How to Find and Audit Shadow IT Tenants in Microsoft Entra ID

Discover how to identify, track, and secure forgotten Microsoft Entra shadow IT tenants that your organization created unintentionally. This guide explores the automated discovery signals, related tenant analysis, and governance steps needed to map unmanaged cloud environments and bring them under central control.

The Hidden Risk of Shadow IT Tenants

There is a risk hiding in almost every large Microsoft 365 setup that rarely gets discussed during standard security reviews. Companies often assume their cloud footprint is neatly bounded by a single directory. In reality, organizations quietly end up owning several Microsoft Entra tenants without ever planning for it. When departments, individual employees, or external project teams spin up a quick pilot, a product demo, or a testing environment using a corporate credit card, a brand-new tenant is born.

Microsoft classifies these isolated environments as shadow IT tenants because central IT does not administer them and frequently has no idea they exist. While security teams spend millions defending the front door against outside attackers, stolen passwords, and sophisticated phishing campaigns, a side entrance might be standing wide open via a forgotten test tenant created two years ago. An attacker does not need to break through heavily monitored defenses when an unpatched, unmonitored shadow tenant has been running in the background with zero administrative oversight.

The danger is not just theoretical. A tenant that nobody administers can easily be misconfigured, exposing sensitive company data to unauthorized parties. Because these environments sit outside standard provisioning and auditing processes, they will never show up in your quarterly access reviews. When an external auditor asks who can access a specific set of corporate files, a shrug will not satisfy regulatory requirements. You can only secure what you can see, and right now, your asset inventory is likely incomplete.

How Microsoft Entra Surfaces Forgotten Tenants

Fortunately, Microsoft provides built-in mechanisms to locate these hidden environments by analyzing connection signals that your ecosystem has been generating all along. This capability relies on discovering related tenants rather than forcing administrators to manually compile an impossible list of every digital asset ever registered by employees.

Business-to-Business Activity Signals

The first major signal used for tenant discovery is business-to-business (B2B) activity. Microsoft Entra continuously scans for guest sign-ins, external guest registrations, and administrative access flows traveling back and forth between your primary directory and external environments. If users in your organization are actively collaborating with an unknown tenant, that cross-pollination registers as a measurable connection.

Multi-Tenant Application Registrations

Modern cloud architectures rely heavily on applications that span organizational boundaries. The second discovery signal tracks multi-tenant app registrations. This includes custom or commercial applications registered in your primary tenant that reach into external directories, as well as third-party apps from outside tenants that hold active permissions and API tokens inside your own environment. These programmatic bridges leave a clear audit trail.

Shared Billing Accounts

Perhaps the most surprising discovery vector is billing. Two separate Microsoft Entra tenants can be structurally connected for no reason other than a shared Azure billing account or enterprise agreement structure. No one has to send an invitation, and no user has to manually sign in across boundaries. If an unmanaged tenant is paying for Azure services through your enterprise billing profile, or vice versa, the connection is instantly visible to the governance framework.

Bringing Unmanaged Tenants Under Central Governance

Once discovery surfaces a list of related tenants, administrators must decide which environments to keep, which to sunset, and how to govern the survivors. Instead of undergoing a disruptive, multi-year tenant migration project, organizations can establish a formal governance relationship.

A governance relationship is a directional link where one parent tenant governs, and the subsidiary tenant is governed. Crucially, this is not a full technical merger; the governed tenant retains its own users, data, and localized workloads. Setting this up involves a secure three-step handshake:

• The tenant that needs to be governed sends an administrative invitation to the parent tenant.
• The parent tenant responds with a request containing a specific policy template outlining allowable administrative permissions.
• The child tenant reviews and accepts the policy template, bringing the secure management link live.

This structure allows IT administrators to manage multiple environments from a single pane of glass using accounts in the governing tenant. It eliminates the security nightmare of maintaining separate, disconnected administrator credentials across dozens of individual tenant portals.

Monitoring and Securing Your Multi-Tenant Ecosystem

Discovery and governance relationships are only the beginning. To ensure shadow IT does not creep back into your organization, you must implement active configuration monitoring and secure creation controls.

Configuration monitoring allows administrators to define a baseline of expected settings and take a continuous snapshot of their actual cloud environment. An automated monitor compares the two every six hours across more than 200 resource types spanning Microsoft Entra, Microsoft Intune, Exchange Online, Microsoft Teams, Microsoft Purview, and Microsoft Defender. If drift occurs, security teams are alerted immediately.

Additionally, secure tenant creation controls allow organizations to restrict who is permitted to spin up a new Microsoft Entra tenant in the first place. Any newly approved tenant can be automatically bound to a governance relationship at birth, ensuring that no new cloud environment ever starts its lifecycle completely unmanaged.

Conclusion

Unmanaged shadow IT tenants represent a silent threat to corporate security, data privacy, and compliance posture. By leveraging Microsoft Entra's built-in discovery signals, establishing formal governance relationships, and enforcing continuous configuration monitoring, IT leaders can finally gain total visibility over their organization's sprawling cloud footprint. To dive deeper into this topic and hear expert insights on modern cloud administration, make sure to Listen to the full episode of the M365 FM Podcast.