When AI Gets the Keys to Your Microsoft 365 Account

AI Integration Security Changes When AI Connects to Your Business

Most business owners think about AI integration security this way: What information are my employees putting into ChatGPT, Claude or another AI tool?

That’s a good question.

But there’s a much bigger question emerging:

What happens when the AI doesn’t need an employee to give it the information because it can retrieve the information itself?

Businesses are beginning to connect AI tools and custom applications directly to Microsoft 365 and other cloud systems. Depending on how they’re configured, those applications may be able to access files, email, calendars, Teams conversations, and other company information.

And in some cases, they may be able to do more than read it.

They may be able to change it.

There’s a Big Difference Between Using AI and Connecting AI

AI integration security becomes much more important as you move from simply using AI to giving it authenticated access to business systems.

Think about three levels.

Level 1: Using AI

An employee opens an AI tool and asks it to summarize a document, improve an email or analyze some information.

The employee generally decides what information goes into the AI.

Level 2: Integrated AI

The AI application authenticates directly to systems such as Microsoft 365.

Instead of an employee uploading a document, the application may be able to retrieve information the employee already has permission to access.

Level 3: AI That Can Take Action

Now the application may potentially be allowed to modify information or perform actions.

Depending on the integration, that could mean working with files, calendars, email or other business data.

That progression matters.

The internal Slingshot review that inspired this topic emphasized an important nuance: delegated access is generally limited by what the signed-in employee can access. But an employee with broad access may still give an integrated application substantial reach.

“But We Require MFA”

Good. You should.

That’s why AI integration security involves more than MFA. Businesses also need to understand application permissions, consent and ongoing access.

But MFA answers the question:

“Is this really the person trying to sign in?”

It doesn’t necessarily answer:

“What is this application allowed to do after that person signs in?”

That’s where application permissions, consent and identity security become important.

An employee can legitimately authenticate to an approved application using MFA, while that application subsequently performs legitimate automated activity using the access it has been granted.

Nothing has necessarily been hacked.

That’s precisely why monitoring these environments is becoming more complicated.

A Security Alert Doesn’t Automatically Mean You’ve Been Hacked

Security monitoring may detect a new application, user consent, permission change or unusual cloud activity.

The easy responses are at opposite extremes:

“I’ve never heard of this. Block it.”

or

“Oh, that’s our AI application. Ignore it.”

Neither is particularly good security.

The better questions are:

Is this application known?
Is this user expected?
Does the activity match its business purpose?
Are these the permissions we previously approved?
Has anything changed?

That’s essentially the approach we use when reviewing cloud application activity. Our internal guidance specifically warns against automatically treating a known AI/custom application as malicious or automatically approving an alert simply because its name is familiar.

The Question Every Business Should Be Able to Answer

Ask whoever manages your IT:

“Can you show me every AI or custom application that has access to our Microsoft 365 environment and tell me what each one can do?”

That’s a very different question from:

“Are our employees using ChatGPT?”

You may discover applications connected to Microsoft 365 that are perfectly legitimate and important to your business.

That’s fine.

But someone should know they’re there.

Create an AI Application Register

You don’t need a 40-page AI governance manual to get started.

For every AI integration or custom cloud application, document:

Application: What is it?
Purpose: Why does the business need it?
Owner: Who is responsible for it?
Users: Who should be able to use it?
Data: What business information can it access?
Permissions: Can it read information, change information or take actions?
Credentials: How does it authenticate?
Environment: Is it production, development or testing?
Monitoring: What should normal activity look like?
Shutdown: How do we safely disconnect it?

That last question is particularly important.

You don’t want to discover during a security incident that nobody knows whether disabling an application will stop an attack or stop your accounting department.

This closely follows the application register recommended in our technical review: document ownership, purpose, accessed systems/data, permissions, credentials, production/test status, logging and a shutdown procedure.

AI Isn’t the Problem. Invisible Access Is.

AI integration can be incredibly useful.

Good AI integration security isn’t about blocking useful technology. It’s about understanding what has access, why it needs that access and who is responsible for it.

An AI assistant that can find documents, summarize meetings, search company information and help employees work across business systems could save enormous amounts of time.

The problem isn’t giving technology access.

Businesses have been doing that for decades.

The problem is giving an application powerful access and then forgetting that the access exists.

That’s why the next stage of AI security isn’t simply telling employees:

“Don’t put confidential information into AI.”

It’s also asking:

“What AI already has access to our confidential information?”

What Slingshot Can Do

Slingshot can help businesses across Northeastern Massachusetts review their Microsoft 365 environment for connected applications, permissions, and other potential security gaps.

We’re not there to tell your developers how to build their applications.

We’re there to help answer the security questions around them:

Who has access? What can they access? What should we monitor? And what happens if something goes wrong?

Concerned about what applications may already be connected to your Microsoft 365 environment? Contact Slingshot and we’ll help you take a look.

Not Sure Who Has the Keys to Your Microsoft 365?

AI tools and custom applications may have more access to your business data than you realize. Slingshot can help you review the applications connected to Microsoft 365, understand their permissions, and identify anything that deserves a closer look.

FAQ

Can an AI application access Microsoft 365?

Yes. Applications can be granted authenticated access to Microsoft 365 services through Microsoft’s identity and application framework. What they can access depends on the permissions granted and how the integration is designed.

Does MFA protect us from AI application risks?

MFA remains essential, but it doesn’t replace application governance. A legitimate user can authenticate successfully while an authorized application subsequently uses permissions that have been granted to it.

Does an application security alert mean we’ve been hacked?

No. Application and permission activity can be completely legitimate. The important question is whether the application, user, permissions and behavior match what your organization expects.

Should we block AI applications?

Not automatically. Disabling a legitimate integration without understanding it could disrupt an important business process. First determine what the application does, who owns it and what access it requires.

How do we know what AI applications have access to Microsoft 365?

Your IT provider or Microsoft 365 administrator can review enterprise applications, application registrations, consent, permissions and sign-in activity to build an inventory of connected applications.