How to find shadow IT apps in your company

To find shadow IT apps, combine several discovery sources, because each one sees a different slice: OAuth grants and sign-in data from your identity provider (Google Workspace, Entra ID or Okta) show apps employees connected with their work account; endpoint software inventory from MDM shows installed applications; network or CASB discovery, such as Microsoft Defender for Cloud Apps, matches traffic logs against a catalog of over 31,000 cloud apps; and expense and card data shows tools paid for outside procurement. Merge the results into one list, compare it against your approved application inventory, and triage every unknown app into approve, replace or remove. CIS Controls Safeguard 2.3 asks for unauthorized software to be removed or given a documented exception, reviewed monthly or more often.

What counts as shadow IT

Shadow IT is any software, SaaS application or service used for work without IT's knowledge or approval. Most of it is not malicious: a team signs up for a design tool with a credit card, someone connects an AI note-taker to their calendar, a free trial becomes the place a project lives. The risks are real all the same: company data in a vendor nobody assessed, OAuth permissions to mailboxes and drives, accounts that survive offboarding because IT never knew they existed, and spend that duplicates tools you already pay for. Lines of business, not IT, now control most SaaS spend; Zylo's 2025 SaaS Management Index put their share at 70%, and its 2026 figures put the average company at 305 SaaS applications.

Five ways to find shadow IT apps

1. OAuth grants and sign-in data from your identity provider

When employees click "Sign in with Google" or "Sign in with Microsoft", or grant an app access to their mail, calendar or files, the identity provider records it. This is the highest-value source because it also shows what data each app can reach.

• Google Workspace: in the Admin console, go to Security, Access and data control, API controls, Manage Third-Party App Access. The Accessed apps list shows third-party apps users have connected with Google, the number of users per app and the Google services each one requested.
• Microsoft Entra ID: review Enterprise applications and, for each app, the Permissions page, which separates admin consent from user consent. User-consent grants can be revoked through Microsoft Graph or PowerShell. Tighten future consent under Consent and permissions; Microsoft recommends allowing user consent only for verified publishers and selected low-risk permissions.
• Sign-in reports: Entra's application activity report lists apps with sign-in attempts. It only covers apps already connected to Entra, so use it to find unapproved apps that went through SSO, not apps that bypass it.

What it misses: apps employees sign up for with an email address and password.

2. Endpoint software inventory

Your MDM (Intune, Jamf, Kandji) or endpoint management tool lists installed applications on every managed device. Compare it against the approved list to find desktop apps, browser-based tools with desktop clients, and AI assistants installed locally. Endpoint inventory also catches apps that never touch the identity provider, which makes it the best source for "installed on laptops but missing from SSO".

What it misses: browser-only SaaS and anything on unmanaged devices.

3. Network and CASB discovery

Cloud access security brokers match web traffic against a catalog of known apps. Microsoft Defender for Cloud Apps Cloud Discovery takes firewall and proxy log uploads, a continuous log collector, secure web gateway integrations, or its native Defender for Endpoint integration, which covers devices beyond the corporate network. Each app in its catalog of over 31,000 is scored on more than 90 risk factors across general, security, compliance and legal categories, which helps prioritise.

What it misses: traffic you do not route or log, and personal devices.

4. Expense, card and procurement data

Finance sees what IT does not: subscriptions on corporate cards, expense reports and invoices. Pull SaaS-looking vendors from the card feed and expense tool monthly. This is the best source for paid tools bought outside procurement and the duplicate subscriptions that inflate spend.

What it misses: free tools and free tiers, which are often the riskiest.

5. Ask people

A short survey or a periodic attestation, "which tools does your team use for work?", surfaces apps no system sees and, just as useful, tells you why people chose them. It also identifies a business owner for each app, which you need for the triage step.

What to do with what you find

Discovery produces a list. The value is in deciding about each item, quickly:

1. Merge and deduplicate the sources into one inventory per app, with users, data access, spend and a suspected owner.
2. Triage by risk. Apps with access to mail, files or customer data, many users, or no security documentation go first.
3. Decide for each app: approve it (assign an owner, add it to SSO and the catalog), replace it with an approved tool you already pay for, or remove it (revoke OAuth grants, cancel the subscription, export the data).
4. Close the path in. Restrict user consent to verified publishers, publish an easy request process for new tools, and make the approved catalog easy to find, because people adopt shadow IT when the official route is slow.
5. Repeat on a schedule. CIS Safeguard 2.3 sets monthly as the minimum for unauthorized software; Safeguard 2.1 asks for the software inventory to be reviewed at least twice a year.

A monthly routine

• Weekly: review newly discovered apps and new OAuth grants with sensitive scopes.
• Monthly: triage the discovered list, reconcile card and expense data, revoke grants for rejected apps.
• Quarterly: confirm owners for approved apps, reclaim unused licenses, and run an access review for apps holding sensitive data.

How Harmony finds and governs shadow IT

Harmony's application management builds one inventory from SSO and OAuth events, endpoint software inventory, SaaS management platforms and expense data, with sources including Okta, Entra ID, Google Workspace, JumpCloud, Intune, Jamf, Kandji, Torii, Zylo, Mesh Payments, Navan and NetSuite. It flags shadow apps found on endpoints but absent from the identity provider, alongside inactive, orphaned and ghost apps. Three agents turn discovery into decisions:

• Discovered Applications Review gathers every app marked Discovered, with its instances and users, into one ticket on a named desk each week so someone approves, rejects or investigates each one.
• Unauthorized Applications Detection runs weekly across identity-provider applications, reports apps without an approved status with owner, user count and first and last seen dates, and opens a ticket.
• Unused Application Discovery surfaces apps with low or no usage so licenses can be reclaimed.

Approved tools then flow through access requests with approvals in Slack or Teams. For the cost side of the problem, see the SaaS sprawl problem: the real cost of shadow IT, and for devices rather than apps, how to find unmanaged devices on your network.

This guide is written and maintained by Harmony. Details about other products come from their public documentation, listed under Sources, and were last checked in October 2026. If something is out of date, email us and we will fix it.