How to Find Shadow IT and Unsanctioned Apps

Ask a business owner how many cloud apps their staff use and you'll get a confident answer. Microsoft 365, the accounting package, the CRM, maybe a project tool. Call it a dozen.

Microsoft's own guidance for its Defender for Cloud Apps product puts it bluntly: when IT admins are asked, they typically guess 30 or 40 apps, and the real average across organisations is over 1,000. That figure comes from larger organisations and a vendor with a product to sell, so don't treat it as gospel for a 15-person firm. But the shape of the gap is real. Nobody adds 1,000 apps on purpose. They arrive one at a time, each solving a small problem on a busy afternoon.

This is shadow IT, and in 2026 it has a new and more slippery form. Here's how to find it, and what to do once you have.

Why it happens, and why it matters now

Shadow IT is rarely malicious. Someone needs to send a file that's too big for email, so they use a free transfer site. Someone needs to turn a PDF into Word, so they upload a client contract to a converter. Someone discovers an AI tool that summarises meetings brilliantly, and connects it to their calendar and Teams.

Each decision is reasonable on its own. Together they leave your business data scattered across services you didn't choose, didn't vet and can't switch off when someone leaves.

AI has made this worse in two ways. First, the free AI chat tools invite people to paste text in, which means client details, contracts and financials can end up on a service whose terms you've never read. Second, AI features now arrive inside apps people already use, so new data flows can appear without anyone signing up for anything.

The stakes are concrete. If personal information leaks from an unapproved app, it's still your breach for Privacy Act and Notifiable Data Breaches purposes.

Six ways to find unsanctioned apps

1. Check which apps have access to your Microsoft 365

Start here, because it costs nothing and it's often the most revealing. Every time someone clicks "Sign in with Microsoft" on a third-party site, or connects an app to their mailbox or OneDrive, that app appears under Enterprise applications in the Microsoft Entra admin centre, along with the permissions it was granted.

Sort the list and look for anything you don't recognise, especially apps with permission to read mail, read all files, or act on the user's behalf when they're not signed in. Then check your user consent settings. In most small businesses we recommend requiring admin approval for new apps, with a simple request workflow so staff can still ask. Google Workspace has an equivalent under its API controls.

2. Look at the sign-in logs

Entra ID sign-in logs show which applications people sign in to with their work accounts and how often. An app with 40 sign-ins a week from one department is a tool someone depends on, and you want to know about it before you block it.

3. Use cloud discovery if your licences include it

Microsoft Defender for Cloud Apps can discover cloud apps from network traffic, including by integrating with Defender for Endpoint on Windows devices, so laptops are covered on and off the office network. It rates apps against a catalogue of more than 31,000 services and over 90 risk factors, such as where data is stored, encryption at rest and audit logging. Availability depends on your Microsoft 365 licences. Your firewall or DNS filter may provide a simpler version of the same view.

4. Inventory browser extensions

Browser extensions are the shadow IT nobody counts. A "free PDF tool" or "AI writing assistant" extension can often read every page you visit, including your email and online banking. Intune and Microsoft Edge for Business can report and control which extensions are installed. Allow-listing approved extensions is a good habit and fits with the Essential Eight's application control strategy.

5. Read the credit card statements

This is the lowest-tech method and one of the best. Pull 12 months of company card and expense claims and search for software subscriptions. At $15 to $40 a month, apps sail under every approval threshold. Five people each paying for their own design tool, transfer service or AI subscription adds up to a few thousand dollars a year, and often duplicates something you already pay for in Microsoft 365.

6. Just ask

Run a short, blame-free survey: "What apps or websites do you use for work that IT didn't give you?" Frame it as an amnesty. You'll learn things no log will show you, such as personal accounts used for work and tools used on personal phones, and you'll learn why people needed them, which is the most useful information of all.

What to do with what you find

Resist the urge to block everything on day one. A ban without an alternative just pushes the behaviour somewhere less visible. Sort each app into one of four buckets:

• Sanction: it's useful, the vendor is reputable and the data handling is acceptable. Bring it under proper management, with single sign-on through Entra ID where possible so access ends when employment does.
• Replace: the need is real but the app isn't suitable. Offer a sanctioned alternative. OneDrive and SharePoint links can replace most free file-transfer sites, and Microsoft 365 Copilot Chat with a work account offers data protections that a personal account on a free AI tool doesn't.
• Tolerate: low risk, no sensitive data, used by one or two people. Note it and move on.
• Block: high risk or no legitimate need. Revoke its consent, remove its access and, if necessary, block it at the firewall or endpoint.

For the apps you're keeping, run them through our checklist for vetting third-party apps.

And, well... one sceptical thought. You can lock everything down so tightly that no new app ever gets in. You can. But a business where nobody can try a new tool is a business that will, uh, quietly stop improving, or quietly start using personal phones instead. The goal is visibility and a fast yes, not a wall.

Keep it from coming back

Shadow IT discovery isn't a one-off project. Make it routine:

1. Write a short cloud and AI use policy listing approved tools and the data that must never go into unapproved ones.
2. Provide a quick way to request new apps, with an answer within days, not months.
3. Review consented apps and sign-in logs quarterly.
4. Remove app access as part of every offboarding.
5. Explain the "why" in staff awareness training, especially around AI tools.

A cyber security assessment is a good way to get a baseline: what's connected, what it can access and where the risks sit.

Frequently asked questions

How do I find out what cloud apps my employees are using?

Check Enterprise applications and sign-in logs in Microsoft Entra ID, use cloud discovery in Defender for Cloud Apps or your firewall if available, inventory browser extensions, review card and expense statements for subscriptions, and ask staff directly in a blame-free survey.

What is shadow IT?

Software, cloud services or devices used for work without the knowledge or approval of whoever manages IT. Common examples are free file-transfer sites, personal cloud storage, browser extensions and AI tools signed up for with a work email.

Is using AI tools at work shadow IT?

It is if the tool hasn't been approved, especially if staff paste business or client information into a free consumer service. Providing a sanctioned AI tool with a work account and a clear policy is the best way to reduce the risk.

Should I block all unapproved apps?

Not immediately. Find out what's in use and why, then sanction, replace, tolerate or block each one. Blocking without offering an alternative usually drives the behaviour onto personal devices where you can't see it.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Want to know what's really connected to your Microsoft 365? Book a review — we'll find the unsanctioned apps, assess the risks and help you clean up without slowing anyone down.