> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/shadow-apps.md). # Shadow apps **SaaS security problem** Employees often try to innovate by adding a third-party app, but they effectively open the back door to a potential data leak. Many third-party apps offer unique benefits, such as AI tools, but it's risky to grant data access to third-party apps that have not undergone the necessary security risk assessments. ‍Supply-chain based attacks involving machine identities and their associated credentials have become a common occurrence. Modern businesses need to prevent the compromise of risky interconnected applications in order to protect business-critical apps and data within the SaaS estate. **DoControl solution** To remediate the risk of supply chain-based attacks via shadow apps, organizations need to establish full visibility, including an inventory of all sanctioned and unsanctioned SaaS applications, and enforce strong governance controls to automatically close compliance gaps. DoControl leverages these tools to provide full visibility, and automatically monitor and remediate shadow app risks across a variety of apps: * [Inventory of OAuth apps](#inventory-of-oauth-apps) * [Inventory of shadow apps](#inventory-of-shadow-apps) * [Playbooks](#playbooks-for-shadow-apps) {% hint style="info" %} **Do you know about the GitHub breach?** In 2022, GitHub publicly announced they’d uncovered evidence of an attacker who exploited stolen OAuth user tokens to download data from dozens of customers. The applications maintained by the compromised platform service providers were used by GitHub users. This breach became a new addition in the growing list of attacks that utilized unauthorized access to target suppliers' systems. GitHub’s analysis of the incident indicated that the attackers used the stolen OAuth tokens to authenticate to the GitHub API. The attackers were selective, and listed the repositories of interest before proceeding to clone private repositories. GitHub began the investigation on April 12, when their Security team first identified unauthorized access to the NPM (Node Package Management) production infrastructure using a compromised AWS API key. GitHub disclosed the breach three days after discovering the attack. {% endhint %} ## What's the risk? OAuth connections provide SaaS applications with access tokens that authorize specific account information to be shared without exposing the user's password. While OAuth connections provide a convenient intermediary between applications and end users, they can also be used in phishing campaigns: Hackers create OAuth URLs that appear legitimate, but are actually modified to produce errors in the authentication flow and redirect to landing pages that attempt to steal login credentials. When users are prompted to approve an OAuth connection, they often accept before closely examining the URL or reviewing the details in the prompt. It’s difficult to implement security policies that prevent users from authorizing OAuth connections across all the disparate SaaS applications used by the business. This creates an attractive landscape for attackers to conduct supply chain-based attacks by breaching trusted third-party apps. When machine identities become compromised, they can provide unauthorized access to sensitive data from the connected application. These shadow apps can gain permission to read, write, and delete sensitive data – all of which can negatively impact an organization's security, business, and compliance risk. ## Inventory of OAuth apps DoControl displays all third-party apps that have access to your organizational data through OAuth, which is used by these integrated SaaS apps: * [Microsoft Entra ID](/docontrol-user-guide/saas-data-monitoring/shadow-apps/microsoft-entra-id-shadow-apps.md) * [GitHub](/docontrol-user-guide/saas-data-monitoring/shadow-apps/github-shadow-apps.md) #### To remediate the risk of unauthorized OAuth apps: 1. From the DoControl side menu, click **Inventory** > **OAuth apps.** 2. Select **Microsoft Entra ID.** 3. To remediate unauthorized Microsoft Entra ID apps, select the relevant apps. 4. Click **Remediate > Inventory actions > Remove application**.
## Inventory of shadow apps DoControl's comprehensive Shadow App module performs discovery, control, and automated remediation for shadow apps installed in your organization's Google Workspace. {% hint style="info" %} Shadow Apps is a premium module. To upgrade your subscription, contact your DoControl Customer Success manager. {% endhint %}

Mini-dashboard for shadow apps

The shadow app inventory includes: * [App discovery](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/app-discovery.md) - DoControl discovers all interconnected SaaS apps within your SaaS estate, and exposes a full mapping and inventory of internal, first-party and third-party applications. By providing your organization with deep visibility into shadow app usage, including risk, company data, users, and departments, DoControl gives you the full business context for shadow app usage. * [Risk scoring](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/risk-snapshot.md) - DoControl fuses multiple risk factors into a single cohesive exposure score, to accelerate your handling and decision making when it comes to permitting shadow apps or not. * [Classification](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/classify-shadow-apps.md) - Based on the rich data DoControl provides, you can manage which applications follow organizational policies, classify apps as sanctioned, unsanctioned or banned, and define automatic decisions accordingly. End users can approve specific applications through a business justification. * [Manual and automatic remediatio](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/remediate-shadow-apps.md)n - Your organization can enforce automated security policies across the SaaS application stack, and remediate the potential risk that sanctioned and unsanctioned applications might pose. Remediation actions can be enforced surgically or in bulk. ## Playbooks for shadow apps To address the use cases of shadow app risks across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Notify your security team whenever a GitHub app is installed. * Automatically remove unauthorized OAuth apps, or apps with excessive permissions. * Remove user app token from a specific shadow app, and prevent installation of an unclassified shadow app.

Select a predefined DoControl playbook to remediate shadow apps

Playbook nameSaaS appPlaybook description
Remove app on-demandMicrosoft Entra IDWhen a user triggers a DoControl inventory action to remove a Microsoft Entra ID app, the apps are automatically removed.
Remove OAuth app from marketplaceMicrosoft Entra IDWhen someone adds a Microsoft Entra ID app via the Office365 marketplace, the Security Ops team is asked for approval. If approved, the actor is notified that their request was accepted. If not approved or the request times out, the OAuth app is automatically removed and the actor is notified.
Remove OAuth app with excessive permissionsMicrosoft Entra IDWhen write permission is given to a Microsoft Entra ID app, the Security Ops team is asked for approval. If approved, the actor is notified that their request was accepted. If not approved or the request times out, the OAuth app is automatically removed and the actor is notified.
Notify on GitHub app installationGitHubWhen someone installs a GitHub app on your organizational GitHub, the Security Ops team is automatically notified by email.
Remove installed shadow app with risky permissionsGoogle WorkspaceWhen someone installs an app with risky permissions on Google Workspace, the SecOps team is asked to approve the app installation. If they don't approve or there is no response, the user app token is automatically removed from the app.
Remove unclassified shadow appGoogle Workspace

When an unclassified shadow app is installed on Google Workspace, the user is asked for approval:

  • If approved, the workflow ends.
  • If not approved or the request times out, the user app token is removed.
Remove user app token on-demandGoogle WorkspaceWhen a user triggers a DoControl inventory action to remove a Google Workspace user app token, the app is automatically removed.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/shadow-apps.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.