Shadow IT: How to Find the Cloud Apps Your Business Never Approved

Shadow IT is software or cloud services being used for business work without the organisation deliberately approving or managing them. It usually starts because somebody is trying to solve a real problem quickly, not because they are trying to bypass security.

The risk appears later: nobody owns the subscription, nobody knows what data went into it, and nobody remembers to remove access when the staff member leaves.

Find what the business is already paying for

Start with recurring card and bank transactions. Match every software charge to an owner, business purpose and administrator account.

Check identity and browser evidence

Review enterprise applications connected to Microsoft 365, approved browser extensions, password-manager entries and other sources that show which services staff use.

Ask staff without turning it into a witch hunt

People are more likely to disclose useful tools if the question is “what helps you do your job?” rather than “what have you installed without permission?” The goal is to understand the environment and create sensible rules.

Classify what you find

For each tool, decide whether it should be approved, replaced, restricted or removed. Check who owns the account, what information it holds, whether MFA is available, how data can be exported, and how access is removed.

Create a lightweight approval path

If approval takes weeks, staff will work around it. Give people a simple way to request a new service and get a timely answer.

Build SaaS into offboarding

Every approved application should have an owner and a removal process. Our employee offboarding guide covers the lifecycle side.

AI tools create a related but distinct problem because of the data staff may enter into them. See our Shadow AI guide and free AI Use Policy template.