Shadow IT

Definition

Shadow IT is any application, service, or device employees use for work without IT's knowledge or approval – the marketing team's unsanctioned Dropbox, a personal ChatGPT subscription processing customer data, a department SaaS tool bought on a credit card, an unmanaged home PC syncing company files. It's rarely malicious; it's employees routing around friction – which is exactly why it accumulates silently in every SMB.

Why it matters to an MSP

Every shadow app is data outside the security perimeter you're paid to defend: no MFA enforcement, no backup, no offboarding (departed employees keep access), no visibility during incident response, and unknown compliance exposure when regulated data lands in it. There's a licensing and cost angle too: duplicate subscriptions, unlicensed use, and SaaS spend nobody tracks or budgets. Discovery requires several data sources. Acronis RMM uses Device Sense and hardware and software inventory to identify unmanaged devices and locally installed applications. DNS-filtering logs, including DNSFilter, show cloud-service domains users access. Microsoft 365 sign-in and OAuth consent logs show which third-party applications can reach company data, while network monitoring identifies other unmanaged traffic. Combine these sources because none provides a complete shadow-IT inventory alone. A shadow-IT report is a strong assessment finding and QBR artifact because it makes invisible risk concrete to a business owner. The fix is governance, not prohibition: sanction the tools people genuinely need, put them behind SSO, fold them into onboarding and offboarding checklists, and give the client a lightweight approval path so the next tool comes to you first.

Related terms: SSO, IAM, Network Monitoring