Connections

Each connection is one Microsoft 365 tenant that a Global Administrator has consented to. On every sync Lantern reads app registrations, consent grants, sign-in logs, Defender for Cloud Apps discovery, Defender for Endpoint hunting data, the unified audit log, vendor email metadata, Azure AI resources, Power Platform connectors, and Purview DLP records from it.

Demo tenantConnecting a real tenant is disabled in demo mode.

Contoso

active

11111111-1111-1111-1111-111111111111

Consented: Sep 14, 2026
Last sync: 2 h ago · succeeded
Sign-in logs: available
Cloud app discovery: available
Advanced hunting: available
Vendor email: available
Purview DLP: available
Azure resources: available
Power Platform: available
Audit log: available

Granted scopes

Application.Read.AllDelegatedPermissionGrant.Read.AllUser.Read.AllOrganization.Read.AllAuditLog.Read.AllDirectory.Read.AllCloudApp-Discovery.Read.AllThreatHunting.Read.AllAuditLogsQuery.Read.AllSecurityAnalyzedMessage.Read.All

Recent runs

Lane	Status	Started	Duration	Findings	Critical	Volume	Error
m365.purview_dlp	succeeded	2 h ago	0.1 s	5	0	13 DLP records · 8 not blocked	none
cloud.ai_platforms	succeeded	2 h ago	0.3 s	12	0	7 resources · 12 connections	none
m365.mail_signals	succeeded	2 h ago	0.2 s	5	0	17 emails	none
m365.audit_log	succeeded	2 h ago	0.9 s	5	0	111 records	none
m365.advanced_hunting	succeeded	2 h ago	0.4 s	9	0	10 devices	none
m365.cloud_app_discovery	succeeded	2 h ago	0.3 s	5	1	8 discovered	none
m365.oauth_consent	succeeded	2 h ago	0.7 s	3	2	46	none

Identity outside Microsoft

Okta and Google Workspace

The consent lane for organizations whose identity lives elsewhere: AI apps assigned or signed into through Okta, third-party AI apps holding OAuth grants against Google accounts and the scopes they received, and Gemini for Workspace usage.

Okta (demo)

Demo Okta orgactive

demo data

Last sync: 1 h ago · succeeded
Recent runs: succeeded (5 apps, 165 sign-ins, 0 grants)

Google Workspace (demo)

Demo Google Workspaceactive

demo data

Last sync: 1 h ago · succeeded
Recent runs: succeeded (7 apps, 22 sign-ins, 14 grants)

Cloud platforms

AWS and Google Cloud

CloudTrail shows who is building on and calling Bedrock, SageMaker, Amazon Q, and the pre-trained AI services, from which roles and regions, and how often IAM said no. A read-only inventory adds custom models, agents, knowledge bases, guardrails, endpoints, notebooks, and Q applications, and whether Bedrock logs invocations at all.

AWS (demo)

123456789012active

regions: us-east-1, us-west-2, eu-west-1 · demo data

Last sync: 42 min ago · succeeded
Recent runs: succeeded (4 services, 125 events, 11 identities, root used)

Google Cloud audit logs show who is configuring and calling Vertex AI, the Gemini API, Gemini for Google Cloud, Vertex AI Search and Agent Builder, Dialogflow, and the pre-trained AI APIs, in which projects, and how often IAM said no. Cloud Asset Inventory adds endpoints, tuned models, notebooks, data stores, and agents, and which projects have AI APIs enabled at all.

Google Cloud (demo)

organizations/123456789012active

as [email protected] · demo data

Last sync: 42 min ago · succeeded
Recent runs: succeeded (6 services, 191 entries, 12 principals, 10 projects, API keys)

Beyond Microsoft

SIEM integrations

Point Lantern at the proxy, firewall, DNS, and EDR logs you already collect. Each integration turns the AI catalog into that product's query language and runs it read-only on every sync.

Splunk (demo)

Demo SIEM (Splunk-shaped)active

demo data

Last query: 2 h ago · succeeded
Recent runs: succeeded (5 apps, 11 rows)

Where AI gets built

Source code

Scan GitHub or Azure DevOps read-only for AI SDKs in manifests, direct calls to AI APIs, coding-assistant and MCP configuration, committed model files, and hardcoded keys.

GitHub (demo)

Demo GitHub organizationactive

owner: contoso

Last scan: 2 h ago · succeeded
Recent scans: succeeded (6 repos, 5 with AI, 3 keys)

No SIEM API?

Raw network logs

Export a proxy, firewall, DNS, or gateway log and drop it here. Lantern finds AI traffic in it without the file ever being uploaded.

Format

Files are parsed in a background thread in your browser, gzip included. Only aggregated counts per AI host, user, and source are sent, in small batches; raw log lines never leave your machine. Very large files fold source addresses and then users so the upload stays bounded. Zeek, Zscaler NSS, Palo Alto URL filtering, Cloudflare Gateway, and Squid are recognized; anything else is scanned for known AI domains.

Read-only access

What Lantern needs

Application.Read.AllSee which apps and service principals exist in the tenant.
DelegatedPermissionGrant.Read.AllSee what your users consented to and which permissions each grant carries.
User.Read.AllPut names and departments to the accounts behind each grant.
Organization.Read.AllRead the tenant name so connections are labeled clearly.
AuditLog.Read.AllRead sign-in logs to see who actually uses each AI app and how often (needs Entra ID P1 or P2).
Directory.Read.AllRequired alongside AuditLog.Read.All for the sign-in logs API.
CloudApp-Discovery.Read.AllRead Defender for Cloud Apps discovery to find AI apps on the network, including ones used with personal accounts (needs a Defender for Cloud Apps license).
ThreatHunting.Read.AllRun advanced hunting queries against Defender for Endpoint to find local AI tools, browser extensions, model files, and the devices behind AI traffic (needs onboarded devices).
AuditLogsQuery.Read.AllSearch the unified audit log for Copilot interactions, custom agents, Teams AI bots, and the record of who consented to each third-party app.
SecurityAnalyzedMessage.Read.AllRead analyzed-email metadata from Defender for Office 365 (sender, recipient, subject only) to spot AI account signups and receipts on work addresses. No mailbox is opened.

Optional: two steps admin consent cannot cover

Azure: Reader on the root management group
Assign the Reader role to Lantern's service principal at the tenant root management group (or each subscription) so Azure Resource Graph can list AI resources. No write access is requested.
Power Platform: register as a management application
Run New-PowerAppManagementApp -ApplicationId <Lantern client id> from the Power Platform admin PowerShell module. This lets Lantern list environments and connections read-only.

Consent is granted once by a Global Administrator through Microsoft's own consent screen. Lantern never sees a password and never writes to the tenant. The grant can be revoked in Microsoft Entra at any time under Enterprise applications.