# Discovered Applications Review

**Categories:** Software Management

Collects every application Harmony has discovered, with its instances and users, into a single ticket so the desk can approve, reject, or investigate each one.

- Runs on a schedule, weekly by default
- Gathers every application currently marked Discovered
- Pulls in the instances and users attached to each application
- Builds a CSV where each row is tagged application, instance, or user
- Opens a ticket on the assigned desk with the report attached
- Notifies the assignee, falling back to the desk managers

## What Discovered Applications Review does

Discovered Applications Review turns application discovery into a decision queue. On a recurring schedule it gathers every application Harmony currently has marked as Discovered, along with the instances and users attached to each one, and compiles them into a CSV where every row is tagged by type. That report is attached to a ticket on the assigned desk, and the assignee - or the desk managers if no assignee is set - is notified with the count of applications waiting. The point is not to detect: discovery already happened. The point is to make sure somebody decides.

## Who Discovered Applications Review is for

**Persona:** IT and SaaS operations teams who own the application inventory, and the desk that has to approve or reject what discovery turns up.

**Pain point:** Discovery finds applications faster than anyone reviews them. The Discovered list grows, nobody owns working through it, and the useful signal - a new tool with fifty users nobody approved - sits in the same undifferentiated pile as a one-person trial. Without a recurring prompt and a named desk, discovery becomes a dashboard people stop opening.

## How Discovered Applications Review works

**Trigger:** A cron schedule, weekly on Monday morning by default and configurable per tenant. The workflow ships disabled and must be turned on.

1. **Query discovered applications** — Collects every application with status DISCOVERED for the configured period, along with its instances and its users, as flat rows ready for a report.

2. **Generate the report** — Builds a CSV with a fixed column order - row type, application name, display name, instance name, user name, email - so each row identifies what kind of record it is. Skipped when the query found nothing.

3. **Create the review ticket** — Opens a ticket on the configured desk with the CSV attached, asking the reviewer to approve, reject, or take further action on each discovered application.

4. **Resolve who to notify** — Uses the configured ticket assignee, and falls back to the managers of the receiving desk when no assignee is set.

5. **Send the notification** — Tells those recipients a new review ticket exists and how many discovered applications it covers.

**Outcome:** One ticket per cycle on the desk that owns application review, carrying a typed CSV of every discovered application with its instances and users, and a notification so it does not sit unopened.

## Capabilities

- **Scheduled review cycles** - Runs on a cron schedule, weekly by default, so the Discovered list is worked through rather than accumulating.
- **Applications, instances, and users together** - Each report covers all three levels, so a reviewer can see how widely an application is actually used before deciding on it.
- **Typed CSV rows** - A Row Type column marks every row as an application, an instance, or a user, with a fixed column order for consistent reading.
- **Configurable lookback period** - The query period is set per tenant, so a cycle can cover the last week or a longer window.
- **Assignee with desk-manager fallback** - Notifications go to the configured assignee, or to the desk managers when none is set, so no ticket lands unowned.
- **Silent when there is nothing to review** - Report generation, ticket creation, and notification are all skipped when the cycle finds no discovered applications.

## Main use cases

**A new tool spreading through a team** - Discovery picks up an application with a handful of users, then more. Because the report includes users per application, the reviewer can see it is spreading and decide to approve and govern it rather than find out at renewal.

**Working down a discovery backlog** - The Discovered list has been growing for months with no owner. A weekly ticket on a named desk turns it into routine triage instead of a project nobody starts.

**Evidence for a SaaS governance review** - A review asks how newly discovered applications get approved or rejected. The recurring tickets and their attached reports are the record, without anyone reconstructing it.

## Integrations

```json
{
  "_key": "discovered-applications-review-int-t",
  "_type": "table",
  "rows": [
    {
      "_key": "discovered-applications-review-int-t-r0",
      "_type": "tableRow",
      "cells": [
        "Integration",
        "Role in the agent flow"
      ]
    },
    {
      "_key": "discovered-applications-review-int-t-r1",
      "_type": "tableRow",
      "cells": [
        "Harmony application discovery",
        "Source of the applications marked Discovered, with their instances and users"
      ]
    },
    {
      "_key": "discovered-applications-review-int-t-r2",
      "_type": "tableRow",
      "cells": [
        "Your connected identity provider (e.g. Okta, Microsoft Entra ID, Google Workspace)",
        "Supplies the sign-in and user data discovery draws on, and resolves the users listed in the report"
      ]
    },
    {
      "_key": "discovered-applications-review-int-t-r3",
      "_type": "tableRow",
      "cells": [
        "Harmony Service Desk",
        "Native ticketing - creates the ticket, carries the attachment, and records the outcome"
      ]
    },
    {
      "_key": "discovered-applications-review-int-t-r4",
      "_type": "tableRow",
      "cells": [
        "Harmony Notifications",
        "Delivers the alert through each recipient's preferred channel: Slack, Teams, or email"
      ]
    }
  ]
}
```

## FAQ

### Does this agent discover the applications itself?

No. Discovery is already happening in Harmony; this agent gathers what discovery has marked as Discovered and puts it in front of a reviewer on a schedule. It closes the loop between finding an application and deciding about it.

### What is in the CSV?

Rows for applications, their instances, and their users, each tagged in a Row Type column, with a fixed column order: row type, application name, display name, instance name, user name, and email.

### Does it approve or reject applications automatically?

No. The ticket asks a human to approve, reject, or take further action on each discovered application. The agent handles the gathering, reporting, ticketing, and notification.

### What happens on a cycle that finds nothing?

Nothing is sent. Report generation, the ticket, and the notification are all conditional on the query returning results, so a quiet week is quiet.

### What needs to be set up before this agent works?

Application discovery active in Harmony, a desk configured to receive the review tickets, and the schedule, lookback period, priority, and optional assignee set for your tenant. Like all these templates it ships disabled, so it has to be enabled first.

## Related agents and features

- [**Unauthorized Applications Detection**](/agents/unauthorized-applications-detection) - Sibling monitor that flags applications already known to be outside policy, where this agent triages ones newly discovered
- [**Unused Application Discovery**](/agents/unused-application-discovery) - Sibling monitor covering approved applications nobody is using, the other end of the same inventory problem
- [**Software Compliance Report**](/agents/software-compliance-report) - Recurring reporting on software compliance across the estate
- **Harmony Service Desk** - Receives the tickets this agent opens and carries the audit trail of what happened