Turn on audit logs, and have someone watch AI activity like everything else.
What it means
If an AI reads lots of files at night, or a new app starts signing in, someone should notice. That only happens if the activity is logged and somebody is watching.
A simple example
A connected app starts downloading every file in the shared drive at 2 a.m. With monitoring, someone gets an alert while it’s happening. Without it, the download could go unnoticed for months.
Do it yourself
- Make sure audit logging is on in your Microsoft 365 or Google Workspace admin, and in each AI tool’s admin settings if it offers one. On Microsoft 365 Business plans it starts switched off: in the Microsoft Purview portal, go to Audit and choose “Start recording user and admin activity”.
- Keep sign in and audit logs longer than the default by sending them to a log service or to whoever monitors your systems.
- Make sure whoever watches your systems around the clock sees AI activity too.
How to check
Use one AI tool as a test user, wait a few hours, then find that use in the log. If it isn’t there, turn on logging for that tool, or send its logs to whoever watches your systems.
What that misses
Logs only help if someone reads them. Catching a 2 a.m. download takes monitoring that runs around the clock.
What we do for you
We monitor your systems around the clock and add your AI tools’ activity to what we watch.
“What we do for you” describes work we do for our clients, and what’s included depends on your plan. Already a client? Your engineer can tell you what your plan covers.
Back to all rulesGet the full guide
Technology, managed by people.
The real McCoy: real oversight, real understanding, real answers. Start with a free AI Check.