> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/faqs/shadow-apps.md). # Shadow apps FAQs on DoControl's Shadow App solution When you integrate your organization with DoControl's Shadow App module, you'll discover all interconnected SaaS apps within your Google Workspace, and expose a full mapping and inventory of internal and third-party applications. {% hint style="warning" %} Shadow Apps is a premium module. To integrate the Shadow Apps module with DoControl, please contact your Customer Support Manager at . {% endhint %} ### Industry terms
Q. What are shadow apps? A. Shadow apps are unauthorized applications used in an organization, often without the knowledge or approval of IT administrators. These unauthorized apps can pose security risks and lead to data breaches.
Q. What are examples of shadow IT apps? A. Shadow IT apps can include messaging apps, file-sharing services, and social media platforms used for work purposes.
Q. What does OAuth mean in authentication? A. OAuth (Open Authentication) is a standard for secure authentication that allows users to login to different services using the same credentials.
Q. What is third-party software? A. Third-party software is software developed by a vendor that is not part of the organization, and can pose security risks if not properly vetted and managed.
Q. What is OAuth 2.0 and third-party application ID? A. OAuth 2.0 is a standard for authorization that allows users to grant access to resources stored on one site via another site without sharing their credentials. An application ID is a unique identifier for an application.
Q. How does third-party authentication work? A. Third-party authentication allows users to login to an application using their credentials from a third-party identity provider, which authenticates the user and sends a token to the application.
Q. What is application governance? A. Governance for apps refers to the policies and procedures that manage the use of applications in an organization, including the procurement, deployment, and management of applications.
### Risks
Q. Are all third-party apps safe? A. Not all third-party apps are safe as they might contain vulnerabilities or malicious code that can lead to data breaches.
Q. What are the risks of third-party apps? A. Data breaches, malware infections, and unauthorized access to sensitive information are all risks associated with third-party apps.
Q. Can a third-party app steal data? A. Yes, if the app is designed to steal data, or if it contains vulnerabilities that can be exploited by attackers.
Q. What is the difference between a first-party and third-party app? A. First party refers to an app published by a trusted domain or the SaaS platform domain; for example, a Google app that's developed by google.com. A third party refers to a vendor or service provider that is not directly involved in the company's operations.
### Shadow app module
Q. How much time does it take for a new shadow app to be visible in DoControl's shadow app view? A. DoControl scans twice a day for new apps.
Q. How long does it take from when an app is in our inventory until it displays the complete risk picture? A. New apps are tagged with the In review label while they are being evaluated by the DoControl data science team. During this time, only basic app data is available and the risk calculation is based on incomplete risk factors. It may take several days until we review the app. Once reviewed, the label is removed and the complete risk picture is exposed.
Q. How can I perform bulk remediation? Can I remove multiple apps at once? A. You can remove shadow apps or users **in bulk** for up to a maximum of 10,000 user tokens within a 24-hour period. For more information, see [Remediate shadow apps](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/inventory/shadow-apps/remediate-shadow-apps).
Q. Why do I need a super admin to integrate DoControl's Shadow app module? A. A regular admin user is insufficient for the Shadow app module to operate. To leverage the full capabilities of the Shadow app module, a **super-admin** user must perform the integration. With only admin user permissions: * DoControl cannot track activities of other admin users, since token installations (either as end users or org-wide) are not detected by other admins. * DoControl can track activities only for the specific admin's Google Workspace organizational unit. * DoControl can't retrieve shadow app Google Workspace events. These are essential for usage and risk scoring calculations, API call tracking, IP call tracking and more.
{% hint style="success" %} To learn more, see [Shadow Apps](/docontrol-user-guide/saas-data-monitoring/shadow-apps.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/faqs/shadow-apps.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.