Shadow AI Detection

A detection of a shadow AI agent on a specific managed device, linked to the device's Microsoft 365 user.

Part of the Microsoft Agent 365 inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Daily	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Agent	Shadow AI Agent	The shadow AI agent detected on this device.	{{ShadowAIDetection.Agent}}
Agent name	String	The shadow AI agent detected on this device.	{{ShadowAIDetection.AgentName}}
Compliance state	String	Intune compliance state of the device.	{{ShadowAIDetection.ComplianceState}}
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{ShadowAIDetection.CreatedTime}}
Device name	String	Name of the managed device the agent was detected on.	{{ShadowAIDetection.DeviceName}}
Device type	String	Type of the managed device (Desktop, Laptop, Virtual Machine, etc.).	{{ShadowAIDetection.DeviceType}}
Display Name	String		{{ShadowAIDetection.DisplayName}}
Last Intune scan	DateTime	Last time the device synced with Microsoft Intune.	{{ShadowAIDetection.LastIntuneSync}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{ShadowAIDetection.LastModifiedTime}}
User	User	The Microsoft 365 user the device is assigned to.	{{ShadowAIDetection.M365User}}
User name	String	The Microsoft 365 user the device is assigned to.	{{ShadowAIDetection.M365UserName}}
Operating system	String	Operating system installed on the device.	{{ShadowAIDetection.OperatingSystem}}
OS version	String	Operating system version installed on the device.	{{ShadowAIDetection.OsVersion}}
Ownership	String	Whether the device is corporate or personally owned.	{{ShadowAIDetection.OwnerType}}
Risk Score	Int32	Stores risk score	{{ShadowAIDetection.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{ShadowAIDetection.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{ShadowAIDetection.RiskScoreValue}}

Relations

Relation	Service	Description
Shadow AI Agent	Microsoft Agent 365	Unmanaged local AI tools and agents (chatbots, coding assistants, local models, agentic CLIs) detected on Intune-managed devices that were not approved by IT.
User	Microsoft 365	All users registered in your tenant (internal, external)

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.