> ## Documentation Index > Fetch the complete documentation index at: https://docs.porcia.org/llms.txt > Use this file to discover all available pages before exploring further. # Shadow IT > Apps your team is using without IT approval — discovered automatically and surfaced in Shadow IT (/shadow-it). **Shadow IT** is a top-level sidebar item at `/shadow-it`. It surfaces apps discovered via email, browser, or SSO that aren't in your sanctioned catalog — so your team can review them and make a decision. ## The Shadow IT page The page has two main sections: **Multi-Source Correlation View** — collapsed by default. Expand it to see a breakdown of how apps were discovered across each source (email, SSO, browser). Useful for understanding coverage and gaps. **Shadow IT Dashboard** — the main view. Lists all unapproved discovered apps with: * App name and logo * Discovery source(s) * Number of users detected * Risk signals from the vendor database * Actions for each app The page header also has a direct link to **OAuth Grants** — because shadow IT and unauthorized OAuth grants often go hand-in-hand. ## What counts as shadow IT An app is flagged as shadow IT when it appears across any discovery source but hasn't been formally approved: * **Email** — invoice or signup confirmation from an unknown app * **Browser extension** — employee logs into a domain not in the sanctioned catalog * **SSO** — app connected to your IdP by a user without going through IT Apps with approval status **Pending** and apps never reviewed are the primary candidates that show up here. ## Reviewing a shadow IT app Click any app to open its detail. From the Shadow IT page you can see: * **Users** — who is using it (from SSO or browser detection) * **Usage frequency** — how actively it's being accessed * **Risk signals** — compliance certifications, data types handled, breach history * **Similar sanctioned apps** — if you already have an approved alternative ## Acting on shadow IT For each discovered app you have several options: **Approve it** — it's legitimate and useful. Click Approve, assign an owner, and it moves into the Apps catalog with Approved status. **Mark as Under Review** — you need more time. Change the approval status to Under Review; the app stays in the catalog with that status until a decision is made. **Deny it** — it shouldn't be used. Change the approval status to Denied. Optionally use a [Playbook](/governance/playbooks) to offboard affected users, or a [Pulse](/governance/pulses) to notify employees why it's being blocked. ## Filtering and exporting Use the **Export** button in the page header to download the shadow IT list as a CSV — useful for sharing with a security team or leadership for a broader review. ## Automatic alerts Set up a [Rule](/governance/rules) to be notified in real time when new shadow IT is detected: * Trigger: New app discovered * Condition: Approval status = Pending (newly found app) * Action: Notify your security team in Slack This gives you continuous awareness instead of checking manually. ## Shadow apps dashboard **Dashboard → Shadow apps** (`/dashboard/shadow-apps`) gives a higher-level view of shadow IT trends over time — useful for tracking whether the number of unapproved apps is growing or shrinking as your governance program matures. ## Next steps Get real-time alerts when new shadow IT is detected Reach employees to verify shadow IT usage Automate offboarding for blocked apps Manage your sanctioned app catalog