Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Find shadow AI by combining endpoint telemetry, network inspection, identity attribution and a controlled agent registry. Then assign every discovered agent an owner, purpose, unique identity, bounded permissions and lifecycle status. Use centralized policy, an AI gateway, logging, quotas and pause or block controls to contain risk without driving useful work further underground.
Shadow AI means consumer-facing AI applications or standalone agents deployed without IT visibility or approval. Unlike a one-off chat prompt, an agent can run autonomously, reach data sources, call external services and take actions. That combination creates blind spots around data leakage, compliance, security vulnerabilities, cost and auditability.
What counts as a shadow AI agent?
An AI agent is shadow AI when it is deployed or used in the organization without IT visibility or approval. It may be a desktop application, a locally running model, a browser-based service, a workflow bot, or an agent built in a cloud platform. The important distinction is not the vendor or model; it is whether the organization can see, identify and govern the agent.
Free tools Windows power users keep installed
One-click scans. No signup required.
Agents create more risk than ordinary unsanctioned software because they may act without a person reviewing every step. An unreviewed agent can retrieve internal documents, send messages, create records, execute code, or transmit data to an external service. Microsoft’s governance guidance warns that an agent touching customer or financial data can turn an unreviewed shortcut into a reportable failure in a regulated environment.
#1 Best Overall
- Unknown data access: The agent may read repositories, mailboxes, file shares or databases outside an approved scope.
- Unknown actions: It may alter records, publish content, send messages or invoke tools with no formal approval.
- External-service exposure: Prompts, files or outputs may pass through services that have not been assessed for retention, residency or contractual controls.
- Weak auditability: If the agent has no durable identity or central logs, you may be unable to prove who initiated an action or what data it used.
- Unmanaged cost and attack surface: Forgotten deployments can consume model tokens, retain credentials and remain exploitable after their original user leaves.
Do not treat the term as a prevalence estimate. The official material used for this guide does not establish a reliable percentage of organizations or employees using shadow agents.
Start with one authoritative agent registry
Discovery tools produce observations; a registry turns those observations into accountable assets. Maintain one organizational record for every AI agent, including approved projects and agents found through investigation. A spreadsheet can start the process, but a system that supports ownership, change history and workflow is safer at scale.
| Registry field | What to record | Why it matters |
|---|---|---|
| Identity | Unique agent identifier, service principal or platform identity | Separates one agent from a user account or another deployment and enables policy binding. |
| Owner | Named business owner and technical custodian | Creates a person responsible for decisions, incidents and retirement. |
| Purpose | Specific business task and expected outcome | Lets reviewers test whether permissions and behavior are proportionate. |
| Platform and location | Cloud service, desktop, server, container, workflow platform and region | Determines which telemetry and jurisdictional controls apply. |
| Data sources | Repositories, APIs, mailboxes, databases and file shares | Defines the information boundary that must be protected. |
| Permissions and actions | Read, write, send, execute and administrative capabilities | Supports least-privilege review and rapid containment. |
| External services | Model providers, plugins, connectors and destinations | Exposes third-party processing and transfer paths. |
| Approval state | Proposed, approved, restricted, rejected or under investigation | Prevents a discovery record from being mistaken for authorization. |
| Lifecycle status | Planned, active, dormant, suspended or retired, with dates | Allows periodic review and removal of abandoned assets. |
Require an owner and purpose before an agent can move from “under investigation” to “approved.” If either is missing, keep the agent restricted while the review proceeds.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Discover agents with four complementary signals
No single inventory is complete. Combine device, network, identity and registry data, then reconcile the results. The following sources answer different questions.
1. Endpoint telemetry shows what runs on devices
Use endpoint detection to identify AI applications and local runtimes installed or executed on managed devices. Microsoft’s Shadow AI preview uses Defender for Endpoint and records the first accessed date, most recent activity, last scanned date, device count, user count and whether a blocking Intune policy was applied.
Export or otherwise retain those fields with the device and user identifiers needed for investigation. A first-access date helps establish when exposure began; recent activity separates an active deployment from an abandoned installation. Device and user counts show whether the issue is isolated or distributed across departments.
Endpoint data can miss browser-only services, unmanaged devices and agents running in cloud environments. Treat it as one signal rather than the complete estate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
2. Network inspection reveals destinations and traffic
Global Secure Access AI Agent Discovery inspects internet-bound traffic and can identify local agents and Copilot Studio agents. It classifies an agent as managed or shadow according to whether it has a Microsoft Entra Agent ID registration, then attributes activity to the originating user, device and process. It also exposes destinations and traffic volume.
The documented preview prerequisites are the Global Secure Access client, internet access forwarding and TLS inspection for local agents. Copilot Studio agents require the relevant integration. Without forwarding or inspection, visibility will be partial, so record those coverage gaps in the registry.
Network evidence is especially useful when an employee uses a portable binary, a browser service or an agent that is not installed through your software-distribution system. Destination and volume data can help prioritize an agent that is transmitting large amounts of sensitive material, but traffic volume alone does not prove that a policy violation occurred.
3. Identity and process attribution connect activity to a responsible person
Preserve the originating user, device, process and agent identity whenever a signal provides them. A name such as “AI helper” is not an identity. Every approved agent should have a distinct identity that can be disabled independently of the employee who operates it.
Recommended Free Tools
Microsoft recommends Entra Agent ID for agent identity, permissions and lifecycle controls, with policies bound to organizational identity governance. Organizations using other identity stacks should apply the same objective: a unique, non-shared identity with ownership, credential rotation and an auditable disable path.
4. Reconcile findings against the registry
- Normalize names and identifiers from endpoint, network, cloud and SaaS sources so that one deployment is not counted several times.
- Match each observation to a registry record using the strongest available keys: agent identity, service principal, device, process path, destination and owner.
- Mark unmatched observations as candidates for review, not as approved agents.
- Investigate records lacking an owner, purpose, identity, approved data scope or current deployment date.
- Ask the owner to demonstrate the agent’s configured tools, data paths and expected actions.
- Record the decision, reviewer, date, conditions and next review date in the registry.
“You can’t govern agents you don’t know exist” is the practical reason to keep discovery and registry reconciliation continuous rather than making it a one-time audit.
Triage discovered agents before choosing a response
Use a consistent disposition so investigators do not jump directly from detection to blanket blocking.
Rank #3
| Finding | Immediate treatment | Required next step |
|---|---|---|
| Known identity, owner and approved scope | Managed | Verify that observed behavior and permissions still match the record. |
| Known tool but no registry record | Restricted pending review | Create a record, identify the owner and document data and action scope. |
| Unknown owner or shared credentials | Pause high-risk actions and preserve logs | Establish an accountable owner and replace shared credentials with a unique identity. |
| Access to sensitive data outside approved scope | Contain immediately | Revoke the excess permission, investigate data access and approve a narrower design. |
| Dormant or abandoned deployment | Schedule retirement | Remove credentials, connectors and stored data, then close the registry record. |
| Evidence of malicious or clearly prohibited activity | Block and escalate under incident procedures | Preserve endpoint, network and identity evidence before cleanup. |
Keep the evidence that led to the disposition. A later reviewer should be able to see which device, user, process, destination or identity produced the finding.
Control architecture for approved and formerly shadow agents
Give every agent a unique identity
Create a dedicated identity for each agent or tightly defined deployment. Do not let several agents share a human account, a generic API key or an administrator credential. Bind permissions and policy to the agent identity, not only to the employee who requested it. Rotate credentials and make disabling the identity a tested, one-step response.
Separate development, test and production identities. A prototype should not inherit production data access merely because it was copied from a working agent.
Apply least privilege to data and actions
Start with the narrowest read-only access that can satisfy the stated purpose. Add a write, send, execute or administrative capability only when the owner documents why it is required and how the action will be reviewed. Limit connectors by repository, record type, geography and environment where the platform allows it.
Review permissions after material changes to prompts, tools, model, connectors or workflow. Agent behavior can drift even when the identity remains unchanged.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Centralize policy and route traffic through a managed gateway
Use a governance layer to enforce rules for data access, allowed actions, sharing and user access. Where possible, route model and tool traffic through a managed AI gateway. A gateway gives security teams one place to apply authentication, logging, throttling and traffic management instead of relying on settings in every individual agent.
Configure token limits and quotas per agent, owner or business unit. Quotas control runaway usage and cost, while throttling protects shared capacity. Define a pause or resume operation that suspends an agent without deleting its configuration or evidence.
Log enough to reconstruct decisions
Capture authentication, prompt or request metadata where policy and privacy rules permit, tool calls, data sources, outputs sent externally, policy decisions, errors, quota events and administrative changes. Retain the originating user, device, process and agent identity. Set retention according to legal, regulatory and incident-response requirements; the official guidance cited here does not prescribe a universal retention period.
Protect logs from alteration and restrict access to investigators and authorized administrators. Logging that cannot be searched during an incident is not an effective control.
Monitor behavior and drift
Alert on new destinations, unusual data volume, access to repositories outside the registry, failed policy checks, privilege changes, sudden token consumption and activity from an unexpected geography or device. Compare current tool use and permissions with the approved record.
Review costs, policy compliance and access patterns on a schedule appropriate to risk. High-impact agents handling financial, customer or regulated information need more frequent review than a read-only internal summarizer.
Use targeted blocking, not a permanent blanket ban
Blocking is appropriate when an agent is malicious, materially exceeds its authorization or cannot be brought under accountable ownership. Microsoft’s current Shadow AI preview lists detection for OpenClaw, ChatGPT Desktop, Ollama Desktop, Poe Desktop, Claw/ZeroClaw, OpenCode and Claude Desktop. In that preview, blocking is listed for OpenClaw and is limited to managed Windows devices enrolled with Intune.
Those supported-agent and blocking details are preview capabilities, not a universal control model. Recheck current documentation before procurement or promising coverage. For other agents, use the equivalent control in your endpoint, identity, network or gateway stack, and document exactly which device types and operating systems it covers.
Operate the agent estate through its full lifecycle
- Request: The requester states the business outcome, data sources, actions, owner and expected users.
- Assess: Security, privacy and compliance reviewers examine data classification, external services, identity, permissions and failure modes.
- Build: The team creates a distinct identity, least-privilege connectors, logging, quotas and a tested pause path.
- Approve: The registry records the decision, conditions, deployment location, review date and responsible owner.
- Monitor: Telemetry and gateway logs are compared with the approved purpose and scope.
- Change: New tools, data sources, models, destinations or high-impact actions trigger a review rather than silently inheriting approval.
- Suspend or retire: Pause risky agents quickly; when an agent is no longer needed, remove credentials and connectors, delete or retain data according to policy, and mark it retired.
Review dormant deployments explicitly. An unused agent may still retain a valid credential, a connector to sensitive data or an exposed runtime. Retirement is a security action, not just housekeeping.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make the approved path easier than the workaround
Shadow adoption often signals an unmet need. Employees may be trying to summarize documents, automate a repetitive task or connect systems that the sanctioned catalog does not support. If the approved route is slow, unclear or unavailable, users will continue to seek alternatives.
- Publish a searchable catalog of approved agents, models, connectors and permitted data classes.
- Provide a short intake form that asks for purpose, owner, users, data and actions rather than an abstract AI risk statement.
- Offer a supported starter pattern for common needs such as document summarization, ticket triage or internal search.
- State review service levels and give requesters a way to see status.
- Explain why a request is restricted and what redesign would make it acceptable.
- Train employees to report an existing unsanctioned agent without implying automatic punishment for good-faith disclosure.
The goal is not to approve every tool. It is to make the governed option faster and more useful than an unapproved workaround.
A practical 30-, 60- and 90-day rollout
Days 1–30: establish visibility
- Name an executive sponsor, security owner and business governance group.
- Create the registry and required fields; load known projects and manually reported agents.
- Enable available endpoint and network discovery on a defined pilot population.
- Document telemetry gaps, unmanaged device populations and systems that cannot provide identity attribution.
- Set a temporary rule that new agents need an owner and purpose before receiving sensitive access.
Days 31–60: establish control
- Assign unique identities to approved agents and remove shared credentials.
- Implement least-privilege connector scopes and separate development from production.
- Route supported traffic through a managed gateway and configure quotas, token limits and pause procedures.
- Define log fields, access permissions and retention decisions with privacy and legal stakeholders.
- Run a tabletop exercise for an agent that must be paused while evidence is preserved.
Days 61–90: establish continuous governance
- Reconcile discovery feeds with the registry on a recurring schedule.
- Set review intervals based on data sensitivity and action capability.
- Retire dormant assets and verify that credentials and connectors were removed.
- Publish the approved catalog and intake route, then measure request volume and turnaround time.
- Report coverage, unowned findings, policy violations, response time and retirement backlog to leadership.
Compare implementation options by control objective
When evaluating products or assembling controls from existing platforms, compare capabilities rather than marketing labels. The following matrix reflects the control questions an enterprise should answer; licensing, regional availability and retention terms are not stated in the official guidance summarized here and must be confirmed for the specific deployment.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Control question | Endpoint approach | Network approach | Registry and identity approach |
|---|---|---|---|
| What can it see? | Installed and executed applications on covered devices. | Internet-bound traffic, destinations and volume where forwarding and inspection are enabled. | Declared agents, owners, platforms, data sources and permissions. |
| Can it attribute activity? | Device and logged-in user, plus process details when available. | Originating user, device and process for supported detections. | Agent identity and owner, if records are complete. |
| Can it distinguish managed from shadow? | Only by reconciling findings with approval data. | Managed or shadow classification based on Entra Agent ID registration in the documented preview. | Approval state and lifecycle status are explicit registry fields. |
| Can it prevent action? | Device or application policy; documented blocking scope varies. | Gateway, DNS, proxy or traffic policy where supported. | Disable identity, revoke permissions or pause the agent. |
| What integration is required? | Managed endpoint agent and policy service. | Global Secure Access client, internet forwarding and TLS inspection for local agents; Copilot Studio integration for those agents. | Identity provider, workflow and a maintained registry. |
| What remains unknown? | Cloud-only and unmanaged-device activity. | Encrypted or unforwarded traffic and activity outside inspected paths. | Unreported deployments and inaccurate owner or purpose entries. |
Before procurement, verify discovery coverage across endpoint, network, cloud and SaaS; identity attribution; registry depth; data-loss controls; policy granularity; blocking scope; logging and retention; integration requirements; deployment geography; licensing; and response speed. Preview status and supported-agent lists can change.
Common failure modes and recovery steps
“Our software inventory shows no shadow agents.”
Software inventories usually miss browser services, personal accounts, cloud workflows and tools installed outside managed distribution. Add endpoint execution telemetry, network inspection and identity evidence, then reconcile each signal with the registry.
“We found an agent but cannot identify its owner.”
Restrict high-risk actions, preserve the device, process, destination and authentication evidence, and ask the responsible business unit to validate the purpose. Do not convert a shared credential into an assumed owner. Create a unique identity before approval.
“Blocking broke a legitimate workflow.”
Use the recorded business purpose and logs to identify the required data and action. Restore only the minimum capability through an approved identity, narrow connector scope, quota and monitoring. Record the exception and its review date.
“The network tool sees traffic but not the local agent.”
Check that the Global Secure Access client is installed, internet access forwarding is enabled and TLS inspection is configured for local agents. Confirm that the traffic path is actually covered; an unforwarded or exempt path cannot produce complete discovery.
“An agent is dormant, so we left it alone.”
Mark it dormant, review its credentials and connectors, and retire it if there is no current owner and purpose. Dormancy lowers observed activity but does not remove the attack surface.
Measure whether governance is working
- Discovery coverage: Percentage of managed devices, network paths and agent platforms producing telemetry.
- Registry completeness: Percentage of observed agents with an owner, purpose, unique identity, data scope and lifecycle status.
- Unmanaged exposure: Count and age of findings still lacking approval or an accountable owner.
- Least-privilege quality: Number of agents with write, send, execute or administrative permissions and the percentage with documented justification.
- Response speed: Time from high-risk discovery to pause, block or permission reduction.
- Lifecycle hygiene: Dormant agents retired, credentials rotated and connectors removed on schedule.
- Approved-path performance: Intake volume, approval turnaround and repeat requests that indicate missing sanctioned capabilities.
These measures connect visibility to an action. As Microsoft’s guidance puts it, “Visibility that ends in a report changes nothing; visibility that ends in a control does.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
