> ## Documentation Index
> Fetch the complete documentation index at: https://docs.accessowl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shadow IT Discovery

Shadow IT can pop up anytime employees sign up for apps without letting the IT team know. AccessOwl shines a light on these hidden tools so you can decide how to handle them—without reading personal emails or intruding on privacy.

## How AccessOwl Finds Hidden Apps

<Tabs>
  <Tab title="SSO Logs">
    AccessOwl checks OAuth grants of users to applications. In addition to that, it reviews the last six months of
    <strong><a href="/integrations/all/google-workspace">Google Workspace SSO logs</a></strong> for activity data.
    Whenever someone used “Sign in with Google,” AccessOwl flags that app as potentially untracked.

    <br />

    <br />

    <Note>If an app doesn’t support Google SSO, it won’t appear in this scan.</Note>
  </Tab>

  <Tab title="Invitation Emails">
    For deeper discovery, AccessOwl looks at <strong>machine-generated invitation emails</strong>. Specifically, it searches the email database for known sender domains (like <code>@dropbox.com</code>).
    This helps reveal apps even if they’re <strong>not</strong> using Google SSO.

    <ul>
      <li>AccessOwl only scans for <strong>sender patterns</strong>, never reading actual email content or internal messages.</li>
      <li>It’s recommended to run <strong>application discovery</strong> (SSO logs) before turning on these email checks.</li>
    </ul>
  </Tab>
</Tabs>

## How User Sync and Imports Affect Discovery

Discovery, user sync, and user list imports provide different types of information:

* **Discovery** identifies app usage from Google Workspace OAuth, SSO, and invitation-email signals.
* **User sync** means syncing the current user list and permissions from a connected application.
* **[Importing a user list](/guides/applications/importing-userlists)** removes the **Discovered Users** tab after an import. The tab reappears if new access is discovered over time. Previously discovered users remain available in the **Reports** tab.

### Apps with User Sync

When an application has an active user sync, AccessOwl treats the synced user list as the source of truth. The **Discovered Users** tab is no longer shown for that application.

Enabling user sync does not delete your discovery history. Previous SSO and invitation-email discovery records stay queryable in the **Reports** tab filtered by **Application**, and export to CSV, including for users who have since become managed. Only the **Discovered Users** tab on the application is hidden.

<Note>
  An employee who uses a free account or a separate vendor workspace with their company email might not appear as a separate discovered user under the synced application.
</Note>

## Discovery Timing

<AccordionGroup>
  <Accordion title="How often does application discovery run?">
    AccessOwl checks Google Workspace OAuth and SSO activity automatically each day. New activity does not appear immediately after a user signs in.
  </Accordion>

  <Accordion title="Why might an expected user or app still be missing?">
    Discovery is best-effort. Results can be delayed or unavailable when a mailbox is unavailable or when your Google Workspace configuration prevents the required access.
  </Accordion>
</AccordionGroup>

## What Happens When Apps Are Found

We send a Slack message to [Org Admins](quickstart/org-admin) or centrally set Org Admin Slack notification channel.

### Approve or Ignore

Once AccessOwl discovers an app:

* **Approve** it if you want to officially manage it. This lets people request the app or automates onboarding/offboarding.
* **Ignore** it if it’s a personal or irrelevant tool (e.g., someone’s side-project account).

### Personal or Irrelevant Apps

Not everything your team signs up for needs central management. Ignored apps stay visible in AccessOwl’s records but won’t alert you again.

## Taking Action on Discovered Apps

If you find a large “free tier” group (like Fireflies or any other service) with many employees:

1. Decide if you want to **keep** them as free users, **upgrade** them to a paid plan, or **remove** them entirely.
2. Use AccessOwl to track which users belong there, so you can handle offboarding if someone leaves.

<Tip>If you don’t want employees repeatedly joining these free tools, you might consider disabling sign-ups (if the tool offers that setting) or having a policy conversation internally.</Tip>

## Finding User Permissions

By default, discovery only confirms that users **have** accounts, not their **exact role** (admin, viewer, etc.). For more detail:

* **Direct Integrations:** Connect AccessOwl directly to apps like Slack or Jira for real-time user lists and permission levels.
* **Manual Upload:** Use our Google Sheets template to import user data if an app doesn’t have an API or easy export.

## Next Steps

1. **Run Application Discovery**\
   Check your Google Workspace SSO logs to uncover hidden tools.
2. **Enable Email Checks**\
   For non-Google SSO apps, let AccessOwl detect invitation emails.
3. **Approve or Ignore**\
   Decide whether to manage or dismiss each discovered tool.
4. **Sync Deeper Permissions**\
   If you need role-level visibility, set up direct integrations or import user lists.
5. **Stay Proactive**\
   Periodically review newly discovered apps to keep your environment safe and uncluttered.