Your CASB Already Sees AI Traffic.
Make It Act on It.

# MCAS API: Tag AI tools in Cloud App Catalog and create governance policies
# Requires: MCAS API token with manage permissions

$McasUrl = "https://yourcompany.portal.cloudappsecurity.com"
$ApiToken = "your-mcas-api-token"
$Headers = @{
    "Authorization" = "Token $ApiToken"
    "Content-Type"  = "application/json"
}

# Step 1: Import AI Tools Blocklist and tag apps in the catalog
$blocklist = Import-Csv "ai_tools_blocklist.csv"
$tagMap = @{
    "Text Generation"   = "AI-TextGen-Unsanctioned"
    "Code Generation"   = "AI-CodeGen-Blocked"
    "Image Generation"  = "AI-ImageGen-Monitor"
    "Data Analytics"    = "AI-Analytics-Blocked"
    "AI Agents"         = "AI-Agents-Blocked"
    "Voice & Speech"    = "AI-Voice-Blocked"
}

foreach ($entry in $blocklist) {
    $tag = $tagMap[$entry.primary_category]
    if (-not $tag) { $tag = "AI-Tool-Unclassified" }

    # Search for the app in the MCAS catalog by domain
    $searchBody = @{
        filters = @{
            domain = @{ eq = @($entry.domain) }
        }
    } | ConvertTo-Json -Depth 5

    $apps = Invoke-RestMethod "$McasUrl/api/v1/discovery/discovered_apps/" `
        -Method POST -Headers $Headers -Body $searchBody

    foreach ($app in $apps.data) {
        # Mark as unsanctioned and apply category tag
        $tagBody = @{
            filters = @{ appId = @{ eq = @($app.appId) } }
            appTags = @($tag)
            sanctioned = $false
        } | ConvertTo-Json -Depth 5

        Invoke-RestMethod "$McasUrl/api/v1/discovery/discovered_apps/bulk/" `
            -Method POST -Headers $Headers -Body $tagBody
    }
}

# Step 2: Create an App Discovery Policy for new AI tools
$discoveryPolicy = @{
    name        = "New AI Tool Detected"
    description = "Alert when a previously unseen AI tool is accessed"
    policyType  = "discovery"
    severity    = "MEDIUM"
    enabled     = $true
    filters     = @{
        tag     = @{ eq = @("AI-Tool-Unclassified", "AI-TextGen-Unsanctioned") }
        userCount = @{ gte = 1 }
    }
    alertActions = @{
        sendAlert    = $true
        alertRecipients = @("[email protected]")
        markUnsanctioned = $true
    }
} | ConvertTo-Json -Depth 5

Invoke-RestMethod "$McasUrl/api/v1/policies/" `
    -Method POST -Headers $Headers -Body $discoveryPolicy

# Step 3: Create a Session Policy for sanctioned AI tools
# (Requires Conditional Access App Control configured in Azure AD)
$sessionPolicy = @{
    name        = "AI Tool Upload Inspection"
    description = "Scan all file uploads to sanctioned AI tools for sensitive content"
    policyType  = "session"
    sessionControlType = "controlFileUpload"
    severity    = "HIGH"
    enabled     = $true
    filters     = @{
        app     = @{ eq = @("ChatGPT", "Microsoft Copilot", "Claude") }
        activity = @{ eq = @("upload") }
    }
    contentInspection = @{
        enabled = $true
        dlpProfiles = @("PII-Detection", "Source-Code-Detection", "Financial-Data")
    }
    actions     = @{
        blockUpload = $true
        notifyUser  = "This upload was blocked because it contains sensitive data."
        alert       = $true
    }
} | ConvertTo-Json -Depth 5

Invoke-RestMethod "$McasUrl/api/v1/policies/" `
    -Method POST -Headers $Headers -Body $sessionPolicy

Write-Host "AI governance policies deployed to MCAS successfully."