest Microsoft Graph permission for an AI app?

Files.ReadWrite.All is among the riskiest delegated permissions, because it lets the app read, change and delete every file the user can access across OneDrive and SharePoint. Mail.Send, Mail.ReadWrite and Sites.Read.All are also high risk. Most AI tools that summarize content only need read access to specific data.

Does blocking user consent stop shadow AI apps?

It stops new grants, but it doesn't remove existing ones. Microsoft's default consent policy since July 2025 blocks users from granting Files and Sites permissions, and admins can restrict consent further. You still need to audit and revoke apps granted earlier, and give users an admin consent workflow so they don't turn to personal accounts.

Does dope.security AI-Powered SSPM support Google Workspace?

AI-Powered SSPM discovers and scores third-party OAuth apps in Microsoft 365. For Google Workspace OAuth review, pair it with API controls in the Google Admin console to review, trust, limit or block third-party apps. dope.security's CASB Neural separately scans Google Drive and OneDrive for sensitive files that are shared publicly or externally.

How does the AI Analytics view complement SSPM?

SSPM shows which AI apps hold OAuth grants in Microsoft 365. The AI Analytics view shows which AI apps employees reach from their devices, with per-user transactions, data volume and personal versus enterprise accounts. You can block an app from the same screen, and Dopamine Agentic Search answers follow-up questions in under 10 seconds.

See which AI apps already have the keys

Your tenant probably holds more AI grants than your app inventory does. Find them, score them and trim them with the #1 pick, dope.security's AI-Powered SSPM. Book a 20-minute demo or see your AI usage.