ChatGPT

1. 01ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
2. 02ChatGPT is installed as a desktop app on 2 devices. If it is not approved, block it with App Control for Business or an attack surface reduction rule, and deploy the sanctioned alternative through Intune.
3. 03Device telemetry names the exact machines and accounts reaching chatgpt.com, api.openai.com. Use it to target coaching rather than blanket blocks.

• ▲Critical85ChatGPTEntra consentall users
• ◆High51ChatGPTNetwork11 people
• ◆High58ChatGPTEmail4 people
• ◆High60ChatGPT via Power PlatformAzure & Power Platform3 people
• ◆High70ChatGPT: sensitive dataPurview DLP3 people
• ◆High66ChatGPTSIEM · Splunk (demo)3 people
• ▲Critical81ChatGPTCode · GitHub (demo)0 people
• ●Medium38ChatGPTOkta (demo)10 people
• ●Medium30ChatGPTGoogle Workspace (demo)5 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. endpoint_telemetry · Sep 13, 2026
   Defender for Endpoint saw ChatGPT on 2 devices (2 accounts) in 30 days: 1 process observation; installed on 1 devices; device connections to chatgpt.com, api.openai.com
   Detail

   {
     "domains": [
       {
         "host": "chatgpt.com",
         "count": 2
       },
       {
         "host": "api.openai.com",
         "count": 1
       }
     ],
     "signals": {
       "network": 3,
       "process": 1,
       "software": 1,
       "extension": 0,
       "model_file": 0,
       "local_server": 0
     },
     "software": [
       {
         "name": "ChatGPT",
         "devices": 1,
         "version": "1.2026.240"
       }
     ],
     "processes": [
       {
         "name": "ChatGPT.exe",
         "count": 1
       }
     ],
     "extensions": [],
     "deviceNames": [
       "LT-ALICE",
       "LT-DAVE"
     ]
   }

2. corroboration
   Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)
   Detail

   {
     "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002"
   }

3. corroboration
   Also found by another lane (mdca:11114)
   Detail

   {
     "findingKey": "mdca:11114"
   }