Shadow IT means the apps, accounts and services people use for work without IT knowing or approving them. Examples include a free file-sharing site, a personal cloud drive, a project tool someone signed up for with their work email, or an app connected to their work mailbox in two clicks.
Shadow IT is rarely malicious. Someone needs to get a job done, finds a tool that works, and starts using it. The problem is that nobody else knows the tool exists, what data is in it, or who can reach it. And it’s growing. Gartner predicts that by 2027, 75% of employees will acquire, modify or create technology outside IT’s visibility, up from 41% in 2022.
This post explains what shadow IT looks like today, why connected apps are the part that matters most, how it differs from shadow AI, and how to find and fix it without banning every new tool.
What shadow IT looks like in a modern business
In a business that runs on Microsoft 365 or Google Workspace, shadow IT usually shows up in five forms:
- Free and personal cloud storage. Work files in a personal Dropbox, Google Drive or WeTransfer link because it was easier than asking for access.
- Sign-ups with a work email. Project boards, survey tools, design apps and CRMs that someone joined on a free plan, outside any purchase process.
- Apps connected to company accounts. “Sign in with Microsoft” or “Sign in with Google” buttons, and add-ins that ask for access to mail, files or calendars. This is the riskiest form, and the least visible.
- Browser extensions. Extensions that read every page, including web mail and the admin portal.
- AI tools. Chatbots, meeting note-takers and AI assistants. This is shadow AI, the newest and fastest-growing kind of shadow IT.
Why connected apps are the real risk
A free tool someone signed up for is a data problem. An app connected to a company account is an access problem.
When someone clicks “Accept” on an app’s consent screen, they give that app an OAuth grant: lasting permission to read, and sometimes change, their mail, files or calendar. That grant keeps working when they close the tab. It usually keeps working when they leave the company. And it works even if their password changes, because the app holds its own token.
That’s why attackers like connected apps. In August 2025, Google’s Threat Intelligence Group reported that attackers used stolen OAuth tokens from the Salesloft Drift integration to export data from many companies’ Salesforce instances, and used Drift’s email tokens to read mail in a small number of Google Workspace accounts. The core platforms weren’t broken. The access came through a connected app.
Most shadow IT grants are much smaller than that. But every one of them is a door that nobody is watching.
The risks of shadow IT
- Data in places you can’t see. Client lists, contracts and payroll files in tools nobody reviews, under contracts nobody read.
- Access that outlives the person. Leavers’ accounts get closed, but their personal sign-ups and the grants they approved often don’t.
- Account takeover spreads further. When an attacker takes over one account, every app connected to it is in reach too.
- Consent phishing. A fake “approve this app” email can give an attacker’s app access to a mailbox without ever stealing a password.
- No off switch. When something goes wrong, nobody knows which tool holds the data or how to cut it off.
- Surprise costs. Free tools become paid tools, often on someone’s personal card.
Shadow IT vs shadow AI
Shadow AI is shadow IT with one important difference: the tools are built for people to paste data into.
| Shadow IT | Shadow AI | |
|---|---|---|
| What it is | Any app or service used without IT approval | AI tools and agents used without IT approval |
| Typical examples | Personal cloud drives, free project tools, connected apps | Chatbots on personal accounts, note-takers, AI browser extensions, AI agents |
| How data leaves | Files uploaded or synced | Text and files pasted into prompts, meetings recorded, mailboxes read |
| Main risk | Unseen data and lasting access | The same, plus sensitive data shared in every prompt |
| How fast it grows | Steadily | Very fast |
The numbers on shadow AI are striking. Verizon’s 2026 Data Breach Investigations Report found 67% of users accessing AI services on corporate devices were using non-corporate accounts. Read shadow AI detection for how to find it.
A worked example: one leaver, six apps
Here’s an illustrative example.
A 35-person marketing agency’s account manager resigns. IT closes her Microsoft 365 account on her last day, as usual.
Three months later, the MSP runs a check of connected apps and finds six that she approved. Two are still in use by her old team. Three haven’t been used since she left: a PDF converter with full access to mail, a scheduling tool with access to every calendar she could see, and an AI note-taker that joined client calls. The sixth is a file-sharing app still holding a public link to a folder of client contracts.
None of these were attacks. All of them were open doors. The MSP revokes the four unused grants, removes the public link, moves the two useful apps to named owners, and adds a rule to check connected apps as part of every leaver process.
How to find shadow IT
You can find most of it with five checks:
- Review app consents in Microsoft Entra ID and the Google Workspace admin console. List every app with access to mail, files or calendars, who approved it, and when it was last used.
- Look for broad permissions. Apps that can read every mailbox, every file, or the whole directory deserve the first look.
- Check sign-ups with work emails. Expense reports and finance records often show paid tools IT never heard of.
- Check browser extensions on managed browsers.
- Ask people. A short, blame-free survey of the tools each team uses will turn up things no log shows.
Checklist: getting shadow IT under control
- Every app with access to mail, files or calendars is on one list.
- Each app has a named owner and a reason it’s needed.
- Apps with broad access, or unused for 90 days, are reviewed or removed.
- Staff can’t approve apps that ask for high-risk permissions without a check.
- Leavers’ connected apps and sign-ups are reviewed before the account closes.
- There’s a simple, quick way to request a new tool.
- Approved tools, including AI tools, are listed where staff can find them.
- Connected apps are reviewed again every 90 days.
The quick request process matters more than it looks. People turn to shadow IT when the approved route is slow. Make the safe path the easy path.
How Centeye helps
- Centeye Lumen is the AI governance and registry platform. It lists every AI app connected to mail, files or calendars and what each grant allows, puts each one in a register with an owner and a 90-day re-approval, and can revoke a specific grant at the setting you choose. Every revoke can be undone.
- Centeye Gatewatch lists every app and service account with access to mail, files or the directory and who approved it, flags risky app consent, and puts the grant up for review or revocation.
For MSPs, both work across every client tenant from one console.
Frequently asked questions
What is shadow IT, in simple terms?
Any app, account or service used for work that IT doesn’t know about or hasn’t approved.
Is shadow IT always bad?
No. It often shows where the approved tools fall short. The goal isn’t to ban it but to see it, decide what to keep, give each kept tool an owner, and remove the rest.
What’s the difference between shadow IT and shadow AI?
Shadow AI is the AI part of shadow IT: chatbots, note-takers, AI assistants and agents used without approval. It carries extra risk because people paste sensitive data straight into the tools.
How do I find apps connected to Microsoft 365?
Check Enterprise applications and user consents in Microsoft Entra ID. For Google Workspace, check the third-party app access list in the admin console. Look at what each app can reach and who approved it.
Should we block users from approving apps?
For high-risk permissions, yes: require an admin check. For low-risk apps, a fast request process usually works better than a hard block, because a hard block pushes people towards personal accounts instead.
New to the terms? See shadow IT, shadow AI and OAuth grant in our glossary. Want to see the apps connected to your tenant? Start a free trial.
Forecast cited from Gartner’s research for CISOs. Shadow AI figure from the Verizon 2026 Data Breach Investigations Report. Salesloft Drift incident as reported by Google Threat Intelligence Group, August 2025. The worked example is illustrative.