ChatGPT

1. 012 seats belong to addresses outside the company in the OpenAI organization. Remove them or move the account to SSO with domain verification so only directory identities can hold a seat.
2. 02ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
3. 032 API keys have not been used in 90 days or never at all. Revoke them; a key that is not used is only a liability.
4. 045 of 11 members are owners or admins. Keep admin to two or three named people and use workspace roles for everyone else.
5. 05Spend grew 51% to 4,360 USD in 30 days. Set a monthly budget alert on the vendor side and per-workspace limits where the vendor supports them.
6. 061 key is held by service accounts. Confirm each maps to a production system with an owner, and rotate on a schedule.
7. 07With 11 members, manage seats through SCIM or the directory rather than by hand, and mirror the member list against leavers monthly.

• ▲Critical85ChatGPTEntra consentall users
• ◆High51ChatGPTNetwork11 people
• ●Medium48ChatGPTEndpoint2 people
• ◆High58ChatGPTEmail4 people
• ◆High60ChatGPT via Power PlatformAzure & Power Platform3 people
• ◆High70ChatGPT: sensitive dataPurview DLP3 people
• ◆High66ChatGPTSIEM · Splunk (demo)3 people
• ▲Critical81ChatGPTCode · GitHub (demo)0 people
• ●Medium38ChatGPTOkta (demo)10 people
• ●Medium30ChatGPTGoogle Workspace (demo)5 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. vendor_org · Sep 13, 2026
   OpenAI (demo) (Contoso): 11 members, 5 admin, 3 workspaces, 4 API keys, 149,420 requests, 4,360 USD in 30 days
   Detail

   {
     "byModel": [
       {
         "model": "gpt-4.1",
         "tokens": 34800000,
         "requests": 137520
       },
       {
         "model": "gpt-4o-mini",
         "tokens": 4800000,
         "requests": 11400
       },
       {
         "model": "o3",
         "tokens": 2000000,
         "requests": 500
       }
     ],
     "settings": {},
     "warnings": []
   }

2. external_member · Feb 16, 2026
   [email protected] holds a seat (member) outside the organization's domains
   Detail

   {
     "role": "member"
   }

3. external_member · Jul 31, 2026
   [email protected] holds a seat (member) outside the organization's domains
   Detail

   {
     "role": "member"
   }

4. stale_key · Apr 17, 2026
   API key 'dave-laptop' ([email protected]) last used 2026-04-17
   Detail

   {
     "ownerType": "user",
     "workspace": "proj_default"
   }

5. stale_key · Jun 11, 2026
   API key 'notebook-test' ([email protected]) never used
   Detail

   {
     "ownerType": "user",
     "workspace": "proj_default"
   }

6. corroboration
   Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)
   Detail

   {
     "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002"
   }

7. corroboration
   Also found by another lane (mdca:11114)
   Detail

   {
     "findingKey": "mdca:11114"
   }

8. corroboration
   Also found by another lane (mde:openai-chatgpt)
   Detail

   {
     "findingKey": "mde:openai-chatgpt"
   }

9. corroboration
   Also found by another lane (mail:openai-chatgpt)
   Detail

   {
     "findingKey": "mail:openai-chatgpt"
   }

10. corroboration
    Also found by another lane (pp:shared_openai)
    Detail

    {
      "findingKey": "pp:shared_openai"
    }

11. corroboration
    Also found by another lane (dlp:openai-chatgpt)
    Detail

    {
      "findingKey": "dlp:openai-chatgpt"
    }

12. corroboration
    Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt)
    Detail

    {
      "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:openai-chatgpt"
    }

13. corroboration
    Also found by another lane (repo:giypXj7r_Gc5tatesErdR:openai-chatgpt)
    Detail

    {
      "findingKey": "repo:giypXj7r_Gc5tatesErdR:openai-chatgpt"
    }

14. corroboration
    Also found by another lane (idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt)
    Detail

    {
      "findingKey": "idp:9BKV_xBnZf5pDRMXOQ1jy:openai-chatgpt"
    }

15. corroboration
    Also found by another lane (idp:EuOZkNxsuTloBalkqeoRT:openai-chatgpt)
    Detail

    {
      "findingKey": "idp:EuOZkNxsuTloBalkqeoRT:openai-chatgpt"
    }