DeepSeek

1. 01275 MB uploaded to DeepSeek in 30 days from 2 people. Check what data is leaving with Defender's file and session policies.
2. 02DeepSeek shows up on the network but holds no Entra consent, so people are using personal accounts or no account at all. Conditional Access cannot see it; block or coach at the gateway with a Defender for Cloud Apps unsanction policy.
3. 03Defender rates DeepSeek 2/10 on security, compliance, and legal criteria. Treat it as unsuitable for work data unless the vendor closes those gaps.
4. 04DeepSeek trains on customer data. Block the app or move users to a business tier that excludes training.

• ●Medium40DeepSeekEndpoint2 people
• ◆High70DeepSeek: sensitive dataPurview DLP2 people
• ◆High62DeepSeekSIEM · Splunk (demo)1 person

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. network_discovery · Sep 12, 2026
   Seen on the network via Defender for Endpoint, Palo Alto log collector: 2 users, 2130 transactions, 275 MB uploaded in 30 days
   Detail

   {
     "domains": [
       "deepseek.com",
       "chat.deepseek.com"
     ],
     "category": "generativeAi",
     "mdcaAppId": "40311",
     "riskScore": 2,
     "ipAddresses": 2,
     "downloadBytes": 35651584
   }