Claude

1. 01Claude shows up on the network but holds no Entra consent, so people are using personal accounts or no account at all. Conditional Access cannot see it; block or coach at the gateway with a Defender for Cloud Apps unsanction policy.
2. 02Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.

• ●Medium43ClaudeEmail1 person
• ●Medium25Claude: sensitive dataPurview DLP1 person
• ●Medium40ClaudeSIEM · Splunk (demo)1 person
• ●Medium41ClaudeCode · GitHub (demo)0 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. network_discovery · Sep 13, 2026
   Seen on the network via Defender for Endpoint: 3 users, 860 transactions, 6 MB uploaded in 30 days
   Detail

   {
     "domains": [
       "claude.ai",
       "anthropic.com"
     ],
     "category": "generativeAi",
     "mdcaAppId": "34211",
     "riskScore": 8,
     "ipAddresses": 3,
     "downloadBytes": 23068672
   }