← AI inventory

ChatGPT

Entra consent OpenAI · Assistant · publisher 'openai, l.l.c.'

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
85
Critical
People
4
Tenant-wide consent · 4 seen signing in
Permission tier
High
4 permissions
First seen
Mar 10, 2026
Last seen 3 d ago
active-7dadmin-consent-audited
Next steps

Recommended actions

  1. 01ChatGPT has tenant-wide admin consent. Confirm a documented approval exists, or revoke the grant and require per-user consent.
  2. 02Scopes expose directory, email, files. Evaluate the vendor's retention and training terms before allowing continued use.
  3. 03ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
  4. 044 people signed in during the last 30 days under the tenant-wide consent. Start the conversation with them.
  5. 05Adoption is broad enough that outright blocking will disrupt work. Prefer a sanctioned alternative plus Conditional Access.
Same app, other lanes

Related findings

Access

Permissions

PermissionGrantsConsent types
Files.Read.All1Admin consent (all users)
Mail.Read1Admin consent (all users)
User.Read1Admin consent (all users)
offline_access1Admin consent (all users)
Who

People

An administrator consented on behalf of all users. Every account in the tenant can use this app without granting anything themselves.
PersonDepartmentSourceSign-ins · 30 dGranted
Dave Patel
[email protected]
n/aSign-in only12 · 4 d agoNo direct grant
Erin Walsh
[email protected]
n/aSign-in only8 · 3 d agoNo direct grant
Bob Okafor
[email protected]
n/aSign-in only4 · 4 d agoNo direct grant
Alice Ng
[email protected]
n/aSign-in only2 · 16 d agoNo direct grant
Consent

Grants

TypePrincipalPermissionsGranted
Admin consent (all users)All usersFiles.Read.All, Mail.Read, User.Read, offline_accessn/a
Usage · 30 days

Who actually uses it

Sign-ins
26
People
4
Last 7 days
3
2026-08-16: 02026-08-17: 02026-08-18: 12026-08-19: 02026-08-20: 02026-08-21: 12026-08-22: 02026-08-23: 02026-08-24: 12026-08-25: 12026-08-26: 52026-08-27: 02026-08-28: 22026-08-29: 22026-08-30: 12026-08-31: 02026-09-01: 22026-09-02: 22026-09-03: 12026-09-04: 12026-09-05: 02026-09-06: 12026-09-07: 02026-09-08: 12026-09-09: 02026-09-10: 22026-09-11: 22026-09-12: 02026-09-13: 02026-09-14: 0
08-1609-14
Last sign-in3 d ago
CountriesUS · 26
ClientsBrowser · 18Mobile Apps and Desktop clients · 8
Failed1
Why

Evidence

  1. service_principal · Mar 10, 2026
    Service principal 'ChatGPT' present in tenant (publisher: OpenAI, L.L.C.)
    Detail
    {
  "appId": "aaaa0002-0000-4000-8000-000000000002",
  "homepage": "https://chatgpt.com",
  "objectId": "sp-chatgpt",
  "publisherName": "OpenAI, L.L.C.",
  "accountEnabled": true,
  "verifiedPublisher": "OpenAI"
}
  2. delegated_grant
    all users (admin consent) granted Files.Read.All, Mail.Read, User.Read, offline_access
    Detail
    {
  "grantId": "g-chatgpt-all",
  "resourceId": "sp-graph",
  "consentType": "AllPrincipals",
  "principalId": null
}
  3. sign_in_activity · Sep 11, 2026
    26 successful sign-ins by 4 people in the last 30 days (1 failed)
    Detail
    {
  "clients": [
    {
      "count": 18,
      "client": "Browser"
    },
    {
      "count": 8,
      "client": "Mobile Apps and Desktop clients"
    }
  ],
  "countries": [
    {
      "count": 26,
      "country": "US"
    }
  ],
  "windowDays": 30,
  "activeUsers7d": 3
}
  4. consent_event · Aug 27, 2026
    Consent to application. (admin consent) by [email protected]: Mail.Read, Files.Read.All, offline_access, User.Read
    Detail
    {
  "scopes": [
    "Mail.Read",
    "Files.Read.All",
    "offline_access",
    "User.Read"
  ],
  "recordId": "ual-0098",
  "isAdminConsent": true
}
Summary

Consent types

  • Admin consent (all users)