This article is based on reporting originally published by TechRepublic, featuring commentary from Niv Goldenberg, principal group PM manager for cloud security at Microsoft.
Shadow IT Has Grown Up
Shadow IT used to mean a developer writing unofficial Excel macros or a team spinning up a file server without telling IT. Today the problem is orders of magnitude larger. Employees routinely expense AWS subscriptions, sign up for Salesforce sandboxes on personal cards, or share sensitive documents with external partners over Dropbox—none of it provisioned or visible to the IT department. According to figures cited in the original TechRepublic report, the average enterprise has more than 1,500 cloud apps in active use, the majority never provisioned by IT, and uploads more than 80 GB of data per month to external cloud services.
Traditional detection approaches—scanning network traffic, parsing firewall logs, or using SaaS spend-management tools to find subscriptions in financial systems—are cumbersome and have a critical blind spot: remote workers. If a user is not on the corporate network, network-based controls simply do not see them. Forcing all traffic through a VPN solves the visibility problem but creates performance and user-experience problems that are hard to sustain.
The Integration: Microsoft Cloud App Security + Defender ATP
Microsoft’s answer is to move detection and enforcement to the endpoint itself. Microsoft Cloud App Security (MCAS)—a Cloud Access Security Broker (CASB) delivered as a cloud service—includes a shadow IT discovery capability that integrates directly with Microsoft Defender Advanced Threat Protection (Defender ATP).
Because Defender ATP already monitors running processes, file access, and network connections as part of its malware-detection work, it can simultaneously report which cloud services each managed device is communicating with. That telemetry feeds into MCAS automatically, building a continuously updated catalogue of cloud apps in use—tagged by user, device, and assessed against security and compliance risk scores—without any additional agents or network taps.
Key outcomes of the integration:
- Discovery without network dependency: Because enforcement happens on the device via the Defender agent, it works for remote and mobile users, not just those sitting behind the corporate firewall.
- Block or allow at the device level: Admins can whitelist approved apps or block risky ones directly through the MCAS portal; the policy is pushed to the endpoint rather than enforced at the network perimeter.
- Read-only access for external users: The integration can enforce read-only access to corporate resources for suppliers and partners—even if those users are on unmanaged devices outside the network.
Data Classification Awareness with Azure Information Protection
Defender ATP can read sensitivity labels applied by Azure Information Protection (AIP). This means MCAS can raise an alert in real time when a file labelled Confidential or Sensitive is uploaded to an unsanctioned cloud service, or when a labelled file is downloaded and stored locally on a device.
Crucially, the telemetry is stored for six months in the customer’s cloud tenant. Goldenberg likens this to a flight recorder: even if a device is no longer online or physically available, investigators can audit which files were accessed, by whom, and what happened to the data—providing an additional forensic layer even for approved cloud applications.
Cloud App Reputation and Risk Scoring
Knowing which apps employees use is only part of the picture. MCAS assigns each discovered app a security and compliance risk score built from multiple factors, including:
- Whether the service uses TLS and secure HTTP connections
- Patching frequency and vulnerability history
- Data usage and data-sharing policies in the service’s terms of service
- Corporate ownership and regulatory compliance posture (e.g., GDPR, CCPA)
- How data is stored and whether it is encrypted at rest
Microsoft’s security researchers monitor new vulnerabilities and compliance regulations to keep scores current. Because MCAS is itself a cloud service, it can detect new URLs and IP ranges being accessed across its entire customer base and determine whether they represent a new application, a new signature for an existing one, or something else entirely. Software vendors can submit their applications for evaluation, and individual customers can request that Microsoft assess and score a specific service; according to the original reporting, both processes typically complete within two business days.
Admins can filter the app catalogue by category, risk score range, or specific risk factors, and drill down to understand exactly why an app received its score.
Dashboards, Drill-Down, and Power BI Reporting
The MCAS dashboard surfaces:
- The full catalogue of discovered cloud apps, with usage volume and user counts
- The ratio of sanctioned to unsanctioned app usage
- Alerts when vulnerabilities are found in apps your employees are actively using
- Per-user, per-device, and per-IP breakdowns of upload and download traffic
Because Defender telemetry is integrated, admins can pivot from a high-level view of risky traffic directly to the specific machine generating it. Unusual patterns—such as a user behaving differently on different devices—can surface both genuine security concerns and practical problems like a sanctioned app performing poorly on older hardware, pushing employees toward workarounds.
Usage data can also be exported to Power BI for richer visualisation and trend analysis. Importantly, data can be anonymised so that reports shared with department managers show application and volume trends without identifying individual users or devices. De-anonymisation requires a documented business justification and is itself audited—a control designed to satisfy employee privacy requirements and local data-protection regulations.
Governing Shadow IT: Beyond the Block List
A pure block-and-deny approach to shadow IT is, as Goldenberg puts it, an unending game of whack-a-mole. Block one file-sharing service and employees find another. The more effective strategy is to understand why employees are reaching for unsanctioned apps and address the underlying need.
Common reasons employees turn to shadow IT include:
- Unmet business needs: No good way to share large files internally drives people to WeTransfer or similar services.
- Productivity shortcuts: Online PDF converters are faster than approved tools—but users rarely read the terms of service, which may grant the provider rights to use uploaded content.
- Presentation quality: Employees seeking better outputs than approved tools provide may turn to online design tools that inadvertently expose business content.
MCAS supports a graduated governance model rather than a binary block/allow switch:
- Monitor only: Track usage without intervening—useful while an app is under legal or technical review.
- Warn: Show users a risk warning but allow them to proceed. Users acknowledge that the app is not recommended before continuing.
- Break-glass override: Users can confirm they have a business reason to use a non-recommended app and gain temporary access. Future roadmap items (at the time of original reporting) include requiring a written justification or manager approval before access is granted, as well as time-limited access grants.
- Block: Prevent access entirely via device-level enforcement.
- Redirect: Send users to a company portal listing approved alternatives.
Governance is also an ongoing lifecycle activity. MCAS can track whether a newly purchased application is actually being adopted, or whether usage of a deprecated tool is declining after standardisation on a replacement. Admins can generate PDF reports for department managers showing how many cloud apps their teams are using and how much data flows through them—shifting the conversation from IT policy enforcement to business-unit accountability.
Platform Support and Ecosystem Expansion
At the time of the original reporting (early 2020), the shadow IT discovery tool supported endpoints running Windows 10 version 1709 and later (with an optional update required for versions prior to 1903). Because the capability relies on the Defender ATP agent—which Microsoft had already brought to macOS—Mac support was described as on the roadmap.
MCAS was also beginning to apply the same risk-assessment framework to application marketplaces. At that time, all applications in the Microsoft Teams marketplace were being rated, with plans to extend coverage to other Microsoft ecosystems including Office 365 add-ins, Dynamics partner applications, and potentially browser extensions for the new Chromium-based Edge. This matters because add-ons and plugins receive OAuth permissions to data within the customer’s tenant—the same governance questions apply as they do to standalone SaaS apps.
Key Takeaways for Security and DevOps Teams
- Shadow IT discovery at the endpoint removes the blind spot created by remote and mobile workers operating outside the corporate network.
- Combining MCAS risk scores with Defender ATP telemetry gives both breadth (what apps exist) and depth (who uses them, on which devices, at what volume).
- AIP label awareness adds a data-classification layer, enabling alerts when sensitive content leaves the organisation through unsanctioned channels.
- The six-month audit trail stored in the cloud tenant supports forensic investigation even when devices are offline or unavailable.
- Effective shadow IT governance focuses on understanding employee needs and providing safe alternatives, not just building longer block lists.
- Graduated controls—monitor, warn, break-glass, block—give organisations flexibility proportionate to the risk level of each application.