ChatGPT

1. 0150 MB uploaded to ChatGPT in 30 days from 11 people. Check what data is leaving with Defender's file and session policies.
2. 02ChatGPT is corroborated by an Entra consent grant. Review both findings together; the consent finding shows what data the app can read.
3. 03ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
4. 04Adoption is broad enough that outright blocking will disrupt work. Prefer a sanctioned alternative plus Conditional Access.

• ▲Critical85ChatGPTEntra consentall users
• ●Medium48ChatGPTEndpoint2 people
• ◆High58ChatGPTEmail4 people
• ◆High60ChatGPT via Power PlatformAzure & Power Platform3 people
• ◆High70ChatGPT: sensitive dataPurview DLP3 people
• ◆High66ChatGPTSIEM · Splunk (demo)3 people
• ▲Critical81ChatGPTCode · GitHub (demo)0 people
• ●Medium38ChatGPTOkta (demo)10 people
• ●Medium30ChatGPTGoogle Workspace (demo)5 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. network_discovery · Sep 14, 2026
   Seen on the network via Defender for Endpoint, Palo Alto log collector: 11 users, 5110 transactions, 50 MB uploaded in 30 days
   Detail

   {
     "domains": [
       "chatgpt.com",
       "chat.openai.com",
       "oaiusercontent.com"
     ],
     "category": "generativeAi",
     "mdcaAppId": "11114",
     "riskScore": 7,
     "ipAddresses": 6,
     "downloadBytes": 188743680
   }

2. corroboration
   Also holds an Entra consent grant (consent:aaaa0002-0000-4000-8000-000000000002)
   Detail

   {
     "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002"
   }