SaaS sprawl and shadow IT: finding the apps nobody approved

How it happens

It starts innocently. A project manager needs to share a large file with a client and uses a free transfer site. A marketing coordinator signs up for a design tool with her work email. Sales staff start using a scheduling link app so prospects can book meetings. Someone finds an AI note-taker that joins video calls. Each choice solves a real problem, and each one creates an account holding company or client data that nobody else knows exists.

Over a couple of years a ten-person business can end up with dozens of these accounts. Some are on personal cards and claimed as expenses, some are free, and some were set up by people who have since left, still holding documents, contact lists or meeting recordings. Nobody planned this; it simply grew one helpful sign-up at a time, which is why it rarely shows up until someone goes looking.

Why it matters

The first risk is data you cannot control. If a staff member leaves, their personal account on a free file-sharing tool may still contain client contracts, and you have no way to recover or delete them. Under the Privacy Act 2020 your business is still responsible for personal information it collected, wherever staff happened to store it.

The second risk is security. Many of these apps are signed into with a simple password, often reused from elsewhere, without multi-factor sign-in. Some request broad access to mailboxes or files when connected to Microsoft 365 or Google Workspace. The third risk is cost and duplication, with several tools doing the same job and nobody able to say which is the official one.

Finding what is in use

Start by asking. A short, non-judgemental survey asking staff which apps and websites they use for work, and why, will reveal more than any technical tool, provided people believe they will not be told off. Combine that with a review of card statements and expense claims for software charges. Then check the technical side. In Microsoft 365 and Google Workspace, an administrator can see which third-party apps users have granted access to their accounts, and remove ones that are risky. Some security tools and firewalls can report which cloud services the office network connects to. Password managers used across the business also show which sites staff log in to.

Sort apps into keep, replace and stop

For each app found, decide whether it is useful enough to make official, whether a tool you already pay for can do the same job, or whether it should stop. Many file transfer and note-taking needs are already covered by Microsoft 365 or Google Workspace, once staff know how to use those features.

Apps you keep should move to a company-owned account with a business email, named owner, multi-factor sign-in and, where possible, single sign-on through your main directory. That way access is removed automatically when someone leaves. For apps you stop, ask staff to export or move anything important first, then close the accounts properly instead of just abandoning them.

Make the approved path the easy path

Shadow IT grows when the official route is slow or unclear. Publish a short list of approved tools for common jobs, such as file sharing, e-signatures, scheduling and video calls, and explain which to use when. Set up a simple request process for anything new, with a fast turnaround, and a few basic questions: what data will it hold, who will use it, and does it support company accounts and multi-factor sign-in. Saying yes to a well-chosen tool and setting it up properly is better than saying no and having people use it anyway on a personal account. The goal is visibility, not control for its own sake.

Keep it from growing back

Fold the app list into onboarding and offboarding. New starters get access to the approved tools on their first day so they do not go looking for alternatives, and leavers have every app account removed or transferred. Restrict the ability of ordinary users to approve third-party apps that request broad access to company data, so such requests come to an administrator first. Review the list every few months alongside your subscription register. New tools will always appear, especially AI products, and that is fine as long as someone knows and they hold data safely.

It also helps to explain the reasons to staff rather than issuing a rule. Most people readily understand that a client contract sitting in a forgotten personal account is a problem for the business and for them. When they see the request process as a way to get good tools set up properly, rather than a hurdle, they start bringing new ideas forward instead of hiding them.