How do I block or allow-list AI tools on company devices?

By Hugh Donatello, LAN Service Group · Published October 20, 2026 · Updated October 20, 2026

Start with a decision for each tool: block, allow or monitor

Blocking is a decision about a specific tool, not about AI in general. Before you touch a setting, list the AI tools your discovery found and give each one of three outcomes. Allow it if the company has a business agreement for it, it connects to company sign-in and an administrator can remove a departing user. Monitor it (warn the user, log the visit, let them continue) if it is unvetted but low risk, or if you are still evaluating it. Block it if it has no business terms, it trains on what users type by default, or it is used to move data you have classed as confidential.

Write each decision into an approved-tools register so the blocklist and the policy say the same thing. Our free AI acceptable-use policy template comes with an Excel approved-tools register you can use as that list. If you have not yet found out which AI tools are in use, read our guide to shadow AI first; blocking before discovery tends to push the same work onto personal phones, where you see nothing.

The list below turns those three outcomes into a rule of thumb. It is a starting point for your own risk decision, not a vendor or regulatory requirement, so adjust it to your own data classification.

• Company-licensed AI tool on business terms, connected to company sign-in: Allow. Add to the approved-tools register; tag Sanctioned in Defender for Cloud Apps if you use it; add to the browser allow list if you run an allow-only list.
• Unvetted AI tool someone has asked for, still under review: Monitor. Defender for Cloud Apps Monitored tag or a Defender for Endpoint warn indicator, with a link to the request process.
• Consumer AI service where staff could use a personal account instead of the company one: Monitor, then block if the approved tool covers the need. Warn first with a link to the approved tool; block once people have moved.
• AI tool with no business terms, or one that is a poor fit for your data rules: Block. Unsanctioned tag, block indicator, browser blocklist entry or DNS block.
• AI browser extension or third-party app asking for access to company mail, files or calendar: Block by default, allow case by case. Restrict user consent in Entra ID or Google Workspace and route requests to an admin; for browser extensions, also block or allow-list extensions in your managed browser policy.

Microsoft 365: Defender for Cloud Apps app tags

If you run Microsoft Defender for Cloud Apps, the app tags are the cleanest way to block or allow AI tools by name. Microsoft describes three governance states: Sanctioned marks an app as approved, Unsanctioned marks it as prohibited, and Monitored marks it as risky. Tagging an app Unsanctioned does not block it by itself. Blocking happens when the tenant also uses Microsoft Defender for Endpoint with the integration turned on: Microsoft says unsanctioned apps are then blocked automatically, because their domains are synced to Defender for Endpoint as custom network indicators.

The Monitored tag is the middle option. Microsoft says users who open a monitored app see a warning with a link you choose, such as your approved-tools page, and can bypass it and continue; you set how long a bypass lasts and can see how many users bypassed. That makes Monitored a good fit for the "monitor" outcome in the decision list above.

Check three limits before you plan around it. First, licensing: Microsoft lists Defender for Cloud Apps plus Defender for Endpoint, or Microsoft 365 E5, as the license prerequisite for this integration. Second, timing: Microsoft says a block can take up to three hours to reach devices after you tag the app. Third, coverage: Defender for Endpoint must be onboarded with Microsoft Defender Antivirus real-time and cloud-delivered protection on and network protection in block mode, and Microsoft notes that customers on Microsoft Defender for Business do not see device groups for scoping. If you do not use Defender for Endpoint, Microsoft says you can export a block script or the domain list for a supported firewall or proxy instead.

Microsoft 365 without Defender for Cloud Apps: indicators, web content filtering and Edge policies

Defender for Endpoint has two web controls that help here. Web content filtering blocks whole categories of sites, and Microsoft lists Microsoft 365 Business Premium and Microsoft Defender for Business among the plans that include it. But the category list Microsoft publishes, checked October 19, 2026, has no category for generative AI, so AI tools have to be handled by name. Custom URL and domain indicators do that: they let you allow, warn on or block specific domains once the Custom network indicators feature is turned on, and Microsoft says that when indicators conflict, allow overrides warn and warn overrides block.

Indicators have browser caveats. For HTTPS sites, Microsoft says an indicator for a full URL path is enforced only in Microsoft Edge; other browsers can block only the whole domain, and only when QUIC and Encrypted Client Hello are turned off in that browser. Microsoft also says a new indicator can take up to 48 hours to apply, though most take effect in under two hours.

Intune can also push browser policy directly. Microsoft documents configuring Microsoft Edge policies on Windows through the Intune settings catalog. The Edge URLBlocklist policy blocks sites by URL pattern, URLAllowlist defines exceptions, and Microsoft says the two policies are limited to 1,000 entries. Microsoft also notes that URLBlocklist does not stop a page from updating through JavaScript, so a blocked path can sometimes still be reached from inside the site. A browser policy controls one browser only; if staff can install and use another browser, block that path too or rely on device-level indicators.

DNS filtering for any stack

DNS filtering works below the browser, so it covers every app on a device or network that uses your filtering resolver. Cloudflare Gateway is one example: Cloudflare says its DNS policies work across all protocols and applications, not only web browsers, and can block by content category or by application. Its domain category list includes an Artificial Intelligence subcategory under Technology, which lets you block a group of AI sites at once and then allow the approved one.

DNS filtering has clear gaps, and Cloudflare documents them. It says Gateway will not properly filter traffic sent through third-party VPNs or other filtering software, naming iCloud Private Relay and Chrome IP Protection as examples, and that some apps, such as WhatsApp, have backup DNS servers built in that bypass the policy unless you also block those resolvers with a Gateway network policy. It also cannot see what a user types into an allowed tool, and it blocks whole domains, so a vendor that serves an AI feature from the same domain as its main product is hard to separate. Use DNS filtering as a broad net, not as your only control.

Google Workspace and Chrome

If your company runs on Google Workspace, three Admin console settings do most of the work. First, Google lets admins block and allow URLs for managed Chrome browsers, ChromeOS devices and users signed in to a managed Chrome profile, up to 1,000 URLs. Google notes that Android apps using Android System WebView do not enforce the blocklist.

Second, the Gemini app has its own service switch. Google says admins can turn the Gemini app on or off for everyone, for an organizational unit or for a group, that the setting covers gemini.google.com, the Gemini mobile apps and Gemini in Chrome, and that it does not affect other AI features inside Workspace services. Google also says that work users without a qualifying Workspace edition use the Gemini app under the Google Terms of Service and the Gemini Apps Privacy Notice, where chats may be reviewed by human reviewers and used to improve Google's products, so check which edition your users have before you turn the app on. Google notes changes can take up to 24 hours, and that it has no separate admin control for the Gemini mobile app beyond this setting and device management.

Third, control which third-party apps can reach company data. Google lets admins set each app to Trusted, Limited, Specific Google data or Blocked, and decide what happens with apps nobody has configured, including blocking them so users cannot sign in with Google to unconfigured third-party apps. That is the setting that stops an AI note-taker or writing assistant from connecting to company mail and Drive without review. In Microsoft 365 the equivalent is the Entra ID user consent setting: Microsoft recommends allowing user consent only for apps from verified publishers, and the admin consent workflow lets users request a review instead. Changing the consent setting does not remove access users have already granted; Microsoft says existing grants stay in place until you review and revoke them. Consent controls also do not stop a browser extension that reads pages directly, so block or allow-list extensions in your managed browser policy as well. In Microsoft Edge on Windows and macOS, Microsoft says the ExtensionInstallBlocklist policy stops users installing listed extensions and disables any already installed, and a value of '*' blocks all extensions except signed ones on the allow list.

What none of these controls catch

Every control above needs something you manage: an onboarded device, a managed browser profile, a filtering resolver or a company account. On a personal phone on mobile data or home Wi-Fi, these controls reach only the company apps, profiles or accounts you manage on it; the rest of the phone, and any personal account or browser, is outside every blocklist. That is the gap that keeps shadow AI alive even in well-run companies.

What you can protect on personal phones is company data, not the phone. Microsoft says Intune app protection policies work on devices that are not enrolled in any device management and can stop users copying and pasting company data into personal apps, but they apply only to work accounts inside managed apps; Microsoft says the policies do not apply when the app is used in a personal context. Endpoint data loss prevention covers a similar gap on managed computers: Microsoft says Windows computers onboarded to Microsoft Purview can use Endpoint DLP policies that warn or block users sharing sensitive information with third-party generative AI sites in a browser; check that your Microsoft 365 plan includes Endpoint DLP before you plan around it. Neither stops someone from typing from memory into an AI app on their own phone. No technical control reaches that case. What reduces it is an approved tool good enough that people use it, and a written policy they have agreed to, which is why the policy and the blocklist have to agree.

Vendor controls side by side

This table sums up each option, what it can and cannot catch, and the licensing or terms the vendor lists. Each row links to the vendor page it comes from, checked on the date shown. Vendors change features and plans often, so confirm current terms before you buy.

Checked against the vendor documents in the source list on October 19, 2026. No prices are shown because they change often and vary by agreement; check the vendor's current pricing page.

A rollout order that does not break work

Put the approved tool in place first and publish where people get it. Then switch on monitoring before blocking: tag tools Monitored or use warn indicators with a link to your approved-tools page, and leave them in warn mode for a few weeks while you watch who bypasses the warning. Move tools to blocked once people have a working alternative, and add the request process to the block page so asking is easier than working around the block. Review the register and the blocklist together each quarter, because new AI tools and new AI features inside existing tools keep arriving.

Common follow-up questions

Sources

1. Microsoft Learn: Govern discovered apps (Defender for Cloud Apps)
2. Microsoft Learn: Govern discovered apps using Microsoft Defender for Endpoint
3. Microsoft Learn: Create indicators for IPs and URLs/domains (Defender for Endpoint)
4. Microsoft Learn: Web content filtering in Microsoft Defender for Endpoint
5. Microsoft Learn: Microsoft Edge policy URLBlocklist
6. Microsoft Learn: Configure Microsoft Edge policy settings for Windows using Microsoft Intune
7. Cloudflare Docs: Gateway DNS policies
8. Cloudflare Docs: Gateway domain categories
9. Google Chrome Enterprise Help: Allow or block access to websites
10. Google Workspace Help: Turn the Gemini app on or off
11. Google Workspace Help: Control which apps access Google Workspace data
12. Microsoft Learn: Configure how users consent to applications (Microsoft Entra ID)
13. Microsoft Learn: App protection policies overview (Microsoft Intune)
14. Microsoft Learn: Microsoft Purview data security and compliance protections for generative AI apps
15. Microsoft Learn: Microsoft Edge policy ExtensionInstallBlocklist