Ollama

1. 01Local inference keeps prompts on the device but sits outside every SaaS control: no DLP, no audit trail, and models of unknown provenance. Confirm these devices are managed and decide whether local AI is allowed at all.

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. endpoint_telemetry · Sep 13, 2026
   Defender for Endpoint saw Ollama on 2 devices (2 accounts) in 30 days: 2 process observations; installed on 2 devices; local inference server on port 11434
   Detail

   {
     "domains": [],
     "signals": {
       "network": 0,
       "process": 2,
       "software": 2,
       "extension": 0,
       "model_file": 0,
       "local_server": 2
     },
     "software": [
       {
         "name": "Ollama",
         "devices": 2,
         "version": "0.12.2"
       }
     ],
     "processes": [
       {
         "name": "ollama.exe",
         "count": 2
       }
     ],
     "extensions": [],
     "deviceNames": [
       "LT-FRANK",
       "WS-RESEARCH-01"
     ]
   }