From Gemini to Azure OpenAI: Shadow AI Made Secure

Shadow AI is the use of consumer AI tools by teams without IT oversight: useful, but with corporate data leaving the security perimeter. For an international manufacturing company in the thermal-comfort sector we tackled a concrete case — a customs-classification app built on Google Gemini — bringing it back onto Azure OpenAI inside the Microsoft infrastructure, without stopping the team’s work.

The company’s Logistics department had solved a real problem with an in-house AI app. The problem was that corporate data was leaving towards Google’s APIs. We brought the same tool inside the Microsoft perimeter, with the same principle of AI kept within the corporate perimeter we apply to every generative-AI project.

The problem: a useful tool, outside the security perimeter

The Logistics team had built a web app that used the Google Gemini APIs to assist with customs classification: enter a product’s name, description, materials, country of origin and destination, and the system suggests the correct HS/CN codes with supporting reasoning. The tool worked. Colleagues used it. It saved hours of manual work.

IT saw the problem: product descriptions, technical specs, destination countries — sensitive data — were leaving the corporate perimeter and landing in Google’s APIs. It was not compliant with security policy.

This is not an isolated case. In many companies of a certain size, someone — often in operations, logistics or finance — finds a way to use consumer AI tools to automate a repetitive process. They do it with good intentions, get concrete results, but bypass IT. The classic response is to block. But blocking has a cost: you throw away working software, demotivate the person who took the initiative, and slow down processes that had become dependent on that tool. The company chose a different path: don’t discard the work — make it secure.

The solution: same functionality, Microsoft perimeter

Customs classification is a critical process. Assigning the correct HS or CN code determines duty rates, export restrictions and customs procedures: an error can trigger penalties, delays and unexpected costs. We stepped in with a precise goal: replicate the app’s functionality by replacing the Google Gemini calls with Azure OpenAI, keeping the rest of the architecture as unchanged as possible.

Solution architecture

The app was rewritten as a SharePoint Framework (SPFx) web part and integrated into the corporate intranet. The classification history still lives in a SharePoint Online list. The AI part — which used to leave towards Google — now runs on Azure OpenAI: data never leaves the company’s Microsoft infrastructure, is subject to the same security and governance policies as the rest of the systems, and is covered by Microsoft’s contractual data-residency agreements.

The usage flow stayed identical: the user enters the product’s name, description, materials and countries, uploads extra technical documentation, and the system queries the AI model to identify the most likely HS/CN candidates. The tool then queries TARIC and Access2Markets to verify restrictions, applicable duties and regulatory references, and lets the user confirm the code and save it to the history. From the end user’s point of view the experience is unchanged: same interface, same flow, same outputs. The migration was transparent.

The most delicate technical challenge was ensuring the answer quality stayed comparable despite the model change. The prompts and call structure were recalibrated to get output from Azure OpenAI consistent with what the team expected from Gemini — different models respond differently to the same inputs, it is not an automatic switch — with the same rigorous grounding as a RAG chatbot in Teams.

The results

The main result is that the Logistics department could keep using the tool it had built, with no operational interruption and no starting over. IT regained control of the corporate data flow: no sensitive information leaves the Microsoft perimeter anymore.

The formula is: same functionality, same workflow, zero data outside the perimeter. Azure OpenAI is not a compromise on AI quality — it is access to the same OpenAI models through infrastructure that guarantees corporate data stays under the company’s control.

Who this approach is for

It is relevant for any organisation that already has AI tools built in-house — or used informally by operational teams — leaning on consumer APIs like ChatGPT, Gemini or Claude.com. There is no need to rebuild everything: replatforming onto Azure OpenAI preserves the work done and replaces only the security-critical component, with lower time and cost than a from-scratch project. It is the first concrete step of an AI adoption strategy that puts governance before enthusiasm.

If your company has AI tools born outside the IT perimeter, we can help you make them secure without losing the work done, with AI integrated into Microsoft 365. Contact us for an assessment →