AI Exposure Audit
Can you tell me what your staff are putting into AI? Almost nobody can — not because they are careless, but because nothing in many businesses was ever switched on to measure it. This answers the question properly: which AI tools are in use, by whom, with what data, and where that leaves you. Delivered by an AZ-305 and AZ-104 certified architect and Microsoft Certified Trainer with thirty years in enterprise infrastructure, remotely worldwide or in person across the Western Cape.
Choose your country to see the rate card that applies to you.
What You Can See Depends On What You Pay Microsoft
It is easy to assume the AI-monitoring tooling is already sitting in your Microsoft 365 tenant. For some businesses it is not, and you deserve to know which row you are in before you spend anything. What you can see depends on your licence and on what else you switch on and pay for. Microsoft’s documentation says that watching third-party AI tools such as ChatGPT, Gemini and DeepSeek mostly needs devices onboarded to Microsoft Purview and a browser extension, and, for AI apps other than Microsoft’s own Copilot, pay-as-you-go billing tied to an Azure subscription. Sources, checked 2 October 2026: Microsoft Learn’s E3 / E5 / E7 licence comparison, the prerequisites for Data Security Posture Management for AI, the Purview billing models, the Purview service description and Microsoft’s Purview Suite for Business Premium page. Licensing changes, so check with Microsoft or your reseller before you decide anything.
Fuller visibility
The most Microsoft lists for AI activity.
- Which AI apps are in use, and by whom
- The prompts and responses themselves
- Third-party tools such as ChatGPT, Gemini and DeepSeek can be watched too, with the extra set-up and billing described above
Partial visibility
Useful, and genuinely better than nothing — but not the whole picture.
- Which AI apps are being used
- Activity export and auditing
- Seeing the content of what was typed is not on Microsoft’s list
- Interviews fill the gap the licence leaves
Not included on these plans alone
Microsoft’s Purview licensing lists Insider Risk Management and Endpoint Data Loss Prevention, which its AI-site monitoring policies rely on, for E5 and the Purview Suite, not for the Business plans. Ask your Microsoft reseller to confirm what applies to you, in writing.
- Business Premium plus the Purview Suite add-on (up to 300 users) adds them; Microsoft says it shows which AI apps staff use and can warn or block a paste. Onboarded devices and the browser extension are still needed
- Copilot activity is recorded in the standard audit log when Copilot is licensed and in use
- Without the add-on: interview, device and browser inventory, with the same four deliverables
- “Here is what you can see today, and what you cannot” becomes finding number one
- An honest answer on whether a licence change is worth it — sometimes it is not
Exposure Scan
About a day of my time across a one-week window. Discovery and a one-page memo, no policy and no briefing. The fastest way to find out whether you have a problem worth spending real money on.
Tell us your Microsoft 365 licence tier and what prompted the question, then book your free call — we’ll agree the details and payment together.
- Discovery of what AI is actually in use, by whom, with what data
- Run on Microsoft Purview where your licence allows it, by interview where it does not
- A one-page exposure memo written for a director, not an engineer
- The three things that would hurt most if they walked
- A straight recommendation on whether the full audit is worth it for you
- No agent to install and no credentials to hand over
Credited against the full audit. The full R8,500 is credited against an Exposure Audit booked within 60 days, exactly as the Estate Health Check credits against a Deep Dive. If a week shows the problem is bigger than a week, you don’t pay twice to find that out.
Payment. Arranged after our free call — instant by card or Instant EFT (PayFast, South Africa), or invoiced on booking with card via Payoneer internationally. 50% on written confirmation, balance within seven days of the final report.
What Is Already Happening, And How To Contain It
How this differs from our Modern Work & Copilot Deep Dive: that assessment answers “are we ready to roll Copilot out?”. This one answers “what is already happening that nobody approved?”. If you are planning a deployment, start there. If you do not know what your staff are already using, start here. The calendar window runs longer than the working days because Microsoft’s tooling needs at least 24 hours to collect after policies are switched on, the oversharing assessment runs weekly, and interviews fit around your people.
Exposure Audit
The full engagement, and the four things you walk away with whatever your licence tier allows.
- An exposure memo — one page, what is in use, by whom, with what data
- An AI acceptable-use policy — naming the actual tools, the specific data that matters, and the person to ask
- A prioritised remediation list — what to fix, in what order, at what cost
- A leadership briefing — 45 minutes, plain language, English or Afrikaans
- Oversharing assessment where your licence allows it
Contain & Enable
Scoped and quoted individually — no two estates need the same work, and I would rather price it after seeing yours than guess now.
- Everything in the Exposure Audit
- The controls actually implemented, not just recommended
- Staff trained on the new policy
- A re-measure thirty days later to show it held
Three Situations Where This Earns Its Money
You bought the licences and nobody uses them
Copilot shows each person whatever they already have permission to open, so a rollout can stall when it starts surfacing documents people forgot they had shared. Microsoft’s own deployment guidance makes fixing oversharing the first step. That is an oversharing problem, not an AI problem, and it is fixable.
An insurer, an auditor or a board has asked
Renewal questionnaires and audit packs are starting to ask about AI use. If nobody can answer, the audit produces the document that does.
You hold other people’s information
Accounting practices, law firms, medical and financial services. Your staff are not reckless; they are busy, and the tool is in the next tab. That is how it can happen.
Also available white-label to MSPs and IT providers — see MSP White-Label.