Email
Medium432 signups, 0 billing emails
- Signups
- 2
- Billing emails
- 0
- Recipients
- 1
- Messages
- 3
1 person · 7 d agoOpen finding →
Claude
Anthropic · Assistant · Confirmed · catalog anthropic-claude. Seen by 6 lanes through 6 findings.
Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Combined score
68
High 43 from the strongest lane + 25 for 5 more
People
8
Distinct identities across every lane
Seen by
6
Email, Source code, SIEM, Network, Vendor account, Purview DLP
First seen
Feb 26, 2026
Last seen 25 h ago
email-signalnew-accountscorroboratedsource-codefixturesiemnetworkno-entra-footprintvendoranthropicsanctioned-accountstale-keyssanctioneddlpdlp-blocked
Evidence
Where it was seen
Source codeGitHub (demo)
Medium412 repos, 1 packages
- Repos
- 2
- Packages
- 1
- Keys in code
- 0
- Public repos
- 0
0 people · 2 d agoOpen finding →
SIEMSplunk (demo)
Medium40320 events, 7 MB up via Splunk (demo)
- Events
- 320
- Uploaded
- 7 MB
- Users
- 1
- Sources
- 1
1 person · 27 h agoOpen finding →
Network
Medium383 users, 6 MB up
- Users
- 3
- Uploaded
- 6 MB
- Transactions
- 860
- Defender score
- 8/10
3 people · 27 h agoOpen finding →
Vendor accountAnthropic (demo)
Medium275 seats, 3 keys, 1963 USD via Anthropic (demo)
- Seats
- 5
- External
- 0
- API keys
- 3
- Spend 30d
- $1,963
5 people · 25 h agoOpen finding →
Purview DLP
Medium25Claude: sensitive data
2 DLP events, 0 not blocked
- Events
- 2
- Not blocked
- 0
- Blocked
- 2
- Top types
- Email Address, All Full Names
1 person · 8 d agoOpen finding →
Next steps
Recommended actions
- 01Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.EmailSource codeSIEMNetworkVendor accountPurview DLP
- 022 signup emails show people creating Claude accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team.Email
- 03Claude SDKs appear in 2 repositories. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally.Source code
- 04Direct HTTP calls to api.anthropic.com bypass any SDK-level controls. Add the hosts to egress policy and prefer the sanctioned client library.Source code
- 05Splunk (demo) confirms what Microsoft 365 signals show for Claude. Use the source list here to find the exact devices and network segments involved.SIEM
- 06Claude shows up on the network but holds no Entra consent, so people are using personal accounts or no account at all. Conditional Access cannot see it; block or coach at the gateway with a Defender for Cloud Apps unsanction policy.Network
- 073 API keys have not been used in 90 days or never at all. Revoke them; a key that is not used is only a liability.Vendor account
- 08Every match was blocked. The control is working; keep the policy and use these events to target awareness at the 1 person involved.Purview DLP
Who
People
| Person | Department | Sources | Seen by | Sign-ins · 30 d |
|---|---|---|---|---|
| n/a | Vendor emailSIEM logsNetwork trafficAudit log | Email · SIEM · Network · Purview DLP | 0 | |
Alice Wu | n/a | Vendor seat | Vendor account | 0 |
Erin Diaz | n/a | Vendor seat | Vendor account | 0 |
| n/a | Network traffic | Network | 0 | |
Grace Hopper | n/a | Vendor seat | Vendor account | 0 |
| n/a | Network traffic | Network | 0 | |
Mia Chen | n/a | Vendor seat | Vendor account | 0 |
Oscar Ruiz | n/a | Vendor seat | Vendor account | 0 |
Vendor
Policy notes
- Trains on data
- Configurable
- Enterprise tier
- Available
- Org policy
- None set
Consumer plans prompt users to opt in or out; Team, Enterprise, and API do not train.
Lanes
Score by source
- EmailMedium43
- Source code · GitHub (demo)Medium41
- SIEM · Splunk (demo)Medium40
- NetworkMedium38
- Vendor account · Anthropic (demo)Medium27
- Purview DLPMedium25
Each lane scores its own evidence. The combined score takes the strongest lane and adds five points per additional lane, capped at 100.