AI Tools in the Workplace: What Businesses Should Consider Before Giving Them Access to Company Data

Artificial intelligence tools are rapidly becoming part of everyday business.

Employees are using AI to draft emails, summarise documents, analyse information, prepare reports and automate repetitive tasks.

Used appropriately, these tools can provide significant productivity benefits.

But there’s an important question businesses should ask before connecting an AI application to Microsoft 365:

What information are we giving it access to?

Clicking Allow on a permissions screen can potentially provide an application with access to much more company information than an employee realises.

That doesn’t mean businesses should avoid AI.

It means AI adoption should be managed in the same way as any other technology that handles company information.

Not all AI tools are the same

The term “AI” covers an enormous range of products.

Some AI tools operate as standalone websites where an employee manually enters information.

Others install applications on computers.

Some integrate directly with Microsoft 365.

Others connect to SharePoint, OneDrive, email, calendars, CRM platforms or other business systems.

These are very different risk scenarios.

The important question isn’t simply:

“Do we allow AI?”

A better question is:

“What does this particular application do, and what information does it need access to?”

Pay attention to Microsoft 365 permissions

When an application integrates with Microsoft 365, it may request permissions to access company information.

Depending on the application and permissions requested, this could potentially include access to things such as:

• User profiles
• Email
• Calendars
• OneDrive files
• SharePoint data
• Teams information
• Company directory information

Some applications only require limited access.

Others may request considerably broader permissions.

Before approving an application, businesses should understand what is being requested and why.

“Sign in with Microsoft” doesn’t mean Microsoft made the application

This is an important distinction.

Many third-party applications allow users to sign in using their Microsoft account.

That can be convenient and may provide secure authentication.

However, seeing a Microsoft login screen doesn’t necessarily mean the application itself is a Microsoft product or has been approved by Microsoft for your organisation.

The login process identifies the user.

The permissions requested afterwards determine what the application may be able to access.

Employees should therefore avoid treating every Sign in with Microsoft button as automatic approval to connect a service to company information.

The principle of least privilege applies to AI too

A useful cybersecurity principle is least privilege.

Users and applications should only receive the access they actually require.

For example, if an AI application only needs access to a specific set of documents, does it really need access to every SharePoint site in the organisation?

If it only needs to help draft text, does it need access to company email?

If the requested permissions seem much broader than the function being provided, that’s worth investigating.

Giving applications unnecessary access increases the potential impact if something goes wrong.

Where does your information go?

Before providing sensitive business information to an AI service, organisations should understand how that information is handled.

Useful questions include:

Is the information retained?

Where is it stored?

How long is it retained?

Is it used to improve or train models?

Can administrators control retention?

Can the information be deleted?

Where is the service hosted?

What happens when an employee leaves the business?

The answers will vary significantly between providers and between consumer and business versions of the same service.

Free and consumer AI accounts deserve particular attention

Employees may discover useful AI tools independently and create accounts using their company email address.

This can create what is sometimes called shadow IT — technology being used for business purposes without the organisation necessarily knowing about or managing it.

The problem isn’t that every free AI tool is unsafe.

The problem is that the business may have no visibility into what company information is being entered, where that information is going or whether access can be removed later.

For sensitive business information, organisations should consider whether an approved business-grade service is more appropriate.

Be especially careful with sensitive information

Not all business information carries the same risk.

Asking an AI tool to improve the wording of a generic marketing paragraph is very different from uploading confidential client documents.

Businesses should think carefully before providing AI systems with information such as:

• Customer records
• Legal documents
• Financial information
• Employee information
• Passwords or credentials
• Confidential correspondence
• Contracts
• Personally identifiable information
• Proprietary business information

Some industries may also have contractual, regulatory or professional obligations governing how information can be handled.

AI applications can create another path into company data

Cybersecurity traditionally focuses on users, computers and networks.

Cloud applications have added another consideration: application access.

Even if an employee has strong MFA and a properly secured computer, a third-party application that has been granted access to their Microsoft 365 information creates another relationship that needs to be considered.

That doesn’t automatically make the application dangerous.

But it does mean application permissions should form part of the organisation’s security management.

Administrator access requires even greater caution

Requests for administrator permissions should receive particular scrutiny.

Administrative accounts can potentially access or change significant parts of an organisation’s Microsoft 365 environment.

Providing an application with broad administrative permissions can therefore carry considerably more risk than allowing an ordinary user to sign in.

Before granting administrator access, businesses should understand exactly what permissions are being requested and whether they are genuinely required.

Convenience shouldn’t be the deciding factor.

Create an AI policy before you need one

Businesses don’t necessarily need a 40-page AI policy.

For many small organisations, a few clear rules can make a significant difference.

For example:

• Which AI services are approved?
• Can employees use company information with AI tools?
• What information must never be uploaded?
• Who can approve new AI applications?
• Who can approve Microsoft 365 integrations?
• Are free consumer AI accounts permitted?
• What happens when an employee leaves?
• Who reviews application permissions?

The goal shouldn’t be to prevent employees from benefiting from AI.

It’s to establish reasonable boundaries.

AI security shouldn’t become AI prohibition

There is a danger of approaching AI entirely from a security perspective.

Businesses that prohibit every AI tool may miss genuine productivity opportunities — and employees may simply start using unapproved services instead.

A better approach is to evaluate the business requirement and then find an appropriate way to meet it.

Ask:

What is the employee trying to achieve?

There may be an approved AI platform that provides the required capability while giving the organisation better control over its information.

Security works best when it enables the business rather than simply saying no.

Review connected applications regularly

Application access shouldn’t be treated as permanent.

Over time, employees leave, projects finish and applications stop being used.

Businesses should periodically review which applications have access to their environment and remove permissions that are no longer required.

This principle applies to AI applications as well as traditional cloud software.

AI should become part of your broader cybersecurity strategy

AI isn’t a completely separate security problem.

It fits into many of the same principles businesses should already be applying:

• Multi-Factor Authentication
• Least privilege
• Device management
• Data protection
• User awareness
• Application control
• Administrator security
• Monitoring
• Backup and recovery

As AI becomes more deeply integrated into business applications, these controls will become even more important.

Helping businesses adopt AI safely

At itX365, we believe businesses should be able to benefit from new technology without unnecessarily exposing company information.

When an application requests access to Microsoft 365, the question shouldn’t simply be whether the software is useful.

We also need to understand what it can access, what permissions it requires and how that fits into the organisation’s overall security environment.

For businesses using Microsoft 365, this can form part of a broader managed IT and cybersecurity strategy.

Before you click “Allow”

The next time an AI application asks for access to your company’s Microsoft 365 environment, take a moment to look at what it’s requesting.

If you’re unsure what those permissions mean, ask before approving them.

A five-minute security review is considerably easier than investigating a data-security problem afterwards.

Talk to itX365 if you’d like help reviewing Microsoft 365 application permissions or developing practical guidelines for the use of AI within your business.

Most businesses have a router.

It connects the office to the internet, provides Wi-Fi and usually includes some basic firewall functionality.

So it’s reasonable for a business owner to ask:

Why would we need anything else?

The answer comes down to the difference between simply connecting a business to the internet and actively managing the security of that connection.

For a very small business with simple requirements, a basic router may be perfectly adequate.

But as a business becomes more dependent on cloud applications, Microsoft 365, remote access and connected devices, the network becomes an increasingly important part of its cybersecurity.

That’s where a managed firewall can provide additional protection and visibility.

What does a firewall actually do?

At its simplest, a firewall controls network traffic between your business and other networks, including the internet.

It decides which connections should be allowed and which should be blocked based on configured rules.

Basic firewall functionality has been built into routers for many years.

Modern business firewalls, however, can provide significantly more security capabilities.

Depending on the solution, this may include:

• Intrusion detection and prevention
• Malicious website blocking
• DNS filtering
• Application control
• Geographic filtering
• Threat intelligence
• VPN connectivity
• Network segmentation
• Security logging
• Monitoring and alerts

The important distinction isn’t simply whether a business has a firewall.

It’s what that firewall is capable of doing and whether somebody is actually managing it.

What makes a firewall “managed”?

Installing a firewall and never looking at it again doesn’t make it managed.

A managed firewall is actively maintained as part of the business’s IT environment.

This can involve keeping its software and security services updated, reviewing alerts, maintaining security policies, monitoring its health and changing its configuration as the business evolves.

For example, if a firewall goes offline at 2:00 AM, does anybody know?

If a security service stops updating, is somebody alerted?

If an employee needs remote access, is it configured securely?

If suspicious network activity is detected, who investigates it?

Those operational questions are often more important than the brand printed on the device.

Your network is part of your cybersecurity

Cybersecurity discussions often focus heavily on computers and email.

Those are important, but they’re only part of the environment.

Your network connects computers, printers, phones, wireless access points, servers, security cameras and an increasing number of other devices.

Some of those devices may have very different security capabilities.

A properly designed network can help control how these devices communicate and reduce unnecessary access between different parts of the environment.

What is network segmentation?

Imagine an office containing employee computers, printers, security cameras and guest Wi-Fi.

Do all of those devices really need to communicate freely with each other?

Usually not.

Network segmentation allows different types of devices or users to be separated into logical networks.

For example, guest Wi-Fi can be isolated from the internal business network.

Security cameras or other connected devices can potentially be placed on a separate network from employee computers.

This doesn’t eliminate security risk, but it can reduce unnecessary exposure.

DNS filtering can stop connections before they happen

Every time you visit a website, your computer normally uses DNS to determine where that website is located.

Security-focused DNS services can use this process to block access to known malicious or inappropriate destinations.

For example, if an employee clicks a link to a known malicious website, DNS filtering may prevent the computer from reaching it.

This provides another security layer alongside endpoint protection, email security and browser protections.

It isn’t a replacement for those systems.

It’s an additional layer.

What about geographic blocking?

Many small businesses operate almost entirely within Australia.

That raises an interesting question:

Should every service on the business network be accessible from everywhere in the world?

In some environments, geographic filtering can be used to reduce unnecessary exposure by restricting certain traffic based on its country of origin or destination.

However, geographic blocking shouldn’t be treated as a magic cybersecurity solution.

Attackers can use infrastructure located in many different countries, including Australia.

It’s another tool that can reduce exposure when used appropriately.

Can a firewall stop phishing emails?

Generally, that’s not its primary job.

This is an important example of why cybersecurity needs multiple layers.

A firewall protects the network.

Email security helps identify malicious email.

Endpoint protection helps protect computers.

MFA helps protect user accounts.

Backups provide recovery options when preventative controls fail.

Each layer addresses different risks.

No single security product — including an expensive firewall — solves everything.

What happens when employees work from home?

This is another reason cybersecurity can no longer depend entirely on the office firewall.

A laptop might spend half its time connected to the office network and the other half connected to an employee’s home Wi-Fi, a hotel or another external network.

Security therefore needs to follow the device and user.

Technologies such as endpoint protection, Microsoft 365 identity security, MFA and device management remain important regardless of where the employee is working.

The firewall is one component of the overall security strategy.

Does every small business need an expensive enterprise firewall?

No.

Security should be proportionate to the business.

A two-person business doesn’t necessarily need the same network infrastructure as a 100-person organisation.

Technology has also changed considerably.

Modern security services make it possible to provide useful network protection to very small businesses without installing large and expensive enterprise appliances.

The right solution should be based on the organisation’s size, network, information, risk and operational requirements.

Why monitoring matters

One of the biggest differences between consumer networking equipment and a managed business environment is visibility.

When something fails or behaves unexpectedly, somebody needs to know.

Monitoring can help an IT provider identify problems such as an offline firewall, failed internet connection or unavailable network device.

That can sometimes allow an issue to be investigated before employees even realise something has gone wrong.

This is part of the broader shift from reactive IT support to proactive managed IT.

A firewall should be part of a layered security strategy

A managed firewall can be an important cybersecurity control, but it shouldn’t operate in isolation.

For many small businesses, a broader security approach might include:

• Multi-Factor Authentication
• Endpoint protection
• Microsoft 365 security
• Email protection
• Managed firewall
• DNS filtering
• Security updates
• Device management
• Backup and recovery
• Monitoring

If one security layer fails, another may still prevent or limit the incident.

That’s the principle behind layered security.

Managed network security with itX365

At itX365, we help Perth businesses implement practical network security based on their actual requirements.

That can include managed firewalls, secure DNS, network segmentation, Wi-Fi, VPN connectivity, internet failover and ongoing monitoring.

For very small businesses, we can also use appropriately sized security solutions rather than assuming every organisation needs expensive enterprise equipment.

The objective isn’t to make the network complicated.

It’s to provide appropriate protection, visibility and management without getting in the way of employees doing their jobs.

Not sure what’s protecting your business network?

If your firewall is simply the router that arrived with your internet service — and nobody is quite sure what it’s doing — it may be worth reviewing your network security.

Talk to itX365 about managed firewall and network security options for your Perth business.

Unfortunately, a password on its own is no longer enough to adequately protect important business information.

Employees use Microsoft 365, cloud accounting systems, online banking, CRM platforms and dozens of other online services. If an attacker obtains the password to one of these accounts, they may be able to access sensitive business information without ever touching the employee’s computer.

That’s why Multi-Factor Authentication (MFA) has become one of the most important basic cybersecurity controls for businesses.

What is Multi-Factor Authentication?

Multi-Factor Authentication adds another verification step when someone signs into an account.

Instead of relying only on something you know — your password — the system asks for another form of verification.

This might include:

• An authentication app on your phone
• A security key
• A biometric such as a fingerprint
• A passkey
• A temporary verification code

The important difference is that stealing the password alone may no longer be enough to access the account.

Why aren’t passwords enough anymore?

The problem isn’t necessarily that employees choose terrible passwords.

Even a strong password can be compromised.

Passwords can be exposed through phishing attacks, malware, compromised websites and other data breaches.

An employee might also be presented with a convincing fake Microsoft 365 login page and unknowingly provide their credentials directly to an attacker.

Without additional protection, those credentials could potentially be used to access the employee’s account.

MFA creates another obstacle.

What happens when a Microsoft 365 account is compromised?

A compromised Microsoft 365 account can be much more serious than somebody simply reading a few emails.

Depending on the user’s permissions and the organisation’s configuration, an attacker may gain access to email, OneDrive files, SharePoint information and other company resources.

Email accounts are particularly valuable because attackers can use them to impersonate employees.

For example, an attacker could monitor an email conversation involving an invoice and then attempt to substitute different banking details.

Because the message appears to come from a legitimate company account, these attacks can be extremely convincing.

MFA significantly improves account security

With MFA enabled, knowing the username and password may no longer be sufficient.

The attacker also needs to satisfy the additional authentication requirement.

This makes many common account-compromise attacks considerably more difficult.

However, it’s important to understand that not all MFA methods provide the same level of protection.

SMS vs authenticator apps

One of the earliest widely adopted MFA methods was sending a verification code via SMS.

SMS verification is generally better than protecting an account with only a password, but stronger authentication methods are now available.

Authenticator applications such as Microsoft Authenticator can provide a better authentication experience and support more modern security capabilities.

Instead of receiving a text message containing a code, the employee verifies the authentication request using an application registered to their account.

For businesses using Microsoft 365, moving away from reliance on SMS authentication is a sensible part of improving account security.

MFA isn’t completely phishing-proof

This is an important point.

Simply enabling MFA doesn’t mean an account can never be compromised.

Attackers have developed techniques designed to trick users into approving fraudulent authentication requests or providing authentication information through sophisticated phishing websites.

That’s why MFA should be considered one layer of security rather than the entire security strategy.

Modern identity security can go further by considering factors such as the user, device, location and risk associated with a login attempt.

Microsoft 365 Business Premium, for example, provides additional identity and device-management capabilities that can be used to build stronger access policies.

Related: Microsoft 365 Business Standard vs Business Premium: Which Does Your Business Need?

Be careful with unexpected authentication requests

One simple rule can prevent a lot of trouble:

If you aren’t trying to sign in, don’t approve an authentication request.

If an unexpected Microsoft Authenticator notification appears on your phone, somebody may be attempting to access your account.

Don’t simply approve the request to make the notification disappear.

If you’re unsure why you’re receiving authentication requests, contact your IT provider.

MFA should also protect administrator accounts

Administrator accounts deserve particular attention.

These accounts can potentially make significant changes to a company’s systems and security configuration.

An administrator account compromised by an attacker can therefore create considerably more risk than an ordinary user account.

Businesses should minimise unnecessary administrator access and ensure privileged accounts are appropriately protected.

The principle is straightforward:

Users should only have the access they actually need to perform their job.

What about shared accounts?

Businesses sometimes create a single username and password and give it to several employees.

This creates security and accountability problems.

Where possible, employees should have their own identities and permissions rather than sharing login credentials.

This makes it easier to control access when somebody joins or leaves the organisation and provides better visibility into who has access to company information.

MFA is only one layer of cybersecurity

MFA is extremely important, but businesses shouldn’t stop there.

A sensible cybersecurity strategy can include:

• Multi-Factor Authentication
• Endpoint protection
• Email security
• Managed firewalls
• DNS and web filtering
• Security updates
• Device management
• Access controls
• Backups
• Security monitoring

No individual security product can eliminate every risk.

The objective is to create multiple layers so that the failure of one control doesn’t automatically result in a serious security incident.

Who should have MFA enabled?

For most businesses, the answer is simple:

Everyone.

If an account provides access to business information, it should generally have appropriate authentication protection.

This is particularly important for Microsoft 365 because email, OneDrive, SharePoint and Teams can contain a significant amount of sensitive company information.

Don’t wait for an account compromise

Cybersecurity improvements are much easier to implement before an incident occurs.

If your business is still relying primarily on usernames and passwords, MFA is one of the most important security improvements you can make.

But enabling MFA is only the beginning.

Businesses should also consider how authentication, device security, Microsoft 365, backups and network security work together as part of their overall cybersecurity strategy.

Protecting Microsoft 365 with itX365

At itX365, we help Perth businesses manage and secure their Microsoft 365 environments as part of our managed IT services.

This includes helping businesses implement appropriate authentication, Microsoft 365 security, device protection and other cybersecurity controls based on their requirements.

Technology security doesn’t need to become complicated for employees.

The goal is to make the secure way of working the normal way of working.

Concerned about the security of your Microsoft 365 environment?

Talk to itX365 about reviewing your current Microsoft 365 security configuration.