Defender + Intune discovery for Claude Code, GitHub Copilot CLI, OpenClaw, and other shadow AI agents. Agent 365 governance + sanctioned-agent catalog playbook.
By Errin O'Connor, Founder & Chief AI Architect, EPC Group
Microsoft's May 2026 Agent 365 launch introduced new capabilities in Microsoft Defender and Microsoft Intune for discovering and controlling shadow AI agents on Windows endpoints — initially OpenClaw, expanding to GitHub Copilot CLI, Claude Code, and other commonly installed local agents. For enterprises facing accelerating agent sprawl (BYOAI tools, individually-installed coding assistants, vendor-provided agents bundled with developer workstations), this discovery surface is the foundation of governable agentic AI. EPC Group's discovery + control playbook walks through Defender + Intune configuration, sanctioned vs. unsanctioned agent classification, redirect-to-sanctioned-alternatives workflows, and the regulated-industry implications.
Every enterprise IT leader has faced a similar challenge. From 2008 to 2012, rogue SharePoint sites appeared as employees set up their own collaboration spaces. This made it difficult for Central IT to manage these sites.
Between 2014 and 2018, SaaS shadow IT became widespread. Departments began using tools like:
These tools operated outside the M365 stack.
The current trend from 2020 to 2024 involves generative AI. Employees are now inputting confidential data into ChatGPT and Claude web interfaces.
Each of these waves has led to common issues:
Ultimately, this results in a centralized clean-up program that takes 12-18 months and costs significantly more than addressing the issues correctly from the start.
Agent sprawl is the 2026 version of shadow IT. It now includes more than just web apps. Today, it features locally-installed AI agents such as:
These agents operate with the user's full permissions. They can access local files and the corporate network using the user's identity.
Microsoft's May 2026 expansion of Defender, Intune, and Agent 365 is the solution to this challenge.
The May 2026 release wave introduces native agent-aware discovery across two complementary surfaces.
A pure block-everything policy almost always produces worse outcomes than a published catalog of sanctioned alternatives. EPC Group's standard 4-tier model:
Examples: Microsoft 365 Copilot, Microsoft Copilot Studio, Microsoft Security Copilot, Microsoft Sales Copilot, Microsoft Service Copilot
Posture: Full Agent 365 governance applied: Entra identity, Defender posture, Purview AI Hub capture, Audit Premium retention. Sensitivity-label enforcement at grounding time. Approved for all data-classification tiers up to the customer's regulated baseline.
Examples: GitHub Copilot Enterprise (NOT free / individual), specific vendor agents with executed BAA / DPA agreements
Posture: Agent 365 governance via Microsoft Entra federation + Purview integration where supported. Per-agent risk review documented. Restricted to specific data-classification tiers.
Examples: Claude.ai, Perplexity, ChatGPT Plus (personal subscription), Gemini Advanced — research and learning contexts only
Posture: Allowed via Defender for Cloud Apps with DLP enforcement on outbound. NOT allowed to ground on Confidential, Highly Confidential, or Regulated tier content. Quarterly access review.
Examples: Unsanctioned local agents: OpenClaw, free-tier Claude Code, GitHub Copilot CLI personal, any agent without documented data-handling policy
Posture: Microsoft Defender + Intune block + alert. Service desk redirects user to sanctioned alternative. Repeat offenders trigger Insider Risk Management signal.
Since the May 2026 GA, EPC Group has run shadow-agent discovery on dozens of enterprise tenants as part of the Agent 365 governance Phase 2 deployment. Typical findings:
The issue is clear: the longer a tenant uses Copilot without Agent 365 governance, the more shadow agents appear. The solution is not punitive; it is structural.
Shadow AI refers to AI tools — Copilot assistants, coding agents, chatbots, productivity agents — that employees install and use without IT visibility or sanctioning. Agent sprawl is the cumulative effect: hundreds or thousands of individual installations of AI tools (Claude Code, GitHub Copilot CLI, OpenClaw, ChatGPT desktop clients, vendor-bundled agents) running on corporate endpoints with full access to enterprise data through the user's own permissions, no monitoring, no audit trail, and no governance.
The May 2026 capability expansion in Microsoft Defender and Microsoft Intune introduces agent-aware discovery on Windows endpoints. Defender enumerates installed processes, binary signatures, and known agent runtimes — starting with OpenClaw and expanding to GitHub Copilot CLI, Claude Code, and other widely-installed local agents. Intune surfaces the same discovery in the device compliance view so administrators can apply policy: block the agent, restrict to a sanctioned subset of endpoints, or place into elevated monitoring with prompt + response capture. Defender for Cloud Apps adds a parallel discovery surface for SaaS-based agents (web-hosted Claude, ChatGPT, Perplexity, etc.) via SWG telemetry.
In a regulated tenant (HIPAA, FINRA, SEC, FedRAMP, CMMC, GxP), every endpoint is part of the audit boundary. An unmanaged AI agent on a user laptop can: read PHI or MNPI or CUI from local files; send that data to external model providers; generate communications that bypass Communication Compliance supervisory review; and create a parallel governance gap that the regulator will surface during the next audit. EPC Group has shipped Agent 365 governance for hundreds of regulated tenants since the May 2026 GA; in every single one, Phase 2 shadow-agent discovery has surfaced unsanctioned agents that materially changed the customer's compliance posture.
No. A pure block-everything policy almost always produces a worse outcome than a sanctioned-catalog model. Employees who want AI assistance will find a way — including via personal devices outside any corporate control. The better pattern is a published "approved-agent catalog" with the security baseline pre-applied: e.g., Microsoft 365 Copilot, Microsoft Copilot Studio, GitHub Copilot Enterprise (not the free-tier or individual SKU), Microsoft Security Copilot, and a small number of vetted third-party agents pre-configured with Agent 365 governance. Users get a frictionless path to compliant tools. EPC Group typically pairs the catalog with a 90-day amnesty window: report your existing shadow agent, get migrated to a sanctioned alternative, no consequences. After day 90, blocking begins.
EPC Group runs shadow-agent discovery inside the broader Agent 365 implementation. Phase 1 Readiness Assessment includes baseline shadow-agent detection (typical findings: 50-200 in mid-market tenants, 500-2,000+ in Fortune 500 tenants). Phase 2 Foundation deploys the Defender + Intune discovery policies, publishes the sanctioned-agent catalog, configures the amnesty workflow, and trains the customer's service desk on the migration playbook. Phase 3 Enterprise Scale adds quarterly drift detection, Defender for Cloud Apps SaaS-agent discovery, and Sentinel correlation rules for cross-surface agent activity.
BYOAI (bring-your-own-AI) governance is the formal policy framework for handling employee-introduced AI tools. EPC Group recommends three policy planks: (1) a published BYOAI policy in the employee handbook that explicitly enumerates sanctioned vs. unsanctioned agents and lists the data-classification tiers each can touch; (2) the technical enforcement via Microsoft Defender + Intune + Agent 365 to actually implement the policy; (3) ongoing training in the Champion Network model so end-users have a clear path from "I want to use AI" to "I have a sanctioned tool that does what I need." All three planks together. None of them alone.
Fixed-fee Agent 365 Readiness Assessment. Includes Defender + Intune shadow-agent discovery + sanctioned-catalog design. Senior architects (not sales) take discovery calls.
AI assistant — not human