ChatGPT

1. 01ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
2. 023 signup emails show people creating ChatGPT accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team.
3. 032 billing emails mean someone is paying for ChatGPT personally and expensing or absorbing it. Consolidate onto a company license where data terms are negotiated.

Metadata only: sender, recipient, subject, and time from Defender for Office 365. No mailbox content is read.

• ▲Critical85ChatGPTEntra consentall users
• ◆High51ChatGPTNetwork11 people
• ●Medium48ChatGPTEndpoint2 people
• ◆High60ChatGPT via Power PlatformAzure & Power Platform3 people
• ◆High70ChatGPT: sensitive dataPurview DLP3 people
• ◆High66ChatGPTSIEM · Splunk (demo)3 people
• ▲Critical81ChatGPTCode · GitHub (demo)0 people
• ●Medium38ChatGPTOkta (demo)10 people
• ●Medium30ChatGPTGoogle Workspace (demo)5 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. vendor_email · Sep 13, 2026
   7 vendor emails from tm.openai.com to 4 people in 30 days: 3 signup, 2 login, 2 billing
   Detail

   {
     "byKind": {
       "login": 2,
       "other": 0,
       "signup": 3,
       "billing": 2
     },
     "subjects": [
       "Verify your OpenAI account",
       "Welcome to ChatGPT",
       "Your ChatGPT code is 482913",
       "Your ChatGPT code is 110372",
       "Your OpenAI receipt",
       "Your ChatGPT Plus subscription renewed"
     ],
     "senderDomains": [
       {
         "count": 7,
         "domain": "tm.openai.com"
       }
     ]
   }

2. mail_signup · Aug 19, 2026
   Signup: 'Verify your OpenAI account' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0001"
   }

3. mail_signup · Aug 19, 2026
   Signup: 'Welcome to ChatGPT' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0002"
   }

4. mail_signup · Aug 26, 2026
   Signup: 'Verify your OpenAI account' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0003"
   }

5. mail_billing · Sep 2, 2026
   Billing: 'Your OpenAI receipt' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0006"
   }

6. mail_billing · Sep 13, 2026
   Billing: 'Your ChatGPT Plus subscription renewed' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0007"
   }

7. corroboration
   Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)
   Detail

   {
     "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002"
   }

8. corroboration
   Also found by another lane (mdca:11114)
   Detail

   {
     "findingKey": "mdca:11114"
   }

9. corroboration
   Also found by another lane (mde:openai-chatgpt)
   Detail

   {
     "findingKey": "mde:openai-chatgpt"
   }