← AI inventory

Otter.ai

Otter.ai (AISense) · Meeting notes · Confirmed · catalog otter-ai. Seen by 5 lanes through 6 findings.

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Combined score
100
Critical 85 from the strongest lane + 15 for 4 more
People
5
Distinct identities across every lane
Seen by
5
Entra consent, Identity, Email, Network, Audit log
First seen
May 2, 2026
Last seen 3 h ago
unverified-publisheractive-7didentitygoogleworkspaceuser-consentedcorroborateddormantemail-signalnew-accountspaid-on-work-emailnetworkaudit-logteams-appbot-in-teamoktaadmin-managed
Evidence

Where it was seen

Strongest finding →
Entra consent
Critical85

3 consenting users, 16 sign-ins

Consent
3 users
Permission tier
High
Sign-ins 30d
16
Data reach
Calendar, Directory, Email, Meetings & transcripts
3 people · 43 h agoOpen finding →
IdentityGoogle Workspace (demo)
High55

0 sign-ins, 3 OAuth grants via Google Workspace (demo)

Assigned
0
Sign-ins
0
OAuth grants
3
Scope tier
High
3 people · 20 d agoOpen finding →
Email
High50

1 signups, 1 billing emails

Signups
1
Billing emails
1
Recipients
1
Messages
2
1 person · 27 d agoOpen finding →
Network
Medium48

4 users, 90 MB up

Users
4
Uploaded
90 MB
Transactions
512
Defender score
6/10
4 people · 3 h agoOpen finding →
Audit log
Medium37

2 audit events

Kind
Teams app
Events
2
People
1
Labeled content
0
1 person · 21 d agoOpen finding →
IdentityOkta (demo)
Medium29

4 assigned, 14 sign-ins via Okta (demo)

Assigned
4
Sign-ins
14
OAuth grants
0
Scope tier
Unknown
4 people · 3 h agoOpen finding →
Next steps

Recommended actions

  1. 01
    Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it.
    Entra consentIdentityEmailNetworkAudit log
  2. 02
    Otter.ai holds application permissions and can read data with no user signed in. Review the app role assignments and remove any that are not essential.
    Entra consent
  3. 03
    Scopes expose calendar, directory, email, meetings. Evaluate the vendor's retention and training terms before allowing continued use.
    Entra consent
  4. 04
    Sign-ins came from 2 countries (US, GB). Check that matches where these people work.
    Entra consent
  5. 05
    3 people authorized Otter.ai against their Google account with scopes that expose calendar, files. Review it under Google Workspace API controls and mark it trusted, limited, or blocked; blocked revokes existing tokens.
    Identity
  6. 06
    Scopes expose calendar, files. Evaluate the vendor's retention and training terms before allowing continued use.
    Identity
  7. 07
    Otter.ai was connected by users, not assigned by an admin. If it is approved, add it to the Workspace app catalog so access is managed and can be revoked at offboarding.
    Identity
  8. 08
    Nobody signed into Otter.ai through Google in 90 days. Unassign or revoke to reduce standing access.
    Identity
  9. 09
    1 signup email show people creating Otter.ai accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team.
    Email
  10. 10
    1 billing email mean someone is paying for Otter.ai personally and expensing or absorbing it. Consolidate onto a company license where data terms are negotiated.
    Email
  11. 11
    90 MB uploaded to Otter.ai in 30 days from 4 people. Check what data is leaving with Defender's file and session policies.
    Network
  12. 12
    Otter.ai is corroborated by an Entra consent grant. Review both findings together; the consent finding shows what data the app can read.
    Network
  13. 13
    Otter.ai was added as a bot to Sales Leadership. Bots in a team receive every channel message. Review with the Teams admin center app permission policies.
    Audit log
  14. 14
    Otter.ai is assigned through Okta, so it already has an owner. Confirm the assignment group is deliberate and mark the app sanctioned here if it is.
    Identity
Who

People

PersonDepartmentSourcesSeen bySign-ins · 30 d
Alice Ng
[email protected]
Sales
Grant + sign-insIdentity providerNetwork trafficAudit log
Entra consent · Identity · Network · Audit log10 · 43 h ago
Bob Okafor
[email protected]
Finance
Grant + sign-insIdentity providerNetwork traffic
Entra consent · Identity · Network6 · 8 d ago
Carol Diaz
[email protected]
HR
Consent grantIdentity providerNetwork traffic
Entra consent · Identity · Network0
[email protected]
[email protected]
n/a
Vendor emailNetwork traffic
Email · Network0
[email protected]
[email protected]
n/a
Identity provider
Identity0
Vendor

Policy notes

Trains on data
Unknown
Enterprise tier
Available
Org policy
None set

Bot joins meetings as a participant and stores full transcripts; calendar access is typical.

Exposure

Data it can reach

CalendarDirectoryEmailMeetings & transcriptsFiles & sites
Lanes

Score by source

Each lane scores its own evidence. The combined score takes the strongest lane and adds five points per additional lane, capped at 100.