> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-card/shadow-apps.md).

# Shadow apps

At a glance, you can see all shadow apps installed by a specific user in your organization's Google Workspace. The more unsanctioned or banned risky apps a user has installed, the greater their risk score.

Shadow apps installed by [terminated users](#terminated-employees-with-shadow-apps) are particularly risky. A terminated employee might still have an **active** status if their Google account was not disconnected. DoControl gives you instant visibility into these users' installed apps and makes it easy to remediate them.

You can [remediate](#to-remove-user-tokens-for-terminated-employees) risky app installations for a specific identity by removing the identity from the app.

{% hint style="warning" %}

* Make sure you've upgraded to DoControl Premium in order to view a user's shadow apps in Identities.
* After upgrading, you need to [reintegrate Google Workspace with DoControl ](/docontrol-user-guide/integrations/integrations-google-drive.md)by selecting the Shadow App use case.
  {% endhint %}

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FtIR3vgJyTNWRYSF1Roc6%2Fshadow%20apps%20ITDR.png?alt=media&amp;token=e49dce9c-eec7-461d-9c14-5c463e6c6de4" alt=""><figcaption></figcaption></figure>

## Shadow app findings

High-level findings pertaining to a specific user's shadow apps are displayed as follows:

<table><thead><tr><th width="293">Shadow app finding</th><th>Description</th></tr></thead><tbody><tr><td>Risky/total apps</td><td><ul><li>Number of risky apps this user has installed out of the user's total number of installed apps. </li><li>Risky apps have a risk score between 7-10.</li></ul></td></tr><tr><td>App trend graph</td><td>Number of new apps installed by this user in the last 7 days</td></tr><tr><td>App status</td><td><ul><li><strong>Installed</strong> - Total number of installed apps for this user</li><li><strong>Reinstalled</strong> - Removed apps that were reinstalled by this user</li><li><strong>Removed</strong> - Apps that were removed by your organization</li><li><strong>Not installed</strong> - Apps that were removed by this user</li></ul></td></tr><tr><td>Department average</td><td>Number of risky shadow apps installed by the average user in this user's department</td></tr><tr><td>Organization average</td><td>Number of risky shadow apps installed by the average user in the entire organization</td></tr></tbody></table>

## Shadow app inventory

The list of all shadow apps installed by a specific user is sorted by risk score:

<table><thead><tr><th width="228">Shadow app parameter</th><th>Description</th></tr></thead><tbody><tr><td>Installed app</td><td>Name of installed app</td></tr><tr><td>Type</td><td>Indication of the application client type for which the app was developed, including Android, Chrome extension, iOS, native desktop, and more.</td></tr><tr><td>App risk</td><td>Score from 1-10 that evaluates how risky the shadow app is in your organization (1 - least risky, 10 - most risky)</td></tr><tr><td>Origin</td><td><p>App publisher origin:</p><ul><li><strong>3rd party</strong> - App publisher domain is not internal or trusted</li><li><strong>1st party</strong> - App publisher includes a trusted domain, or SaaS platform domain</li><li><strong>Internal</strong> - App publisher includes your organizational domain</li></ul></td></tr><tr><td>Classification</td><td><p>Manual classification for each app:</p><ul><li><strong>Banned</strong> - App is risky and should not be installed in your workspace.</li><li><strong>Sanctioned</strong> - App use is allowed by your organization.</li><li><strong>Unclassified</strong> - App isn't classified yet.</li><li><strong>Unsanctioned</strong> - Installed app isn't approved by your organization.</li></ul></td></tr><tr><td>View</td><td>Click <strong>View</strong> <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fh1PTUvilwUjBiALm9QC4%2FView%20more.png?alt=media&amp;token=6d06e2fb-9714-4d18-b1e3-2530f04231ce" alt="" data-size="line"> to investigate an app in the Shadow App module</td></tr><tr><td>Remediate</td><td>Click <strong>Remediate</strong> <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F9Yj91tyPLF0cryJOUJlh%2Fremediate%20wand.png?alt=media&amp;token=6436013e-b229-48cc-acba-202420e693cf" alt="" data-size="line"> to remove this identity from a specific shadow app</td></tr></tbody></table>

{% hint style="success" %}
To investigate a shadow app, click the **View more** ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fh1PTUvilwUjBiALm9QC4%2FView%20more.png?alt=media\&token=6d06e2fb-9714-4d18-b1e3-2530f04231ce) icon or **Go to shadow apps** to see all filtered shadow apps for this user.
{% endhint %}

## Terminated employees with shadow apps

If you have **terminated** users in your organization, it's critical to check that they don't have any installed shadow apps in your Google Workspace. A terminated employee might still have an **active** status if their Google account was not disconnected.&#x20;

Shadow apps installed by terminated users are a significant security threat, and can potentially result in data exfiltration or damage to your organization.&#x20;

{% hint style="warning" %}
Make sure you remove all **user tokens** from shadow apps that were installed by terminated employees.
{% endhint %}

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fj7EBQJx7qDn8GrDRHLEm%2Fterminated%20shadow%20apps.png?alt=media&amp;token=ba132f84-5ce0-44c2-a295-5f72374dc955" alt=""><figcaption></figcaption></figure>

#### To remove user tokens for terminated employees:

1. In the **Identities** module, open the **Identity card** for a terminated user and click the **Shadow apps** tab.
2. If the user has risky shadow apps installed, click the **Remediate** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F9Yj91tyPLF0cryJOUJlh%2Fremediate%20wand.png?alt=media&amp;token=6436013e-b229-48cc-acba-202420e693cf" alt="" data-size="line"> icon for each app.
3. Select **Inventory actions > Remove user from app**.\
   \
   ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FIvav1JAVyuXj9vsqUcds%2Fremove%20user%20from%20app%20ITDR.png?alt=media\&token=4255c42d-d4b1-4039-a836-cc993aa19620) <br>

## **Remediate shadow apps in bulk**

To remove multiple shadow apps installed for a specific user, you can remove them in a bulk action from the Shadow App module.

**To remove user tokens in bulk:**

1. In the **Identities** module, open the **Identity card** for a specific user and click the **Shadow apps** tab.

2. Click **Go to shadow apps** to see all filtered shadow apps for this user.&#x20;

3. Select the shadow apps you wish to remove.

4. Click **Remove apps** to remediate in bulk.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F0rP5b8yK5NPeY0takQAE%2Fremove%20shadow%20apps%20in%20bulk.png?alt=media&amp;token=a68b68fe-2c95-418d-9f78-04fcc3968ec2" alt=""><figcaption></figcaption></figure>

5. Click **Remove apps**.<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fkf7Vpm7wkDnB3ALEYd4p%2Fremove%20app%20message.png?alt=media&amp;token=b34bba44-c3fb-459b-8c41-6731bfbb7046" alt=""><figcaption></figcaption></figure></div>

6. Click **OK**.<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FEfteEOYVnQmsCoz7nw2l%2Fremediation%20about%20to%20start%20app.png?alt=media&amp;token=8a5eefb5-d7f0-441f-a159-88b02205debe" alt=""><figcaption></figcaption></figure></div>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-card/shadow-apps.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.