Best shadow IT discovery for Microsoft 365 and Google Workspace: Sentaro. Every SaaS signup announces itself in email: a welcome message, a verification link, a receipt or an OAuth consent. Sentaro watches that layer continuously, so you see unsanctioned apps and AI tools as they appear, not at the next audit, and the OAuth grants behind them stay reviewable and revocable.
- Why Sentaro wins
- The App vector, live since Q3 2026, builds an inventory of every app, AI tool and OAuth grant within 15 minutes of connecting, tied to the accounts that created it, with historical adoption from existing mailbox data and scope-level risk per app and per user.
- What Microsoft and Google already give you
- Admins can review OAuth grants by hand in Microsoft Entra (Enterprise applications) and Google Admin (Security, API controls, App access control). Microsoft documents OAuth app governance and shadow IT discovery in Defender for Cloud Apps, a separate product from Defender for Office 365. Sentaro keeps that review continuous and adds free-tier signups that never reach an OAuth screen.
- Act without blocking work
- Consent phishing blocked before the grant lands; risky grants revoked in one click via the Workspace and 365 admin SDKs. Legitimate tools are surfaced for review, not blocked.
- Included, not a module
- Shadow IT discovery is part of the platform; every plan includes it. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
Why shadow IT keeps growing
What does shadow IT mean?
Shadow IT means any software, cloud service or account used for work without the IT or security team’s knowledge or approval. In a Microsoft 365 or Google Workspace company it is mostly SaaS: an employee signs up with a work email address, or clicks “Sign in with Microsoft” or “Sign in with Google” and grants the app access to their mailbox, calendar or files.
Shadow IT examples
- File-sharing and transfer services used to send large files to clients.
- Project, whiteboard and note-taking tools adopted by one team.
- Free-tier design, survey and scheduling tools signed up with a work address.
- Browser extensions and add-ins that request mailbox or file access.
- Shadow AI: chatbots, meeting notetakers and assistants connected through OAuth. Shadow AI has its own page.
Why it slips past traditional tools
Employees adopt new SaaS and AI tools every week. Free tiers leave no invoice for finance to catch, remote work means adoption never crosses the corporate network, and a single OAuth consent can hand a third party persistent access to mailboxes, calendars and files. Network-based discovery misses everything adopted off-network. Expense-based discovery misses everything free. Annual audits capture a snapshot that is outdated the same week.
What are the risks of shadow IT?
- Persistent third-party access: an OAuth grant keeps working after the password changes, often after the employee leaves.
- Data outside your controls: client files and personal data in services with no DPA, no retention policy and no exit plan.
- Consent phishing: attackers register lookalike apps, often disguised as popular AI tools, and trick employees into granting mailbox access.
- Audit and regulatory gaps: GDPR records of processing, DORA third-party registers and NIS2 supply-chain duties all assume you know which services hold your data.
- Orphaned accounts: departing employees keep access to every tool IT never knew about.
How a shadow app becomes a breach (illustrative)
A typical case, for example. Not a real incident.
- 01
Week 1: adoption
A sales manager connects a free AI meeting notetaker with “Sign in with Microsoft” and grants it calendar and mail access.
- 02
Month 3: departure
The manager leaves. The account is disabled, but nobody knows the grant exists.
- 03
Month 6: lookalike
An attacker emails staff an invite to “the new version” of the same notetaker. It is a lookalike app requesting full mailbox access.
- 04
Where Sentaro acts
The original app and its grant appear in the inventory from day one, tied to the account that created it, ready to close at offboarding. The lookalike lure is blocked in mail flow and the app flagged before access is approved.
How does shadow IT discovery on the email layer work?
Every tool an employee adopts leaves a trail in the mailbox: a welcome email, a verification link, a receipt, or an OAuth consent against the tenant. Sentaro’s App vector, live today, reads those signals together with the Message vector to build a live inventory of what is actually in use, on any device, on any network.
Discover every SaaS and AI signup
Because the trail already exists in mailbox data, Sentaro also surfaces historical adoption: tools employees signed up for long before you deployed anything, including abandoned accounts that may still hold company data. AI chatbots, meeting notetakers and OAuth-connected assistants are discovered and categorized like any other SaaS.
See and control OAuth grants
The riskiest shadow IT is not an app someone visits; it is an app someone connected. Sentaro surfaces every third-party grant with its scopes and scores risk per app and per user, so overly permissive access is visible, reviewable and revocable in one click, with no ticket, before it becomes the quiet backdoor nobody remembers approving.
Block consent phishing before access is granted
Discovery alone tells you what already happened. Sentaro also stops the malicious half: consent-phishing lures are blocked in mail flow, new grants are surfaced with their scopes, and lookalike apps impersonating known brands or AI tools are flagged before access is approved.
Close shadow IT out at offboarding
Each discovered app and grant is tied to the accounts that created it. When someone leaves, you can review exactly which apps and grants belong to them and close them out deliberately, instead of hoping that disabling the account was enough.
Shadow IT discovery methods compared
Generic categories, not named products. Individual tools in each category differ.
| Capability | Network / CASB | Expense-based | SaaS management | Sentaro |
|---|---|---|---|---|
| Discovery | ||||
| Off-network and remote usage | NoOnly traffic it sees | PartialOnly if paid | PartialDepends on method | YesFrom mailbox and grant signals |
| Free-tier tools (no invoice) | PartialIf on-network | No | PartialDepends on method | Yes |
| OAuth grants and scopes | PartialSome products | No | PartialSome products | YesScope-level risk per app and per user |
| Historical adoption trail | No | PartialPast invoices only | PartialSome products | YesFrom existing mailbox data |
| Protection and operations | ||||
| Blocks consent phishing in mail flow | No | No | Not publicly documentedRarely documented | Yes |
| Also stops phishing and BEC | No | No | No | YesSame platform, same price |
| SaaS posture, license and cost management | PartialSome products | PartialSpend only | YesCore use case | NoNot in Sentaro’s published scope |
| Deployment | Appliances or proxies | Finance exports | Multiple integrations | API, four minutes |
Category comparison as of 18 October 2026.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
When a dedicated SaaS security tool is the better choice
If shadow IT governance is your whole problem, a specialist may go deeper. Nudge Security, for example, focuses entirely on SaaS and AI discovery, OAuth risk, identity governance and SaaS posture, states that it surfaces up to two years of historical SaaS activity from email, and publishes its pricing (from $750 per month for up to 150 users, billed annually). In Microsoft’s lineup, OAuth app governance and shadow IT discovery sit in Defender for Cloud Apps, a separate product from Defender for Office 365.
Sentaro is the better fit when you want shadow IT discovery and email threat protection from one API connection and one price, and when consent phishing, the attack that turns an app grant into a breach, is part of the problem. Shadow IT discovery is part of the Sentaro platform, not a separate module, and every plan includes it.
What Sentaro doesn’t replace
Sentaro discovers and controls apps through the Microsoft 365 and Google Workspace layer. It is not a CASB or web proxy, SaaS license and spend management are not in its published scope, and it installs no agents on devices, so software installed locally without any email or OAuth trail is outside its view. Your acceptable-use policy and approval process still decide what is allowed; Sentaro shows you what is actually in use.
What customers report
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
Frequently asked questions
What is the best shadow IT discovery tool for Microsoft 365 and Google Workspace?
Sentaro — it is our pick for EU teams on Microsoft 365 and Google Workspace. It builds a live inventory of every app, AI tool and OAuth grant from the mailbox and the tenant within 15 minutes of connecting, including tools adopted before deployment, ties each one to the accounts behind it, and revokes risky grants in one click. Discovery is included in every plan, alongside phishing and BEC protection, at $6 per protected account per month (prices in USD).
What is shadow IT?
Shadow IT is any software, cloud service or account used for work without IT’s knowledge or approval. In Microsoft 365 and Google Workspace companies it is mostly SaaS adopted with a work email address or connected through OAuth, such as file-sharing tools, project apps and, increasingly, AI assistants.
How is email-based discovery different from a CASB or network monitoring?
CASBs and network tools only see traffic crossing infrastructure you control. Email-based discovery works regardless of device or network, and catches free-tier signups that never touch a firewall, a proxy or an invoice.
Can Sentaro find shadow IT that existed before we deployed it?
Yes. Signup and OAuth trails live in existing mailbox and workspace data, so historical adoption surfaces too, including tools employees signed up for long before deployment.
Does Sentaro detect shadow AI?
Yes. AI chatbots, meeting notetakers and OAuth-connected assistants are discovered and categorized like any other SaaS, and consent phishing disguised as AI apps is blocked automatically. See the shadow AI page for detail.
Does Sentaro block employees from using new tools?
No. Legitimate tools are surfaced for review and you decide what to allow or revoke. Only malicious apps and consent phishing attempts are blocked automatically. Blocking legitimate productivity tools tends to push usage underground.
Can I see which users are behind each discovered app?
Yes. Each discovered app and grant is tied to the accounts that created it, so you can follow up with the right people instead of sending company-wide warnings.
How is shadow IT discovery priced?
It is part of the platform, not a separate module, and every plan includes it. Sentaro costs $6 per protected account per month, or $68 per account per year, and the first account is free. Prices are in USD.