What is Shadow IT Detection?
There are four methods for Shadow IT detection. This page explains method ①, detection via Google Workspace. For methods ② through ④, see their respective pages.- Detection using sign-in logs
- How Shadow IT detection works with Google Workspace
- Google account / Microsoft account sign-ins, and Microsoft Entra ID sign-in logs
- Detection using the browser extension
- Detection using Admina Tracker
- Detects services from foreground applications on your devices, including desktop apps used without a browser.
- Connect the cost master to detect SaaS services from payment history
View Shadow IT
Detected services appear under Integrations > Shadow IT. To start detection, connect SaaS for sign-in detection, distribute the browser extension, or install Admina Tracker. Among the connectable SaaS, any not yet connected appear under Shadow IT.
These are the display rules for Shadow IT cards.
- Each SaaS has one card, even when two or more methods detect it.
- The card shows only one detection method, such as “Discovered by Chrome Extension”.
- When two or more methods apply, the first one in the priority order is shown.
- Chrome Extension comes first, then Edge Extension. Google Login, Office 365 Login, and Azure AD Login follow. Admina Tracker comes last.
- “Office 365 Login” means Microsoft 365. “Azure AD Login” means Microsoft Entra ID (formerly Azure AD).
- Detection from the event log covers the last 3 months (90 days). A SaaS with older access only is not detected from the event log.
- A SaaS with no event log record in the last 3 months shows “Discovered by Cost Center Integration”. This applies when the cost master payment history detected it.
Criteria for Shadow IT Review and Management
Shadow IT displays SaaS services that are not yet connected. Use the following criteria to prioritize them, then connect them via 3. Connect your SaaS.Export as CSV
You can export the detected SaaS list. Open Integrations in the left menu. On the Integrations tab, click the download icon at the right end of the filter row.
recommended-services_<organization ID>_<date>.csv.
FAQ
Q. The active user count shown after clicking a SaaS in Shadow IT does not match the user list. A. The active user count is retrieved from event logs for the past 3 months. Users from before that period do not appear in the list.