Netskope holds a narrow lead over Microsoft Defender for Cloud Apps for real-time visibility across sanctioned and unsanctioned cloud traffic. When buyers look specifically for a cloud access security broker, Microsoft emerges as the usual answer.
How to detect shadow IT in your cloud infrastructure
Shadow IT is the use of cloud services, applications, infrastructure, or accounts that your organization hasn't approved or properly inventoried. Examples include employees creating personal cloud storage accounts, developers deploying workloads in unapproved regions, forgotten test environments, and SaaS applications connected to corporate identity systems without security review.
The most effective approach is to reconcile what you can observe across your cloud, identity, network, endpoint, and SaaS environments against what your organization has authorized. Don't rely on a single cloud inventory or security scanner: each sees a different part of the problem.
1. Where to look for unauthorized services
Cloud control planes
Find unapproved virtual machines, containers, Kubernetes clusters, databases, storage buckets, serverless functions, public IPs, and resources deployed in unexpected regions or subscriptions.
Sources: AWS Organizations and CloudTrail; Azure Resource Graph and Activity Logs; Google Cloud Asset Inventory and Cloud Audit Logs.
Identity and SaaS
Look for unknown OAuth applications, third-party integrations, unmanaged service accounts, suspicious API keys, newly registered applications, and users authenticating to unapproved SaaS providers.
Sources: IdP sign-in logs, OAuth consent logs, SaaS audit logs, and cloud IAM inventories.
Network and endpoint telemetry
Identify recurring traffic to unknown cloud providers, newly observed domains, personal file-sharing platforms, unauthorized tunnels, and endpoints using unsanctioned developer tools.
Sources: DNS logs, secure web gateways, firewalls, EDR, CASB, and cloud flow logs.
Billing and procurement
Search for unexpected cloud subscriptions, marketplace purchases, new vendor charges, unrecognized API usage, and resources billed to unfamiliar cost centers.
Here is a repeatable process for an initial audit, followed by continuous monitoring.
Step 1 — Establish your authorized baseline
Export every cloud account, tenant, subscription, project, region, resource, identity, and approved SaaS application. Include business owners, environments, and approved deployment methods.
Step 2 — Discover actual usage
Query cloud APIs for deployed assets, ingest audit logs, and analyze DNS, proxy, endpoint, and identity telemetry. Collect data across all accounts, not just the primary production environment.
Step 3 — Reconcile and flag discrepancies
Compare discovered resources and services against your approved inventory. Flag unknown account IDs, unapproved regions, missing owners, unfamiliar SaaS domains, and deployments outside your approved infrastructure-as-code pipelines.
Step 4 — Investigate and prioritize
Identify who created or used the service, when it appeared, what data it can access, whether it is publicly exposed, and whether credentials or sensitive information may be at risk.
Step 5 — Automate detection
Send findings to your SIEM or cloud security platform. Alert on new unapproved services, unusual data transfers, risky permissions, and resource changes. Repeat inventory reconciliation on a schedule.
3. Use the right tools for each cloud
Environment
Inventory and audit sources
Useful detections
AWS
AWS Organizations, AWS Config, CloudTrail
New accounts, unapproved regions, unusual resource creation
Microsoft Azure
Azure Resource Graph, , Entra ID
For example, Google Cloud Asset Inventory supports searching and exporting asset metadata and monitoring changes, while Cloud Audit Logs helps establish who did what, where, and when.
For SaaS discovery, Microsoft's Shadow IT discovery guide describes analyzing network and endpoint telemetry, evaluating app risk, and setting up ongoing alerts.
4. Define detection rules that catch real risks
Start with these rules and tune them to your environment.
Detection rule
Priority
New cloud account or project without an approved owner
High
Public database or storage bucket containing sensitive data
Critical
New privileged identity, access key, or OAuth grant
High–Critical
Resource deployed in a prohibited region
High
New SaaS service receiving sensitive company data
High
Unexpected bulk download or upload to an unfamiliar service
High
Treat these as investigation triggers, not proof of malicious activity. An unfamiliar service may be a legitimate business tool that hasn't been registered yet.
5. Build a shadow IT findings register
For each discovery, record enough information to support an audit and remediation.
Audit record checklist of
[Copy blank audit template]
Important: Don't immediately delete every unknown resource. First preserve relevant logs, identify the owner, assess dependencies, and determine whether it is compromised or simply unapproved. For confirmed threats, contain access and exposure using your incident-response procedures.
6. A practical 30-day rollout
Days 1–7
Establish visibility
Inventory cloud accounts and resources, enable the relevant audit logs, and collect SaaS/network discovery data.
If shadow IT visibility is the primary requirement, these CASB options are worth evaluating:
Microsoft Defender for Cloud Apps — discovers cloud apps, identifies users/devices using them, assesses risk, and supports policies for newly discovered or unsanctioned apps.
Netskope One CASB — provides visibility into managed and unmanaged cloud applications, including shadow IT and shadow AI.
Zscaler CASB — discovers shadow IT/risky apps and provides reporting plus controls for sanctioned and unsanctioned applications.
Skyhigh Security CASB — specifically offers Shadow IT discovery, usage dashboards, risk reporting, and granular cloud-app controls.
If you already use Microsoft security tooling, Defender for Cloud Apps is particularly worth evaluating because its discovery can integrate with Defender for Endpoint and analyze cloud-app traffic.
Top options specializing in shadow IT discovery and risk scoring include:
: Widely regarded as an anchor in this space. It maps out thousands of cloud applications, scores them dynamically based on over 50 risk criteria (compliance, data privacy, security posture), and tracks data flows and real-time usage.[]()
Azure Activity Logs
Microsoft
Unknown subscriptions, app registrations, suspicious role assignments
Google Cloud
Cloud Asset Inventory, Cloud Audit Logs, Cloud IAM
Unapproved projects, new resources, unexpected IAM changes
SaaS across providers
Microsoft Defender for Cloud Apps or another CASB/SSE platform; IdP and proxy logs
Unsanctioned apps, OAuth grants, anomalous usage, high-risk data transfers
Unowned resources or services with unexpected recurring costs
Medium
New test environment outside approved deployment pipelines
Microsoft Defender for Cloud Apps : An enterprise-grade native CASB that deeply integrates with Microsoft Entra ID and endpoint telemetry. It is exceptionally strong at discovering shadow IT, assessing risk exposure, and spotting anomalous behavior within a Microsoft-centric ecosystem.[](https://theodosian.com/blog/best-shadow-it-solutions-in-2026-security-buyers-guide)
