Examples of shadow IT
- A team signs up for a project tool with their work email.
- Someone connects a note-taking app to the company calendar through an OAuth grant.
- A developer adds a browser extension that reads every page they open.
- A manager pastes customer data into an AI assistant nobody reviewed.
Why does shadow IT matter for identity security?
Each unapproved app is a set of accounts your identity provider may never see. Leavers keep those accounts. OAuth grants give the app access to mail, files or calendars, often with broad scopes.
AI tools have made the gap wider. In UpGuard's 2025 research, 81% of employees and 88% of security leaders said they use AI tools nobody approved.
How do you find shadow IT?
- Sign-in logs. Apps that use single sign-on show up when people sign in.
- OAuth grants. Your identity provider records which apps people let into their account.
- Email metadata. Sign-up confirmations and invoices name the service, even when it never touches SSO.
- A browser extension. It sees the sites people sign in to directly, with a password.
Then decide for each app: approve it and give it an owner, replace it with a tool you already pay for, or block it.
Frequently asked questions
Is shadow IT always a problem?
No. It often shows a real need that the approved tools do not meet. The risk is the data and access nobody controls, and the accounts that stay open after people leave.
What is shadow AI?
Shadow AI is the same pattern with AI tools. People sign up for assistants, extensions and agents, then connect them to company data without approval.
How do you stop shadow IT?
You cannot stop every sign-up. Find the apps, decide for each one whether to approve, replace or block it, and give every approved app an owner.