how to limit users use of non company AI?

Posted by Dereksversion@reddit | sysadmin | View on Reddit | 25 comments

we might be on the cutting edge for a small/medium business, but we had users who had manager approved paid chatgpt accounts, our official policy is that no business info be put into public AI platforms, and those who need AI recieve a microsoft co-pilot license from us which as we know has gpt5 built in. so now, we have sales staff the like who have their own accounts plus our license and i've recently learned that some of them are choosing to use their GPT accounts because they already had them trained. i spoke to them but i don't believe they will actually cut over despite the lip service. so how do i get my arms around this? i can't block GPT as we don't have an outright ban on the free version.

Reply to Post

25 Comments

[-]

TheITSEC-guy@reddit

As a sys admin you are the master of your univers Talk is cheap, Block it and let them come to you https://learn.microsoft.com/en-us/purview/ai-microsoft-purview

[-]

franciscolorado@reddit

Make your co pilot much more attractive. Does it have access to all your company databases without me having to login, download and upload spreadsheets ?

[-]

i8noodles@reddit

I would just ban it and have copilot as your default AI since u have an AI solution already. have them go through some mandatory training to get the license about not adding business data into it. then if they do, u have grounds for dismissal etc. or if u absolutely can't ban gpt, get everyone to do mandatory training on use of AI. get them to sign of that they did it. if they continue, block there access and let legal and hr handle it. either way enforcement is key.

[-]

Refuse_@reddit

You can't, atleast not 100%. You can block access from company devices or data sources, but you can never prevent users from typing sensitive data in any AI outside of work. It's something we deal with as well. Other than company policy, there is no real barrier from preventing people to use it anyway.

[-]

Naclox@reddit

You have an official policy. What does that policy say the consequences for not following the policy are? Instituting those consequences are how you stop people from doing it. This isn't an issue you solve with tech, it's an issue you solve through people management. You should probably talk to the sales manager to get their people to stop and if that doesn't work go up the chain. If the c-suite doesn't do anything then you're SOL

[-]

ajsadler@reddit

Our IT policy says that users can only input any company data into the one approved AI tool. Breach will be gross misconduct and can result in dismissal. Any generic queries without company data, they can use whatever AI they like.

[-]

Sovey_@reddit

Are you able to monitor this? Or just "we better not catch you doing it?"

[-]

ajsadler@reddit

We can access to their browsing history, so we can monitor it if we feel that it's necessary (through proper management/MD approvals, not just checking on a whim). But knowing that it can result in summary dismissal if they get caught then I trust they're not stupid enough to use any of the unapproved AI tools with company data.

[-]

fresh-dork@reddit

yeah, i'd probably do that and if upper management isn't on board, tell my immediate management that this means we don't have a policy

[-]

parsimonyprinciple@reddit

It sounds like the policy is either not known, not properly disseminated in the company or being actively ignored. Time for some comms. Make it very clear what the standard is and what the consequence is. If, after this campaign issues persist management and HR should take a scalp and make that action known From a tech perspective, ensure access is restricted from company devices and platforms. The rest is management/HR and outside most sysadmins' paygrades.

[-]

Manwe89@reddit

Technically you can block it on level of Defender. This will soon be also monitoring usage of MCP and other local connectors [https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/discover-risks-in-ai-model-providers-and-mcp-servers-with-microsoft-defender/4440050](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/discover-risks-in-ai-model-providers-and-mcp-servers-with-microsoft-defender/4440050) With that you will still have an issue of people just taking picture of the screen with their phone and using it anyway. You have an option to airgap your device,or create and watch over policies which punish such behaviour This to my experience doesnt work,the issue you have now is Shadow IT [https://en.wikipedia.org/wiki/Shadow\_IT](https://en.wikipedia.org/wiki/Shadow_IT) The idea that users are sabouters of your perfect IT environment is false. You are there to help them reach their goals and if they have consistency to find ways around it,you have to build strong security culture in your company. This is management issue,which is usually covered by strong IT leadership But the basis will be that you should provide them with compliant and safe tools which help them reach the same goal they are doing behind your back differently

[-]

Va1crist@reddit

We have the sign in blocked and our web filter captured all that traffic , we allow chat gpt only but no sign in and if you put in company data of any sort that flags as cat 2 or higher well you lose access .

[-]

mnoah66@reddit

Soft ban = employees will still use it on company device. Hard ban = employees will use the app on their phone. Comes down to what management/legal wants to do and you put the levers in place.

[-]

turbokid@reddit

First option is a company problem. The second option is a management issue. Fix option one and fire anyone putting company data into 3rd party apps in option 2.

[-]

KavyaJune@reddit

You can Combine of DLP policy and Conditional Access policy to prevent users uploading sensitive files to ChatGPT even when they have access to it. Check this post for more details: [https://blog.admindroid.com/detect-shadow-ai-usage-and-protect-internet-access-with-microsoft-entra-suite](https://blog.admindroid.com/detect-shadow-ai-usage-and-protect-internet-access-with-microsoft-entra-suite/#Prevent%20uploading%20sensitive%20data%20to%20GenAI%20with%20Netskope%20One%20Advanced%20SSE)

[-]

thirsty_zymurgist@reddit

This is the answer. Also, the enterprise version of ChatGPT has a connector built in to Purview which makes it fairly simple to monitor.

[-]

Sylogz@reddit

the domains of the others are blocked and the only one allowed works. If you can't reach chatgpt, you can't use it

[-]

CyberMarketecture@reddit

You have policies that have consequences. Make sure they are clear and regularly seen. If someone breaks them, then report it to whoever has the authority. Beyond that, it isn't your problem. You aren't the company nanny, dude.

[-]

daorbed9@reddit

Just remember the more you lockdown the more calls/tickets you get.

[-]

shikkonin@reddit

Log, alert and fire. They're intentionally violating the terms of their contract, putting sensitive company information at risk (and possibly breaking the law).

[-]

OneEyedC4t@reddit

Send them an email showing them how to transition their rules and training data?

[-]

MarkOfTheDragon12@reddit

Realistically, unless you want to start filtering traffic and explicitely blocking those sites and serveces and constantly policing/updating those blocks, you have to rely on policy. The only (unlikely) solution is to get HR/Legal to be in people's face with public notices and reminders that any unauthorized usage will be repremanded. Making sure that the supported solutions can get the job done is pretty big, too. As long as theres no repercusion for ShadowIT, you will always have people ignoring policy for their own convenience.

[-]

how to limit users use of non company AI?

Reply to Post

25 Comments

TheITSEC-guy@reddit

franciscolorado@reddit

i8noodles@reddit

Refuse_@reddit

Naclox@reddit

ajsadler@reddit

Sovey_@reddit

ajsadler@reddit

fresh-dork@reddit

parsimonyprinciple@reddit

Manwe89@reddit

Va1crist@reddit

mnoah66@reddit

turbokid@reddit

KavyaJune@reddit

thirsty_zymurgist@reddit

Sylogz@reddit

CyberMarketecture@reddit

daorbed9@reddit

shikkonin@reddit

OneEyedC4t@reddit

MarkOfTheDragon12@reddit

derango@reddit

Hobbit_Hardcase@reddit

caribbeanjon@reddit