Skip to main content

​
Overview

Some workspaces linked with Microsoft 365 or Microsoft Entra ID may stop Shadow IT detection. When this happens, the following message may appear.
This message appears when the linked environment lacks the license required to collect event logs. This page explains how to resume Shadow IT detection.

​
Prerequisites

Collecting event logs from Microsoft 365 or Microsoft Entra ID requires one of the following licenses. Without one of these licenses, the integration cannot retrieve data from the “Microsoft OAuth” source. As a result, Shadow IT detection stops. For details on licensing, see Microsoft Entra ID licensing (external site).
  • Microsoft Entra ID Premium P1 license, or
  • Microsoft Entra ID Premium P2 license

​
How to Resolve

  1. In the Microsoft 365 or Microsoft Entra ID admin center, check whether the account has a Premium P1 or P2 license.
  2. If it has one of these licenses, re-integrate the workspace.
  3. After re-integration completes, confirm that Shadow IT detection resumes.

​
Notes

  • If the account is linked without one of these licenses, assign the license first, then re-integrate.
  • After re-integration, it can take a few hours for Shadow IT detection results to appear.
  • If the same message appears for multiple workspaces, re-integrate each workspace individually.
Last modified on July 23, 2026