Corp Data Security from AI Agents

Treat WhatsApp as an unmanaged destination, regardless of whether the recipient is a person or an AI agent. The enforceable boundary is the movement of corporate data into the app; endpoint controls generally cannot reliably distinguish one encrypted WhatsApp conversation from another. On managed Windows devices, use Microsoft Purview Endpoint DLP to test and then block copying, pasting, uploading, or printing labeled content to restricted applications and browser destinations. Add the desktop client to the restricted-app policy if it is allowed for personal use, and use Microsoft Edge work profiles so corporate sessions and downloads stay in the managed browser context. On managed mobile devices, Intune app-protection policies should keep data inside approved work apps and block Open in, Save as, and cut/copy into unmanaged apps such as WhatsApp. Conditional Access can require those protected apps before corporate data is opened on a mobile device.

Validate the policy with real paths: copied text, file attachment, drag and drop, browser upload, Share sheet, screenshots, and files first downloaded locally. Record which paths are blocked and which only generate an alert. Manual retyping or photographing a screen cannot be eliminated by a DLP rule, so reduce access to sensitive records, label them, monitor unusual retrieval, and make the prohibition on consumer AI agents explicit in the data-handling policy.