Shadow IT discovery and the SaaS inventory conversation nobody wants to start

A marketing manager finds a free AI transcription tool that turns meeting recordings into clean summaries. It saves real time. During setup a screen asks to connect Microsoft 365, she clicks accept and the OAuth grant goes through in 2 seconds. Nobody reviewed it. Now every meeting she records, including calls where customers discuss their contracts and their data, flows to a vendor no one at the company has ever vetted. No policy was broken. No malware was involved. A capable person solved a real problem faster than IT could have.

That is shadow IT, and it is not a story about rogue employees. It is a story about people doing their jobs. The risk is not the transcription tool. The risk is ungoverned data and an unreviewed OAuth grant that persists silently long after the person who created it has forgotten it exists.

This post covers what shadow IT actually is, why it is a data-governance problem before it is a security problem, how to discover it, how to triage what you find and how to build a request path so the problem does not simply grow back.

Shadow IT is a symptom, not a crime

The instinct is to treat shadow IT as a discipline problem. Someone broke the rules, find them, stop them. That framing fails because it misreads the cause.

Shadow IT appears when the sanctioned path is slower than the problem. A team needs to transcribe calls, share a large file, run a quick survey or automate a tedious step. The approved option requires a ticket, a review and a wait. The unapproved option requires a credit card or a free tier and 5 minutes. People pick the fast path because they are trying to get work done, not to undermine security.

The scale is larger than most owners expect. Industry surveys of SaaS usage consistently find that a typical 50-person company runs well over 100 distinct SaaS applications, while IT is aware of only a fraction of them. The gap between what is running and what is known is the shadow. It is not a handful of oddballs. It is the majority of the software footprint.

Punishing the marketing manager does nothing about the other 80 apps nobody has mapped. Discovery and governance do.

The real risk is the grant, not the app

Most shadow IT conversations fixate on the application. Is this vendor trustworthy, is this tool secure. That is the wrong first question. The first question is what data the app can reach and how.

Two mechanisms create the exposure:

• OAuth grants into Microsoft 365. When a user connects a third-party app and accepts the consent screen, the app receives a token that can read mail, files, calendars or recordings on that user’s behalf. That token keeps working after the browser closes. It survives the user changing their password. Many grants include offline access, which means the vendor can pull data continuously without anyone signed in. Revoking a password does nothing to a live OAuth grant.
• Data copied out to the vendor. The transcription tool does not just read the recording once. It stores a copy on infrastructure you do not control, under a data processing agreement nobody read, in a jurisdiction nobody checked. If that vendor is breached, your customer data is in the breach.

An app that only stores a team’s lunch orders is low risk no matter who built it. An app holding an offline_access grant to a mailbox full of customer records is high risk even if the vendor is reputable. Sensitivity of the data and scope of the grant drive the risk. The brand name on the app does not.

This is the same discipline we bring to managing identity in a 50-person company. Identity is the front door and OAuth grants are side doors that bypass it. A password policy and MFA on the front door mean little if a dozen apps hold standing tokens through the side.

How to discover what is actually running

Discovery combines three lenses because no single source sees everything. Logs miss free-tier tools that never involved a payment. Statements miss apps connected by OAuth at no cost. Surveys miss what people forget to mention. Run all three.

Sign-in and OAuth consent logs

Start inside Microsoft 365. Entra ID keeps a record of every enterprise application and every OAuth consent granted in the tenant. Export the enterprise application inventory and the sign-in logs, then read the delegated permissions each app holds. Apps carrying Mail.Read, Files.Read.All, Sites.Read.All or offline_access are the ones to surface first. Those permissions let a vendor read broad swaths of company data on a schedule.

Expense and card review

Pull 12 months of corporate card and expense data. The signature of departmental SaaS is a recurring small-dollar charge, often 10 to 50 dollars a month, to a vendor procurement has never heard of. One charge is a subscription. A pattern of them across departments is a shadow software portfolio.

Department surveys

Ask each department lead a simple question. What tools does your team actually use to get the work done. Frame it as help, not enforcement, because the goal is honest answers. People happily name the free tools they would never expense, and those are exactly the ones the logs and the statements cannot see.

Triage by data sensitivity, not by vote count

Once discovery produces a list, resist the urge to rank apps by how many people use them. Rank them by the sensitivity of the data they touch and the scope of the access they hold.

Build a single inventory with one row per app and these columns:

• App and vendor. What it is and who runs it.
• Data touched. Customer records, financials, health data, internal only or public.
• Access mechanism. OAuth grant into Microsoft 365, a data copy, or standalone with no company-data link.
• Grant scope. For OAuth apps, the specific permissions and whether offline access is present.
• Sanction status. Sanctioned, tolerated or unsanctioned.
• Owner. The named person accountable for the decision.

Sort that inventory by data sensitivity. A tool used by 40 people that touches no company data sits below a tool used by 1 person that holds a live grant to a mailbox full of customer contracts. The single-user app with the sensitive grant is the one that becomes a breach headline.

For firms carrying regulated data, this inventory is also the artifact a customer security questionnaire will ask about. Knowing every app that touches customer data is a direct input to the answers we walk through in our customer security questionnaire post.

Govern the risky ones, then close the door behind you

Triage produces a short list of apps that need action. Two moves handle most of them.

Revoke. For unsanctioned apps touching sensitive data, revoke the OAuth grant in Entra ID and disable the account. Revoking the grant is the step that actually cuts off the standing access. Deleting the app or changing a password does not.

Govern. For apps worth keeping, move them under control. Put them behind single sign-on and conditional access so identity governs them. Get a reviewed data processing agreement on file. Assign a named owner. Document the decision so the next review starts from a recorded answer rather than a blank page.

The move that keeps shadow IT from growing back is the request path. Discovery is a snapshot. Without a faster sanctioned route, the shadow reappears within months because the underlying pressure never changed. The fix is to make the approved path quick. A short intake form, a same-week turnaround and a default posture of yes-with-controls rather than no. When the sanctioned path is faster than the credit-card path, the next tool arrives with a security review already attached instead of a surprise OAuth grant nobody sees for a year.

A realistic first pass runs about 2 weeks. Roughly 3 to 5 days to pull logs, statements and survey responses, a few days to build and triage the inventory, then remediation and the request process stood up by the end of the window.

Where Atticus Rowan fits

Atticus Rowan runs shadow IT discovery as part of the Microsoft 365 identity and governance work we do for small businesses across our client base. We pull the Entra ID application inventory and consent grants, cross-reference expense data, survey the teams, build the sensitivity-ranked inventory and remediate the grants that should not exist. Then we stand up the intake path so the tenant stays governed instead of drifting back into shadow. Our solutions page outlines the broader engagement model.

If you cannot name every third-party app connected to your Microsoft 365 tenant, you have shadow IT and you have not measured it yet. Schedule a discovery call and we can scope the inventory and the path to a governed SaaS footprint inside a 2-week window.