Discover and triage shadow IT

Shadow IT is the third-party software your employees connect to their corporate Google accounts without going through IT: an AI note-taker granted access to Calendar, a design tool reading Drive, a browser extension holding a Gmail token. Shadow IT discovery scans those OAuth grants across your Workspace and lists every third-party app, so you can see what has access, judge the risk, and decide what to sanction or shut down.

It reads your directory through the same service account as the Google Workspace connector. For each active Workspace user, it calls the Admin SDK users.tokens.list and collects the apps that user has authorized, then groups the results by app. Nothing is changed in Google; discovery is read-only.

You reach it at Admin → Software → Shadow IT.

Before you begin

• You need an admin role (admin, it-admin, or super-admin).
• The Google Workspace connector is configured with a service account and an impersonated admin. If it isn't, set it up first under Workspace seat sync.
• That service account's domain-wide-delegation grant carries the three scopes in Required Google scopes. Discovery fails or returns partial data without them.

How discovery works

A scan iterates every active user in your Workspace (suspended and archived accounts are skipped, the same rule the seat sync uses) and asks Google which third-party applications each one has authorized. The results are de-duplicated into one row per app.

Per app, the scan records	From
App name and the OAuth client it was authorized as	users.tokens.list
The scopes it holds (for example Gmail read, Drive read/write, Calendar)	users.tokens.list
How many of your users have authorized it	Aggregated across users
Authorized from: the most recent authorization's IP, actor, time, and platform	Workspace audit log (see Required Google scopes)

Required Google scopes

Shadow IT discovery uses the same service account as the Google Workspace connector. Extend that account's domain-wide-delegation grant with the scopes below; the first is already present if you configured Workspace seat sync.

Scope	Enables
admin.directory.user.readonly	List the active users to scan.
admin.directory.user.security	Read each user's OAuth token grants: the third-party apps and their scopes. This is the core discovery scope.
admin.reports.audit.readonly	Populate the Authorized from column: the most recent authorization's IP address, actor, time, and platform, read from the Workspace audit log.

To add them, in the Google Admin console go to Security → Access and data control → API controls → Domain-wide delegation, open the service account's client ID, and add the full scope URLs:

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.user.security
https://www.googleapis.com/auth/admin.reports.audit.readonly

Paste all three into the OAuth scopes field (comma or newline separated) and select Authorize. Changes to a delegation grant can take a few minutes to take effect.

The "Authorized from" column needs the audit scope

Discovery still runs without admin.reports.audit.readonly, but the Authorized from column stays blank for every app and the Shadow IT page shows an amber hint banner pointing at the missing scope. The two directory scopes drive the app inventory; the reports scope only enriches it. Add the reports scope to fill the column.

Run a scan

1. Open Admin → Software → Shadow IT.
2. Select Scan now. The scan walks your active users and may take a minute or two on a large domain.
3. When it finishes, the page lists every discovered app with its risk level, user count, scopes, and Authorized from details, and stamps the time of the scan.

Re-run Scan now whenever you want a fresh picture. Discovery is manual in this release, so a newly authorized app appears only after the next scan, and one a user has since disconnected drops off it.

Triage discovered apps

Every discovered app carries a status and a risk level. Triage is the loop of working the New queue down to zero: review each app, judge its access, and move it to a resting state.

Status

Status	Meaning
New	Freshly discovered and not yet reviewed. The triage queue.
Sanctioned	Reviewed and approved for use. Record it in the software catalog to track it as a known product.
Flagged	Marked as a concern to act on: revoke the grant in Google, contact the users, or open a follow-up.
Ignored	Dismissed as not worth tracking, a harmless personal app for example. Drops out of the active queue without being approved.

Set a status from the app's row by choosing Sanctioned, Flagged, or Ignored. Filter the list by status to focus on the New backlog or to review everything you have Flagged.

Risk level

OnTrackio scores each app's risk from the sensitivity of the OAuth scopes it holds: a tool with read-only access to a profile is low risk; one that can read and send Gmail or read all of Drive is high.

Risk	Typical grant
High	Broad read/write access to mailbox, Drive, or admin data.
Medium	Read access to substantial content, or write access to a single service.
Low	Profile, email address, or other minimal, read-only scopes.

Sort or filter by risk to deal with the most sensitive grants first.

tip

Risk is a heuristic from the granted scopes, not a verdict on the vendor. Treat High as "review this now", then confirm what the app actually does before you sanction or flag it.

Read the "Authorized from" column

When admin.reports.audit.readonly is granted, each app shows Authorized from: the most recent authorization OnTrackio found for it in the Workspace audit log, with

• the IP address the authorization came from,
• the actor, the user who granted access,
• the time of the authorization,
• the platform (browser or device) used.

It answers "who last connected this, and from where" at a glance, which is often what decides whether a grant is routine or worth flagging. If the column is blank across every app, the audit scope is missing; see Required Google scopes.

Verify

• After Scan now, the page shows a scan timestamp and the apps you expect for a domain that uses third-party tools.
• With the reports scope granted, Authorized from shows an IP, actor, time, and platform rather than staying blank, and no amber hint banner appears.
• Moving an app to Sanctioned, Flagged, or Ignored removes it from the New filter and keeps that status on the next scan.

Troubleshooting

Symptom	What to do
Authorized from is blank and an amber banner names a missing scope	admin.reports.audit.readonly isn't on the delegation grant. Add it (see Required Google scopes) and re-scan.
A scan finds no apps, or errors reading tokens	admin.directory.user.security is missing, or domain-wide delegation isn't authorized for the impersonated admin. Confirm both on the service account's grant.
A scan can't list users, or returns an authorization error	admin.directory.user.readonly is missing or the Google Workspace connector isn't configured. Check it under Workspace seat sync.
An app you expected is missing	Only third-party apps authorized by active users are scanned; suspended and archived accounts are skipped. Re-scan after reactivating the user.
Scopes were added but nothing changed	Delegation changes can take a few minutes to propagate. Wait, then select Scan now again.

Related

Google WorkspaceSet up the service account and domain-wide delegation that discovery builds on.Read →Software catalogRecord a sanctioned app as a known product with its own security grade.Read →Software and licenses overviewHow the catalog, licenses, and assignments fit together.Read →Audit logSee the platform's record of admin actions and security events.Read →