Should we allow ChatGPT or Claude connectors into Outlook?

You’re right to worry. “It shows up in the Microsoft 365 admin centre” is not the same as “it stays inside our Microsoft DPA.” A connector that authenticates a personal ChatGPT or Claude account against work mail is an export path with a friendly UI.

Here’s what’s going on. Two different lanes get confused under one “AI” label. Anthropic models inside Microsoft Copilot (when you opt in under AI providers operating as Microsoft subprocessors) generally ride Microsoft’s Product Terms and DPA — with residency caveats we covered separately. ChatGPT, Claude, Gemini and other generative AI apps that users connect to Microsoft 365 (Outlook, files, calendar) are non-Microsoft AI apps. Microsoft’s own guidance for those is DSPM for AI (Purview), Defender for Cloud Apps discovery and sanction/unsanction, and Defender for Endpoint blocking on managed devices — not “flip Copilot on and hope.” Purview even categorises Anthropic Claude Enterprise and ChatGPT Enterprise separately from browser-detected “Other AI apps.” Consent type (admin vs user), permissions, and last-used signals matter more than the logo on the splash screen.

Schofield’s First Law (historically attributed) asks how you get data out on terms you understand. Here the twin questions are: whose processor is this, and can someone glue a personal AI login to a work Entra consent?

Options that actually work in practice:

1. Deny by default + named pilot. Mark Generative AI apps unsanctioned in Defender for Cloud Apps until reviewed; use app governance policies for new discoveries; require admin consent for enterprise apps; assign any approved Entra enterprise app to a security group only. Best default for most UK organisations.
2. Sanction a true enterprise path only. If leadership insists on ChatGPT Enterprise or Claude Enterprise with contractual terms you can read, treat it as its own programme: DSPM one-click policies, DLP for Edge, sensitivity labels that block export, and a written owner for the connector. Still not “everyone’s personal free tier.”
3. Leave connectors open because productivity asked nicely. Users will connect personal accounts where vendors allow it. Audit and compliance records for that traffic are weaker than in-tenant Copilot. I’d avoid this until Security has named the residual risk in writing.

12 Panes action / comms (Steady before scale): Pane 04 Security owns a short decision: which AI apps are sanctioned, which are blocked, who may consent. Tell leadership: Copilot seats and third-party mailbox connectors are different control planes — approving one does not approve the other. Give makers a sanctioned path (or none) so shadow connectors don’t become the unofficial helpdesk.

Benefits / risks: Controlled connectors can reduce copy-paste into consumer chatbots. Uncontrolled ones move prompts and attachments outside your tenant boundary under terms you didn’t negotiate. Budgets that fund “AI tools” without an owner for app governance are how you get both spend and surprise.

I’d suggest a one-page GRC note this week: inventory Generative AI in Cloud Apps, unsanction anything without a business owner, and only then talk pilots. You’ll have peace of mind when the only mail leaving for AI processing is on a contract you can actually find.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer