What Is Shadow IT, How to Discover It, and How to Manage It Without Banning Everything

Method 1: DNS and proxy log analysis

Every cloud app a device contacts shows up in DNS queries and firewall/proxy logs. Shadow IT discovery starts with analyzing what domains your network traffic is hitting.

For organizations with a web proxy or NGFW (Palo Alto, Fortinet, Zscaler, Cisco Umbrella):

• Most NGFW vendors include an app identification database that categorizes traffic by application (Dropbox, Google Drive, ChatGPT, etc.): pull the top cloud app categories from the past 30 days
• Look for file sharing categories (personal cloud storage, collaboration tools), AI/ML services, and productivity/business tools that are not in your approved list

For Microsoft 365 environments, Microsoft Defender for Cloud Apps includes a Shadow IT discovery feature:

# Enable Cloud Discovery in Defender for Cloud Apps
# Then pull the discovery report from:
# security.microsoft.com > Cloud Apps > Cloud Discovery > Dashboard

The Defender for Cloud Apps catalog rates thousands of apps on security criteria including data residency, SOC 2 compliance, breach history, and encryption practices.

Method 2: OAuth grant audit

Employees authorize OAuth apps to access work accounts constantly: 'Sign in with Google' or 'Connect to Microsoft 365.' Each authorization grants the app access to whatever scope the user approved, often without IT knowledge.

# Audit all OAuth grants across your Microsoft 365 tenant
Get-MgOauth2PermissionGrant -All | ForEach-Object {
    $app = Get-MgServicePrincipal -ServicePrincipalId $_.ClientId -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        AppName = $app.DisplayName
        Publisher = $app.PublisherName
        Scope = $_.Scope
        UserCount = 1  # Aggregate this in real analysis
    }
} | Group-Object AppName | Sort-Object Count -Descending | Select-Object -First 50

Apps with Mail.ReadWrite or Files.ReadWrite.All access across many users represent significant unmanaged data exposure.

Method 3: Employee survey (underused and highly effective)

Ask employees directly what tools they use for work that are not officially sanctioned. Frame it as a tool evaluation exercise, not a security audit: you will get honest answers if employees believe the goal is to sanction useful tools rather than ban them.

A 5-question survey to department heads:

1. What apps do you use regularly that IT has not approved?
2. What tools do you use for file sharing with external parties?
3. What AI tools do you use in your work?
4. What browser extensions do you rely on?
5. What would make your approved tools good enough that you would stop using the unapproved ones?

Once you have discovered shadow IT, the temptation is to block everything unapproved. This is counterproductive: it damages productivity and erodes trust without proportionate security benefit.

Classify discovered apps into four tiers:

Tier 1: Approved: Already vetted and accepted. No action needed.

Tier 2: Fast-track approve: Apps with strong security posture (SOC 2 Type II certified, data residency in acceptable jurisdictions, no history of breaches, reasonable data processing terms) that employees use for legitimate work purposes. Fast-track these through a 3-day approval process: the goal is to get them under management (SSO enrollment, DLP policy coverage) without blocking productivity.

Tier 3: Conditional use: Apps with adequate security posture but requiring specific controls: for example, allowing Dropbox for external file sharing only if sensitive data classification blocks are in place, or allowing a specific browser extension only on managed devices. Define the conditions; communicate them; monitor for compliance.

Tier 4: Block: Apps with poor security posture (no encryption at rest, no data processing agreement available, no incident response contact, jurisdiction with no privacy protections), apps that handle sensitive data categories your compliance framework restricts, or apps that create compliance violations regardless of their security posture (GDPR transfers to non-adequate countries, HIPAA data in non-BAA apps).

Tier 4 blocking works only when you provide a sanctioned alternative that meets the same need. If you block personal Dropbox for external file sharing and do not provide a sanctioned external sharing option, employees will use email attachments instead: which is worse.

The most effective shadow IT control is making the sanctioned process faster than the workaround.

A fast-track approval SLA that works:

• Employee submits app request via a form (app name, URL, business use case, data types that will flow through it)
• IT/security reviews the app against a standard checklist: SOC 2 status, data processing agreement availability, privacy policy data residency, vendor breach history
• Decision within 5 business days: approved with conditions, conditionally approved, or denied with alternative
• If approved: the app is added to the SSO catalog (employees get it through company accounts, not personal ones), enrolled in the DLP policy if handling sensitive data, and logged in the SaaS inventory

The SSO enrollment is the critical security control: When an app is connected to your IdP (Entra ID, Okta, Google Workspace), you control access through centralized identity management. When an employee leaves, deprovisioning through the IdP automatically revokes access to all connected apps: instead of leaving corporate data accessible in personal accounts indefinitely.

Tools for ongoing management:

• Microsoft Defender for Cloud Apps: continuous shadow IT discovery, app risk scoring, policy-based blocking for high-risk apps
• Okta or similar IdP: centralized app catalog, access request workflows, deprovisioning automation
• Browser agent deployment: some CASB vendors deploy a browser agent that can block unapproved web apps or alert on shadow IT access without requiring a full web proxy