Block ChatGPT for All Users Except Selected Devices

Question

We have around 500 computers, and users are using various AI tools such as ChatGPT and Grok. Our requirement is to block ChatGPT and a few other AI services (not all AI tools) on all devices except five specific computers.

I checked Microsoft Defender Indicators, but the policy applies to all devices, and I couldn't find a way to exclude a device group. I also looked at Intune Device Configuration, but it only works with Microsoft Edge.

What is the best way to block specific AI services across all browsers while excluding a few devices?

[Moved from Microsoft 365 and Office | Microsoft 365 Defender | Other | Windows]

Answer 1

Hi Zayan zay

Blocking specific AI services like ChatGPT across all browsers while still letting a handful of machines through is a bit tricky, but doable. Microsoft Defender Indicators are great, but as you noticed, they’re all-or-nothing across devices. What you’ll want to look at instead is setting up Conditional Access policies combined with device groups in Intune or Entra ID. That way, you can target the block policy at “all devices except group X,” where group X is your five exempt computers.

For the actual blocking, you’ll likely need to use Web Content Filtering in Microsoft Defender for Endpoint. This lets you blacklist domains like chat.openai.com or grok.com across all browsers, not just Edge. Then, scope the policy to your main device group, and exclude the smaller group of machines that should still have access. Another option is to use a network-level firewall rule (like via Microsoft Defender Firewall or your perimeter firewall) to block those domains org-wide, and then create exceptions for the five machines by IP or device tag.

I hope this information can help you solve the problem.