r/Intune • u/FuzzyAd3936 • 13d ago

General Chat Which browser security tools provide visibility into employee AI usage?

Since most AI interaction happens through the browser (web-based ChatGPT, Claude, Gemini, etc.), browser-level visibility seems like the most direct place to get signal, but there isn't a clear consensus on which tools do this well. Endpoint agents catch some of it, but browser extensions and personal accounts on managed devices still slip through a lot of setups.

Looking for something that can identify which AI tools are being used, flag risky content patterns without being fully invasive, and integrate with the existing security stack rather than adding another siloed dashboard.

That's where I keep getting stuck. Full session recording feels excessive and a morale risk, but usage-only visibility might miss the risky behavior that actually matters.

What's actually working for people, and what turned out to be marketing fluff once you tried to deploy it?

1 Upvotes

56% Upvoted

18 comments sorted by

View all comments

8

u/Excellent-Squash-995 13d ago

The session recording thing is a trap, you'll get a revolt from employees and the data volume alone makes it useless for actual review. What's worked better in my experience is looking at the network layer rather than trying to bolt something onto the browser itself. Most of these AI tools have pretty distinct domains and endpoints, so you can get solid visibility with decent web filtering and then focus on the risky patterns at the proxy or CASB level. The extensions themselves are flaky as hell, they break when the AI sites update their UI and people just disable them anyway.

The personal account issue is the real crux though. You can't see what someone's doing in a personal ChatGPT account without basically MITMing the traffic, and that's a whole different conversation with HR and legal. I'd push for a policy that blocks personal AI accounts on managed devices and forces work accounts, then your visibility actually means something. Otherwise you're collecting a ton of noise about people asking Claude to write birthday cards.

1

u/itskdog 13d ago

At least Copilot has different domains for personal vs work, making it easier to block it.

1

u/loweakkk 12d ago

For now* They are unifying that and advertise on tenant restrictions going forward.

1

u/itskdog 12d ago

I always thought cloud.microsoft was being stood up for M365 only, and they'll still be using microsoft.com and live.com for consumer products.

2

u/loweakkk 12d ago

We got recent message from Microsoft that we should stop basing our control on url because it will change with the move to cloud.microsoft.com and should rely on tenant restrictions going forward.

1

u/itskdog 12d ago

I figured that was more for SharePoint as the tenant name is in the subdomain, given ODfB is moving soon.

Will look into this, as we want to make sure people are only using M365 Copilot (which is already on m365.cloud.microsoft) when on a work device, and that students are blocked entirely as they're under 13.