EfficientEther
Book a demoTry it free

Solutions / Shadow AI and AI governance

Shadow AI discovery and AI governance for Microsoft 365.

AI nobody approved. Who invited the note-taker?

AI is already inside your tenant, let in one consent at a time. EtherInsights shows which AI apps users let in, what each can read in plain English, and who let it in and when. Then decide, act and show the board what you found, in two pages.

14-day free trial on your own tenantRead-only by default

Or book an AI discovery review

EtherInsights AI overview: 23 items, 6 to look at, Azure AI 5 with 1 of 3 sources read, and the Look at first list of six. Sample data.
Plain English
What each AI app can read, such as every meeting transcript or your mail
Name and date
Who let it in: an admin for everyone, or one person for themselves
2 pages
A board-ready AI report that says what it could not see

One radar for every way AI gets into your organisation.

Five routes, each sorted into act now, decide or known. Coverage depends on the licences and permissions you have, and the radar says which routes it could not read.

  1. Route 1

    Microsoft 365 Copilot

    Seats against real use, by app and by person, and use without a licence.

  2. Route 2

    Azure AI

    Azure OpenAI and Foundry resources, model deployments, tokens and cost.

  3. Route 3

    AI apps users let in

    Chat assistants, meeting note-takers and coding assistants, with what each can read and who let it in.

  4. Route 4

    AI websitesPreview

    People, devices and traffic from Defender signals. Prompts and page contents are never read.

  5. Route 5

    AI on devices

    AI software installed through Intune, browser extensions and local model runtimes.

Find the AI in your tenantSee AI governance in EtherInsightsCheck Copilot readiness

AI is already running in your organisation.

Users let AI apps in one consent at a time, and each keeps the access it was granted until someone removes it.

What is happening

Consent is quiet.

An AI note-taker or chat assistant connected with one person’s sign-in can read what it was granted, such as mail or meeting transcripts, and nobody is told.

Why it gets missed

There are four places to look.

Copilot, Azure AI, AI apps and websites, and AI on devices each sit in a different console.

What good looks like

One radar, then a decision.

Every AI app with what it can read and who let it in, an owner and a review date, controls that can be undone, and a report for the board.

Decide, act, and prove it.

One radar instead of four consoles for the practitioner, and a two-page answer for the board when it asks what AI is running in the business.

EtherInsights AI overview: a radar of 23 items, 6 to look at, by route and urgency, 5 awaiting a decision, 1 unsanctioned and still present, 11 of 15 sources read. Sample data.
The AI overview in EtherInsights. Sample data.

Decide, with an owner

Mark each AI app Sanctioned, Monitored, Unsanctioned or Awaiting decision, with an owner, a rationale and a review date. A decision records intent; the controls do the work.

Act, and undo if needed

Limit an app to chosen groups, revoke delegated consent, require admin approval for new AI apps, add a Conditional Access policy in report-only mode, or warn on and block an AI website on Defender for Endpoint devices. Every change can be undone.

Know when a control changes

Control history shows what is already in place and what has changed since, so a control someone switched off does not go unnoticed.

Prove it to the board

A report of about two pages, as a PDF or a deck, with a Shadow AI found section. Anything it could not read is labelled. Not read is never shown as zero.

Start here

Find the AI nobody approved, in your own tenant.

See this working on your own tenant.

Try it freeBook a demoExplore EtherInsights

Four things you can check on your own tenant.

Seats nobody uses. Changes nobody noticed. AI nobody approved. EtherInsights finds all three across your Microsoft estate, gives each one an owner, and keeps the proof. From £0.79 a user a month.

Seats, changes and AI, one price.

Seats nobody uses, changes nobody noticed and AI nobody approved, found in one platform. The waste becomes one annual figure your finance lead can read, with a date to beat: your renewal.

£0.79 per licensed user per month, whole platform

Try it on your own tenant today.

Your tenant, your number, 14 days. Connect read-only and see real findings in the first session.

14-day free trial on your own tenant. Cancel inside the trial.

An owner on every finding.

Each finding says what to cut, who owns it and what it is worth. The savings report tracks what was actually cut.

A savings report with an owner, an action and a value on every line

Nothing fails silently.

Every leaver closed, checked and filed. Every check says what it couldn't read: anything unread shows as "Not read", never as zero. Read-only by default, and changes are opt-in, run under your own admin's delegated sign-in.

ISO 27001, ISO 9001 and ISO/IEC 42001

A UK software company for the Microsoft estate. Listed by Microsoft as a Windows 365 partner, on Microsoft Marketplace, and certified to ISO 27001, ISO 9001 and ISO/IEC 42001.

About EfficientEther
EtherInsights

Know what AI is running before the board asks.

Discovery is read-only. Controls are opt-in, run under your admin’s delegated sign-in with the right Entra or Defender role, and every one can be undone. AI governance is in the same per-user price.

£0.79per licensed user / month

Whole platform, one price. You pay for licensed users only. A licensed user is an account that is switched on and holds any Microsoft licence, such as E3. Volume and MSP pricing on request.

  • 14-day free trial on your own tenant
  • Read-only by default
Try it freeOr book a demo first

Questions people ask first.

Microsoft facts on this page are checked against Microsoft Learn. Glossary of terms

AI tools people use at work without IT approving them: an AI meeting note-taker someone connected with their own account, an AI chat assistant in the browser, a local model on a laptop. In Microsoft 365, most of it arrives as an app a user consented to, which keeps the access it was granted until someone removes it.

Guides and analysis on this topic

Read the blog
How to Find and Fix Oversharing Before Enabling Copilot: SharePoint, OneDrive and Teams

Microsoft 365 · 10 Aug 2026

How to Find and Fix Oversharing Before Enabling Copilot: SharePoint, OneDrive and Teams

Find and fix oversharing across SharePoint, OneDrive, and Teams before enabling Copilot, using the reports and controls that make cleanup stick.

Read article
AI Wrote the Script. Who Signs It Off?

IT operations · 30 Sept 2026

AI Wrote the Script. Who Signs It Off?

AI can write a remediation script in seconds. Most organisations have no rule for who approves it, what the reviewer checks, or what evidence is kept.

Read article
Why Purpose-Built AI Wins in Microsoft IT Environments

IT operations · 12 May 2026

Why Purpose-Built AI Wins in Microsoft IT Environments

IT leaders do not need another chat window; they need operational depth, control, and outputs teams can actually use.

Read article

See it on your own tenant this week.

Start on your own, see it with a practitioner, or ask the question procurement will ask. Every path has a person behind it and a published price.

  • TodayConnect read-only in about seven minutes. Nothing in your tenant changes.
  • First sessionFindings appear as the scan runs, each with a monthly figure and an owner.
  • Day 14Keep the plan or cancel.

See what your Microsoft estate is wasting.

Connect your own tenant with read-only consent. Licence, Azure and Cloud PC findings appear in the first session.

Try it free
  • 14-day free trial on your own tenant
  • Read-only by default, actions opt-in
  • ISO 27001, 9001 and 42001

Next: sign in with Microsoft and approve read-only access. About seven minutes to connect.

Prefer to see it first? Watch the 90 second tour