Detect Shadow IT in Microsoft 365

Your tenant likely has unknown apps, risky OAuth scopes, and guest-installed connectors. Use Microsoft-native tools (Defender/Cloud App Security, Entra ID logs, Shadow IT discovery) to discover, then apply app consent policies, Conditional Access, DLP, and approval workflows to control—and adopt a quarterly review loop to keep it clean.

🚨 What Chaos Looks Like

• Surprise Teams bots and Power Automate connectors tied to personal services

• Over-shared SharePoint links (“anyone can view”) and unknown external guests

• Broad OAuth scopes (e.g., Read all mailboxes) granted by well-meaning users

• Orphaned apps owned by ex-employees still syncing sensitive data

🔎 The Hunt: Native Tools That Surface Shadow IT

• Microsoft Defender for Cloud Apps (MCAS) Shadow IT discovery: traffic, app risk scores, usage trends

• Entra ID (Azure AD) Sign-in & Audit logs: who consented, when, from where, to what scopes

• Enterprise Apps → Permissions: enumerate admin-consented and user-consented apps

• Power Platform Admin Center: unmanaged Power Automate connectors & flows

• SharePoint/OneDrive reports: anonymous links, external sharing hotspots

Pro tip: Start with apps requesting tenant-wide scopes (Mail.Read, Files.Read.All, Sites.Read.All, offline_access) and apps installed by guests.

🧱 Draw the Line (Without Breaking Workflows)

• App Consent Policies

  • Block user consent by default; allow only verified publishers and low-impact scopes

  • Route higher-risk requests to an IT approval workflow (ServiceNow/Power Automate)

• Conditional Access for Apps

  • Require MFA, compliant devices, and trusted locations for risky app access

  • Block legacy/unsupported client types; exclude meeting rooms/service accounts appropriately

• Govern Power Platform

  • Data Loss Prevention (DLP) policies: split Business vs Non-Business connectors

  • Turn on solution-aware flows; restrict custom connectors

• External Sharing Guardrails

  • Default to people in your org; require expiry for guest links; sponsor model for guests

🛠️ One-Week Remediation Sprint (Practical Playbook)

Day 1–2: Discovery

• Pull MCAS Shadow IT report & Entra ID app permissions export

• Flag admin-consented apps + tenant-wide scopes + guest-owned apps

Day 3: Contain

• Set User consent = Disabled (or verified publishers, low-risk only)

• Create Conditional Access (per-app): MFA + compliant device for risky scopes

Day 4: Clean

• Revoke unused/orphaned apps; contact owners for critical flows; migrate if needed

• Tighten SharePoint external sharing & link expiry defaults

Day 5: Govern

• Roll out request/approval workflow for new apps

• Publish allowed app catalog + “request an exception” form

Day 6–7: Monitor & Communicate

• Turn on anomaly alerts (new high-risk consent, unusual sign-ins)

• Send a friendly “How to request an app” guide; list blocked behaviors & alternatives

🧪 Policy Templates (Quick Starts)

• App Consent Policy:

  • Allow: Verified publisher + scopes in baseline list (openid, profile, email, offline_access only)

  • Require approval: Any Mail.Read*, Files.Read*, Sites.Read*, Chat.Read*, Calendars.ReadWrite, Directory.Read.All

  • Deny: Mail.ReadWrite, Files.ReadWrite.All, full_access_as_app

• Conditional Access (per-app):

  • Target cloud apps = risky OAuth app

  • Grant = MFA + compliant device; Block from high-risk sign-ins / unknown countries

📊 KPIs That Prove It’s Working

• Shadow apps discovered → sanctioned/blocked ratio (target: >80% resolved in 30 days)

• New user-consented apps per month (target: near zero; all via workflow)

• High-risk scopes granted (target: 0)

• External sharing with “anyone” links (target: -90% in 60 days)

• Incidents tied to third-party apps (target: -40% QoQ)

🧾 Review Cadence (Keep It Clean)

• Monthly: New consents, high-risk scopes, orphaned owners, guest app installs

• Quarterly: DLP policy drift, Power Platform environment audit, external sharing report

• After Org Changes: Reassign app ownership; re-validate app purpose & scopes

🧯 Fast Troubleshooting Map

• “Where did this app come from?” → Entra ID > Enterprise Apps > Audit logs (ConsentGranted)

• “Why did mail suddenly leak?” → Check app scopes for Mail.* + audit MailItemsAccessed

• “Guest connected a tool?” → Filter apps by Owner = Guest; revoke & sponsor request path

• “Flow hitting personal services?” → DLP policy catching Non-Business connector; migrate or sanction

🧠 Change Management That Users Don’t Hate

• Publish an App Catalog (approved tools + data boundaries)

• Offer secure alternatives before blocking popular apps

• Keep a 1-page request guide (what info to provide; expected SLA)

• Celebrate “sanctioned wins” (e.g., replacing a risky connector with a secure, supported one)

✅ Executive Takeaways

• Shadow IT is inevitable; unmanaged risk is optional

• Use built-in Microsoft tooling for 80% of discovery & control

• Workflow > wall: approvals keep productivity up while cutting risk

• Track a few KPIs and show quarter-over-quarter risk reduction