AI in Client Environments

Security field guide · v1.1 · 2026

Setup and permission walkthroughs for the four AI stacks clients actually deploy, and how to make each of them safe.

What this is

This was written as internal training material for MSP technicians rolling AI tools into client tenants — the reference a tech opens when a client says "we want to use AI" and someone has to decide what that actually means.

It is published here as written, in its working voice. The audience is people who will be clicking through admin consoles, not executives evaluating a strategy. That framing is deliberate: the value is in the specific click paths, the tier differences that matter, and the failure patterns that show up repeatedly in real tenants.

The problem it addresses

Most organizations treat AI like any other SaaS purchase. Buy the licenses, hand them to employees, done. For most software that model works fine.

It does not work for AI, because these tools inherit permissions rather than defining their own. Copilot inherits SharePoint and mailbox access. Gemini inherits Drive. ChatGPT and Claude inherit whatever OAuth scope the authorizing user grants through a connector.

The consequence is that a Copilot license attached to an untuned SharePoint tenant becomes a natural-language search engine over a decade of accumulated oversharing. Access a user technically had — and had forgotten about — becomes access they can now simply ask for in plain English.

Enabling the product is not the setup. The setup is deciding what the AI is allowed to see and do.

What it covers

Four stacks, each with the same structure so a technician can jump between them without re-orienting:

Each section covers what the product is and which tier differences actually matter — SSO, SCIM, audit, retention, BAA and HIPAA, data residency — followed by the click path through the admin console and, critically, what the AI can reach once enabled and how to restrict it.

Two of the nine pages are dedicated entirely to tenant pre-flight work: SharePoint permissions before Copilot, and Drive permissions before Gemini. That is the part clients skip, and it is the part that produces the incidents.

The controls that do the work

The guide is opinionated about which settings matter. On the Microsoft side that means SharePoint Advanced Management's Prepare-for-Copilot assessment, the Data Access Governance reports for "Everyone except external users" grants and anonymous sharing links, Restricted Content Discovery on sensitive sites, Purview sensitivity labels, and DSPM for AI as the post-deployment monitoring surface.

On the Google side, Workspace Intelligence per-source toggles are the primary blast-radius control, backed by DLP rules that apply Information Rights Management restrictions — Gemini cannot reach a file the user cannot download, print, or copy.

For the standalone tools, the control surface is the connector: read the OAuth scope before authorizing, do the tenant pre-flight first, and disable unused connectors at the workspace level before a user quietly authorizes one.

Two failure modes

Everything in the guide works toward preventing one of two outcomes.

Data leaving. To the vendor through training or retention on the wrong tier. To an attacker through a compromised agent. To coworkers through AI surfacing files that were technically shared but never meant to be found.

Output trusted when it should not be. Hallucinations acted on. Prompt injections executed. Agent actions taken that no human approved. Auto-approval on a command-execution agent is the single most dangerous configuration change available.

Field guidance

The final section is the practical half: red flags to look for at a client site, a triage table mapping what you see to what to do, and five questions to ask when a client says they want to use AI — because they usually do not know what they mean, and about half the time they have already been pasting company data into a free consumer tier for months.

Sources verified August 2026 against Microsoft Learn and Message Center, SharePoint Advanced Management and Purview documentation, Google Workspace Admin help and Updates blog, OpenAI Help Center, and Anthropic Support.