> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/getting-started/use-cases/shadow-app-discovery-and-remediation.md). # Shadow app discovery and remediation ## Industry challenge It’s not only human users who have access to your data. Third-party OAuth apps are frequently connected with SaaS applications to streamline work processes and enhance productivity. The Open Authorization (OAuth) protocol enables application-to-application (via machine identity) connectivity in SaaS environments. If the tokens involved in the authentication process become compromised, the risk of a supply-chain based attack increases significantly. Attackers can target these third-party OAuth applications to gain unauthorized access to business-critical data and resources. ## **DoControl solution** DoControl provides visibility into third-party apps and their access permissions, detects over-privileged or untrusted connections, and remediates suspicious app activity. {% embed url="" %} ### **Application discovery** Continuously identify third-party app integrations with your core SaaS ecosystems. DoControl discovers all connected applications including shadow apps, abandoned and malicious apps, together with enriched data about users and access permissions. ### Risk evaluation Assess the risk level of each connected application. DoControl considers usage, geolocation data and the extent of app permissions and scopes to determine the risk score of each application. ### On-demand and automated remediation Suspend, remove or ban suspicious and unauthorized apps. DoControl enables remediation of overprivileged, vulnerable, abandoned, and malicious applications, either on-demand or by setting automated workflows to prevent and alert on future installations. You can create customized workflows that automatically revoke external access after a predetermined time period.

Playbook for removing external sharing after a predefined period of 30 days

{% hint style="success" %} Learn more about [shadow apps](/docontrol-user-guide/saas-data-monitoring/shadow-apps.md) and how to integrate DoControl with [Google Workspace ](/docontrol-user-guide/integrations/integrations-google-drive.md)to support shadow apps. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/getting-started/use-cases/shadow-app-discovery-and-remediation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.