मुख्य सामग्री पर जाएं

DEV-151 - Detect & Block Shadow AI / Local AI Agents

Implementation Effort: Low – Uses built-in Intune Properties Catalog collection, the Local AI Agent Security Baseline, Compliance Policies, and Defender for Endpoint AI Agent Runtime Protection.

User Impact: Medium – Prevents unsanctioned local AI agents (such as OpenClaw) from executing or marks the device noncompliant until removed; users should be directed to sanctioned enterprise AI tools.

Overview​

Unsanctioned local AI agents (such as OpenClaw) running directly on endpoints can read local files, execute shell commands, invoke browser sessions, and exfiltrate sensitive organizational data outside cloud governance perimeters. Microsoft Intune and Microsoft Defender for Endpoint provide a multi-layered Zero Trust defense for local AI agents on Windows devices:

  1. Discover via Properties Catalog & Multi-Device Query (2605): Collect the Local AI Agent entity using an Intune Properties Catalog policy and query fleet-wide presence using KQL Device Query.
  2. Prevent Execution via Security Baseline (2605): Deploy the Local AI Agent Baseline – OpenClaw (Preview) (or toggle blocking from the M365 Admin Center Shadow AI page, which auto-creates the A365 - Block OpenClaw Intune policy) to block execution paths on managed Windows endpoints.
  3. Runtime Protection via Microsoft Defender for Endpoint (2609): Configure MDE AI agent runtime protection settings in the Windows Endpoint Security template in Audit mode (detect and alert on unsafe AI agent activity) or Block mode (stop unsafe AI agent actions before execution).
  4. Enforce Access via Compliance Policy & Conditional Access (In Development): Configure prohibited local AI agents in a Windows Compliance Policy so devices with unsanctioned agents are automatically marked noncompliant and blocked from corporate resources by Microsoft Entra Conditional Access until the agent is removed.

Key Configuration Steps​

  1. Create an Intune Properties Catalog policy (Devices > Configuration) to collect the Local AI Agent inventory entity and audit devices via Device Query.
  2. Deploy the Local AI Agent Baseline - OpenClaw (or enable blocking in the M365 Admin Center Shadow AI page) to block unsanctioned agent execution.
  3. Configure MDE AI agent runtime protection (Endpoint security > Antivirus / Defender for Endpoint) in Audit or Block mode.
  4. Add prohibited AI agent rules to your Windows Compliance Policy to enforce Conditional Access blocks on noncompliant endpoints.

Reference​