Hands-On Lab Workshop: Managing Shadow AI with Microsoft Security
Event Overview
Shadow AI is putting sensitive company data at risk, often without anyone realizing it until it's too late. In this hands-on workshop, you'll step into the role of a security investigator working a real insider threat scenario. Using Microsoft's integrated security suite, you'll uncover unsanctioned generative AI tools running under the radar, trace unauthorized data uploads back to specific users and IP addresses, and follow the evidence trail across three connected Microsoft platforms. You'll trigger and interpret data loss prevention alerts in Microsoft Purview, examine sensitive information matches, and ultimately pinpoint the exact device tied to the user at the center of the investigation using Microsoft Intune. This is a practical, investigation-style look at how Defender for Cloud Apps, Purview, and Intune work together to close the visibility gap that shadow AI creates.
Featured Speakers
What to expect
- A scenario-driven investigation, not a slide walkthrough — you'll work through a real insider threat case step by step.
- Hands-on time in Microsoft Defender for Cloud Apps to surface unsanctioned generative AI usage.
- A walkthrough of triggering and interpreting Microsoft Purview DLP alerts and incident reports.
- Practice connecting user activity to device identity using Microsoft Intune.
- Live Q&A with the lab's presenter and panelists.
- Access to a dedicated lab environment you can revisit after the session.
Goals and Objectives
• Identify and investigate shadow IT activity using Microsoft Defender for Cloud Apps • Validate data loss prevention controls and interpret alerts using Microsoft Purview • Understand policy scope, user-level exceptions, and override workflows across an organization • Connect device identity to user activity using Microsoft Intune
Who should attend?
• Security analysts and SOC team members • IT and security administrators evaluating Microsoft's security suite • Compliance and data governance professionals • Anyone responsible for AI usage policy or oversight within their organization
Related content
Managing Shadow AI with Microsoft Security
Microsoft CTF: Blind Spot