ChatGPT user with no Entra ID identity
AI summary
ChatGPT users without matching Entra ID identities are invisible to Microsoft 365 controls like conditional access, lifecycle management, and offboarding. Identifying and connecting these accounts to real people or removing their access closes the security gap they create.
What it detects
Detects ChatGPTChatGPT EnterpriseChatGPT Enterprise is the business plan of the ChatGPT AI assistant by OpenAI.Read more users who do not match any Entra IDMicrosoft Entra IDMicrosoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant.Read more user by email.
Why it matters
An account with no directory identity is invisible to every Microsoft 365Microsoft 365Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps.Read more control the company relies on: no conditional access, no lifecycle, no department, no offboarding. It is also the account nobody will think to disable. Match the address to a real person or remove the membership. This needs the Microsoft 365 Users inventory scanned in the same environment: without it every ChatGPT user matches.
The rule
Every ChatGPT User where M365 user is empty
In Rencore Governance
Details
| Applies to | ChatGPT user |
|---|---|
| Connector | ChatGPT Enterprise |
| Severity | High |
| Category | Security |
| Recommended | Yes |
| Recommended automation | Remove ChatGPT Workspace User (with approval) |
| License type | Standard |
Related policies
Other policies that check ChatGPT user objects:
- Codex seat with no Codex usage (Low)
- Idle ChatGPT seat (Low)
- Inactive user still holding objects (High)
- Manually managed ChatGPT user (Medium)
- ChatGPT login bypassed SSO (High)
- ChatGPT user with no spend cap (Medium)
- ChatGPT user over 80% of their spend cap (Medium)
Frequently asked questions
What does the ChatGPT user with no Entra ID identity policy detect?
What does the ChatGPT user with no Entra ID identity policy detect?The ChatGPT user with no Entra ID identity policy detects ChatGPT users who do not match any Entra ID user by email.
Which objects does the ChatGPT user with no Entra ID identity policy check?
Which objects does the ChatGPT user with no Entra ID identity policy check?The ChatGPT user with no Entra ID identity policy checks ChatGPT user objects from the ChatGPT Enterprise inventory and reports each one that matches its rule as a violation.
Which automation is recommended for the ChatGPT user with no Entra ID identity policy?
Which automation is recommended for the ChatGPT user with no Entra ID identity policy?Rencore Governance recommends the Remove ChatGPT Workspace User (with approval) automation template for the ChatGPT user with no Entra ID identity policy.
How severe is a violation of the ChatGPT user with no Entra ID identity policy?
How severe is a violation of the ChatGPT user with no Entra ID identity policy?Violations of the ChatGPT user with no Entra ID identity policy have High severity. The policy is in the Security category.
Which module includes the ChatGPT user with no Entra ID identity policy?
Which module includes the ChatGPT user with no Entra ID identity policy?The ChatGPT user with no Entra ID identity policy comes with the ChatGPT Enterprise connector (in preview) in the AI & Agents module of Rencore Governance, an add-on module on the Premium and Enterprise Plans.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?