{"id":93909,"date":"2026-09-01T13:33:20","date_gmt":"2026-09-01T11:33:20","guid":{"rendered":"https:\/\/www.skaylink.com\/?p=93909"},"modified":"2026-09-01T13:33:20","modified_gmt":"2026-09-01T11:33:20","slug":"entra-internet-access","status":"publish","type":"post","link":"https:\/\/www.skaylink.com\/en\/insights\/blog\/entra-internet-access\/","title":{"rendered":"Microsoft Entra Internet Access: More transparency and control for AI applications"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Home<\/a><\/span><\/span><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Blog<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Microsoft Entra Internet Access: More transparency and control for AI applications<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tDetecting, controlling, and securing: How Microsoft Entra Internet Access protects you from shadow AI, prompt injection, and data leaks.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tSeptember 1, 2026\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\"Picture\n\t\t\t\t<\/div>\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\n\t\t\t\t\t\t\tFlorian Schnepf\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\"Picture\n\t\t\t\t<\/div>\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\n\t\t\t\t\t\t\tFlorian Aschbichler\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The introduction of generative AI tools has revolutionized the world of work \u2013 and at the same time created a new category of security risks. Employees use dozens of AI services, such as ChatGPT, Claude, Gemini, or specialized AI assistants, on a daily basis, often without the IT department\u2019s knowledge or approval. This phenomenon has a name: Shadow AI<\/strong>.<\/p>\n

Similar to shadow IT, which is the uncontrolled use of unauthorized software and cloud services, shadow AI refers to the use of AI tools outside a company\u2019s IT governance framework. The difference is: The risk is potentially much more serious. While an unauthorized file-sharing tool mainly poses a risk of data loss, AI services can transfer sensitive business information, customer data, or intellectual property directly to external models \u2013 without the IT department having the slightest clue.<\/p>\n

According to Microsoft, only 9% of organizations<\/strong> feel sufficiently prepared to address risks such as shadow AI, prompt injection attacks, and fragmented security controls. This is an alarming number, and is also a clear signal that action is needed here.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What is shadow AI \u2013 and why is it so dangerous?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Shadow AI arises when employees want (and are supposed to) use AI tools, but no officially approved alternatives are available \u2013 or when the onboarding process for new tools is simply too slow. The result: Developers paste internally classified code into ChatGPT, sales representatives upload customer data to an AI assistant, HR teams use public models to analyze job applications.<\/p>\n

The risks are multiple:<\/p>\n

    \n
  • Data leaks<\/strong>: Sensitive or confidential information is shared with external AI providers without proper oversight.<\/li>\n
  • Compliance violations<\/strong>: GDPR, HIPAA, NIS2, and other regulations may be violated if personal data is processed without authorization.<\/li>\n
  • Prompt injection<\/strong>: Attackers can use manipulated inputs to trick AI models into performing unintended actions or revealing sensitive information.<\/li>\n
  • Inability to audit<\/strong>: Without insight into AI usage, it is virtually impossible to analyze security incidents after the fact.<\/li>\n
  • Uncontrolled leaks<\/strong>: No one knows what the AI sends back to third parties or writes to external systems.<\/li>\n<\/ul>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Microsoft Entra Internet Access: An answer to shadow AI<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    With Microsoft Entra Internet Access<\/strong>, a part of Global Secure Access, Microsoft has developed a direct solution to these challenges. Internet Access is a cloud-based, identity-driven Secure Web Gateway (SWG)<\/strong> that secures an organization\u2019s entire outbound Internet traffic. It is not a traditional proxy tool, but rather a security layer fully integrated into the Microsoft Entra identity platform that combines network, identity, and endpoint control.<\/p>\n

    Internet Access offers the following key features for shadow AI:<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t

    1. Shadow AI Discovery: Visibility as the first step<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The first step for controlling shadow AI is visibility. Shadow AI Discovery<\/strong> analyzes users\u2019 network traffic and identifies all connections to generative AI applications and services, including ChatGPT, Claude, Gemini, DeepSeek, SaaS MCP servers, and AI model provider frameworks.<\/p>\n

    Detected applications are automatically synced with the Microsoft Defender for Cloud Apps Cloud App Catalog<\/strong>. This catalog categorizes apps and assigns risk scores based on general security and compliance criteria. Administrators can see it all at a glance:<\/p>\n

      \n
    • Which AI apps are being used in the organization?<\/li>\n
    • How many users are using a specific app?<\/li>\n
    • What risk profile does the respective app have?<\/li>\n
    • How high is the transferred data volume for each app?<\/li>\n<\/ul>\n

      This feature can be accessed via the Entra Admin Center<\/strong> under Global Secure Access \u2192 Applications \u2192 Insights & Analytics \u2192 Cloud Applications<\/em>. The \u201cGenerative AI apps and tools\u201d filter allows you to specifically filter and analyze all AI-related services.<\/p>\n

      Shadow AI Discovery not only helps security teams uncover unknown risks, but also provides the data-driven foundation for informed decisions: Which apps are blocked? Which are included in the official approval process?<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t

      2. Conditional access for AI applications<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Visibility alone is not enough. Internet Access allows conditional access policies<\/strong> to be applied directly to detected AI applications. This means that security teams can respond based on the specific situation.<\/p>\n

        \n
      • Low-risk apps that are eligible for approval are passed on to the regular approval process.<\/li>\n
      • High-risk or non-compliant apps are blocked immediately<\/strong>.<\/li>\n
      • Specific exceptions can be defined for certain user groups (e.g., developers).<\/li>\n<\/ul>\n

        This granular level of control allows companies to enable the use of AI without losing control. This is a key advantage over the blanket blocking approach used by many legacy solutions.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t

        3. Blocking unsanctioned MCP servers<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        With the advent of the Model Context Protocol (MCP)<\/strong> as a standard for integrating AI models into enterprise workflows, a new level of risk is emerging: SaaS-based MCP servers. Internet Access allows you to specifically block access to unauthorized MCP servers<\/strong> via URL policies before they can even establish a connection to internal resources.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t

        4. TLS inspections: A look inside the encrypted tunnel<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        Generative AI services communicate exclusively via encrypted HTTPS. Without TLS inspection, the actual content of this communication \u2013 namely the employees\u2019 prompts and the models\u2019 responses \u2013 remains invisible to security tools. Internet Access offers TLS inspection<\/strong>, which decrypts, inspects, and then re-encrypts HTTPS traffic.<\/p>\n

        This allows content filtering policies, DLP rules, and prompt policies to be applied to the actual content of AI communications \u2013 not just to metadata. To use this feature, a root CA certificate must be distributed to managed devices (e.g., via Microsoft Intune).<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t

        5. Prompt Shield: Protection from AI manipulation<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        Prompt Shield<\/strong> is one of the most innovative features of Entra Internet Access. It operates at the network level and inspects prompts in real time before they reach the AI model. Specifically, Prompt Shield detects and blocks:<\/p>\n

          \n
        • Jailbreak attempts<\/strong>: Attempts to manipulate AI models to circumvent their security policies.<\/li>\n
        • Data leaks due to prompt injection<\/strong>: Attacks in which hidden instructions are used to extract sensitive information from the AI context.<\/li>\n
        • Manipulation of the AI\u2019s behavior<\/strong>: Attempts to trick the AI into performing unwanted actions.<\/li>\n<\/ul>\n

          Prompt Shield integrates with Azure AI Content Safety<\/strong> to classify and filter unsafe content, and can be applied to user groups at a granular level through security profiles and conditional access policies. OWASP lists prompt injection as LLM01:2025<\/strong> \u2013 in other words, the most critical risk for LLM-based applications.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t
          \n\t\t\t\t\t

          6. Web content filtering and threat intelligence<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          In addition to AI-specific protection, Internet Access offers comprehensive filtering of web content by category (e.g., social media, gambling, malware pages) as well as threat intelligence filtering<\/strong>, which blocks traffic to known malware domains, phishing sites, and command-and-control infrastructures \u2013 for all users, regardless of their location.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t
          \n\t\t\t\t\t

          The architecture: How Internet Access controls shadow AI<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          User (GSA client)<\/p>\n

          \u00a0\u00a0\u00a0 \u2502<\/p>\n

          \u00a0\u00a0\u00a0 \u25bc<\/p>\n

          Global Secure Access Edge<\/p>\n

          \u00a0\u00a0\u00a0 \u2502<\/p>\n

          \u00a0\u00a0\u00a0 \u251c\u2500\u2500 TLS inspection (decrypting\/inspecting\/encrypting)<\/p>\n

          \u00a0\u00a0\u00a0 \u2502<\/p>\n

          \u00a0\u00a0\u00a0 \u251c\u2500\u2500 Shadow AI Discovery (detection & risk scoring)<\/p>\n

          \u00a0\u00a0\u00a0 \u2502<\/p>\n

          \u00a0\u00a0\u00a0 \u251c\u2500\u2500 Prompt Shield (real-time prompt inspection)<\/p>\n

          \u00a0\u00a0\u00a0 \u2502<\/p>\n

          \u00a0\u00a0\u00a0 \u251c\u2500\u2500 Web content filtering \/ threat intelligence<\/p>\n

          \u00a0\u00a0\u00a0 \u2502<\/p>\n

          \u00a0\u00a0\u00a0 \u2514\u2500\u2500 Conditional access policy enforcement<\/p>\n

          \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2502<\/p>\n

          \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u251c\u2500\u2500 Approved: Access allowed<\/p>\n

          \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2514\u2500\u2500 Blocked: Access denied + log entry<\/p>\n

          All checks are performed at the network level<\/strong> and are therefore independent of the browser used or the device\u2019s status. The GSA client on the end device (Windows, macOS, iOS, Android) ensures that data traffic is routed through GSA Edge.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t
          \n\t\t\t\t\t

          Summary: AI security starts in your own network<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          Shadow AI is not a theoretical threat \u2013 it is a reality in nearly every company. The solution does not lie in a blanket ban on AI \u2013 which would fail in practice anyway \u2013 but rather in controlled visibility and sophisticated management<\/strong>.<\/p>\n

          Microsoft Entra Internet Access, as part of Global Secure Access, offers exactly this: an identity-driven, network-based layer of protection that doesn\u2019t prevent the use of AI, but makes it secure. From detecting unauthorized tools to granular access controls and real-time protection against prompt injection, Internet Access is the central component of a modern AI security strategy.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t
          \n\t\t\t\t\t

          Licensing (overview, as of May\u00a02026)<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t
          • Microsoft Entra ID P1\/P2<\/strong>: Prerequisite: enables basic GSA functions (M365 profile, Compliant Network Check)<\/li>
          • Standalone Internet Access<\/strong>: approx. $5 per user per month (in addition to P1\/P2)<\/li>
          • Entra Suite<\/strong>: approx. $12 per user per month \u2013 includes Private Access, Internet Access, Entra ID Governance, ID Protection (P2), and Verified ID Premium<\/li>
          • Microsoft\u00a0365\u00a0E7<\/strong> (GA as of May\u00a02026): first M365\u00a0SKU to include the full Entra Suite<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

            Detecting, controlling, and securing: How Microsoft Entra Internet Access protects you from shadow AI, prompt injection, and data leaks.<\/p>\n","protected":false},"author":23,"featured_media":92889,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[100],"tags":[206,174],"class_list":["post-93909","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-ai","tag-microsoft"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/93909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/comments?post=93909"}],"version-history":[{"count":6,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/93909\/revisions"}],"predecessor-version":[{"id":94191,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/93909\/revisions\/94191"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/media\/92889"}],"wp:attachment":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/media?parent=93909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/categories?post=93909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/tags?post=93909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}