Shadow IT

Shadow IT is a top-level sidebar item at /shadow-it. It surfaces apps discovered via email, browser, or SSO that aren’t in your sanctioned catalog — so your team can review them and make a decision.

​

The Shadow IT page

The page has two main sections: Multi-Source Correlation View — collapsed by default. Expand it to see a breakdown of how apps were discovered across each source (email, SSO, browser). Useful for understanding coverage and gaps. Shadow IT Dashboard — the main view. Lists all unapproved discovered apps with:

• App name and logo
• Discovery source(s)
• Number of users detected
• Risk signals from the vendor database
• Actions for each app

The page header also has a direct link to OAuth Grants — because shadow IT and unauthorized OAuth grants often go hand-in-hand.

​

What counts as shadow IT

An app is flagged as shadow IT when it appears across any discovery source but hasn’t been formally approved:

• Email — invoice or signup confirmation from an unknown app
• Browser extension — employee logs into a domain not in the sanctioned catalog
• SSO — app connected to your IdP by a user without going through IT

Apps with approval status Pending and apps never reviewed are the primary candidates that show up here.

​

Reviewing a shadow IT app

Click any app to open its detail. From the Shadow IT page you can see:

• Users — who is using it (from SSO or browser detection)
• Usage frequency — how actively it’s being accessed
• Risk signals — compliance certifications, data types handled, breach history
• Similar sanctioned apps — if you already have an approved alternative

​

Acting on shadow IT

For each discovered app you have several options: Approve it — it’s legitimate and useful. Click Approve, assign an owner, and it moves into the Apps catalog with Approved status. Mark as Under Review — you need more time. Change the approval status to Under Review; the app stays in the catalog with that status until a decision is made. Deny it — it shouldn’t be used. Change the approval status to Denied. Optionally use a Playbook to offboard affected users, or a Pulse to notify employees why it’s being blocked.

​

Filtering and exporting

Use the Export button in the page header to download the shadow IT list as a CSV — useful for sharing with a security team or leadership for a broader review.

​

Automatic alerts

Set up a Rule to be notified in real time when new shadow IT is detected:

• Trigger: New app discovered
• Condition: Approval status = Pending (newly found app)
• Action: Notify your security team in Slack

This gives you continuous awareness instead of checking manually.

​

Shadow apps dashboard

Dashboard → Shadow apps (/dashboard/shadow-apps) gives a higher-level view of shadow IT trends over time — useful for tracking whether the number of unapproved apps is growing or shrinking as your governance program matures.

​

Next steps