> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/shadow-apps/microsoft-entra-id-playbooks-for-shadow-apps.md).

# Microsoft Entra ID playbooks for shadow apps

To mitigate the risk associated with shadow apps in Microsoft Entra ID, you can define automated workflows for these use cases: 

* [Remove app on-demand](#remove-app-on-demand)
* [Remove OAuth app from marketplace](#remove-oauth-app-from-marketplace)
* [Remove OAuth app with excessive permissions](#remove-oauth-app-with-excessive-permissions)

## Remove app on-demand

When a user triggers a DoControl inventory action to remove a Microsoft Entra ID app, the apps are automatically removed. This workflow is event-aggregated, so it can be run for multiple events.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to shadow apps, and select the **Remove app on-demand** playbook. 
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FTRnnFWJS08OXReIm55pQ%2FIT%20playbook%20AD%20quick%20action.png?alt=media&amp;token=e119a7f9-14cc-4f22-aa35-a67d146bc872" alt=""><figcaption></figcaption></figure>
4. Under the **Remove OAuth app**, make sure the App ID macro is selected.
5. Customize the workflow as necessary.

## Remove OAuth app from marketplace

When someone adds a Microsoft Entra ID app via the Office365 marketplace, the Security Ops team is asked for approval. If approved, the actor is notified that their request was accepted. If not approved or the request times out, the OAuth app is automatically removed and the actor is notified.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to shadow apps, and select the **Remove OAuth app from marketplace** playbook.&#x20;
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPqgUAcMXryyvRIrbAqHo%2FIT%20playbook%20AD%20marketplace.png?alt=media&amp;token=b462e875-06c1-4b40-a6e7-c5a8fe9f9e22" alt=""><figcaption></figcaption></figure>
4. Under the **Add application** event, add the relevant conditions.
5. Customize the **Approval** step to send an email or Slack message to the Security Ops team asking for approval:\
   \
   `An application with write permissions has been installed by <actor>.`

   `Do you approve the installation of this application: <app name>?`

   * **Yes** - Customize the **Notify by email** step to send to the actor, notifying them that their request to install the specific app has been approved.
   * **Timeout** - Customize the **Wait** step time period; for example, 3 days.
   * **No** - Customize the **Remove OAuth app** step to remove the unauthorized app. Make sure the App ID macro is selected.
6. Customize the **Notify by email** step to send to the actor, notifying them that their request to install the specific app has been rejected.

## Remove OAuth app with excessive permissions

When write permission is given to a Microsoft Entra ID app, the Security Ops team is asked for approval. If approved, the actor is notified that their request was accepted. If not approved or the request times out, the OAuth app is automatically removed and the actor is notified.

1. In Workflows, select **Playbooks**.

2. Filter the playbooks according to shadow apps, and select the **Remove OAuth app with excessive permissions** playbook.&#x20;

3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FnpvPmfwaIngh7kVIdtjm%2FIT%20playbook%20AD%20excessive%20perm.png?alt=media&amp;token=dbf8eae0-a88a-4608-ac8c-02a5625af07e" alt=""><figcaption></figcaption></figure>

4. Under the **Consent to application** event, add the relevant conditions.

5. Customize the **Approval** step to send an email or Slack message to the Security Ops team asking for approval:\
   \
   `An application with write permissions has been installed by <actor>.`

   `Do you approve the installation of this application: <app name>?`

   * **Yes** - Customize the **Notify by email** step to send to the actor, notifying them that their request to install the specific app has been approved.
   * **Timeout** - Customize the **Wait** step time period; for example, 3 days.
   * **No** - Customize the **Remove OAuth app** step to remove the unauthorized app. Make sure the App ID macro is selected.

6. Customize the **Notify by email** step to send to the actor, notifying them that their request to install the specific app has been rejected.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/shadow-apps/microsoft-entra-id-playbooks-for-shadow-apps.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.