Claude

1. 01Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
2. 022 signup emails show people creating Claude accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team.

Metadata only: sender, recipient, subject, and time from Defender for Office 365. No mailbox content is read.

• ●Medium38ClaudeNetwork3 people
• ●Medium25Claude: sensitive dataPurview DLP1 person
• ●Medium40ClaudeSIEM · Splunk (demo)1 person
• ●Medium41ClaudeCode · GitHub (demo)0 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. vendor_email · Sep 7, 2026
   3 vendor emails from mail.anthropic.com to 1 person in 30 days: 2 signup, 1 login, 0 billing
   Detail

   {
     "byKind": {
       "login": 1,
       "other": 0,
       "signup": 2,
       "billing": 0
     },
     "subjects": [
       "Verify your email address for Claude",
       "Welcome to Claude",
       "Your login code for Claude"
     ],
     "senderDomains": [
       {
         "count": 3,
         "domain": "mail.anthropic.com"
       }
     ]
   }

2. mail_signup · Aug 22, 2026
   Signup: 'Verify your email address for Claude' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0008"
   }

3. mail_signup · Aug 22, 2026
   Signup: 'Welcome to Claude' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0009"
   }

4. corroboration
   Also found by another lane (mdca:34211)
   Detail

   {
     "findingKey": "mdca:34211"
   }