> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps.md).
# Google shadow apps
DoControl's premium shadow app module discovers all third-party shadow apps installed in your Google Workspace, and enables you to mitigate Google Workspace insider threats.
By providing visibility into third-party apps and their access permissions, DoControl allows you to:
* Detect over-privileged or untrusted connections
* Discover all used and unused third-party apps
* Classify and assess risk levels of over-permissioned, malicious and dormant apps
* Remediate suspicious app activity by suspending users or removing unnecessary apps, either manually or with automated workflows
{% hint style="info" %}
* Shadow Apps for Google apps is a premium module. To upgrade your subscription, contact your DoControl Customer Success manager.
* To leverage the Shadow App module in your organization's Google Workspace, follow the [integration procedure](/docontrol-user-guide/integrations/integrations-google-drive.md) for shadow apps.
{% endhint %}
## Shadow app overview
DoControl's comprehensive Shadow App module performs discovery, control, and automated remediation of Google Workspace apps. Shadow App functionality includes:
* [App discovery](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/app-discovery.md) - DoControl discovers all interconnected SaaS apps within your SaaS estate, and exposes a full mapping and inventory of internal, first-party and third-party applications. By providing your organization with deep visibility into shadow app usage, including risk, company data, users, and departments, DoControl gives you the full business context for shadow app usage.
* [Risk scoring](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/risk-snapshot.md) - DoControl fuses multiple risk factors into a single cohesive exposure score, to accelerate your handling and decision making when it comes to permitting shadow apps or not.
* [Classification](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/classify-shadow-apps.md) - Based on the rich data DoControl provides, you can manage which applications follow organizational policies, classify apps as sanctioned, unsanctioned or banned, and define automatic decisions accordingly. End users can approve specific applications through a business justification.
* [Manual and automatic remediatio](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/remediate-shadow-apps.md)n - Your organization can remediate the potential risk that sanctioned and unsanctioned applications might pose, by removing shadow apps, or removing users from apps. Remediation actions can be enforced surgically or in bulk.
## Shadow app dashboard
The mini-dashboard for shadow apps provides your organization with better visibility, risk insights and manageability. Mostly clickable, the mini-dashboard takes you to a filtered inventory view for each data item. It includes several data visualization cards:
Mini-dashboard for shadow apps
### **Managed apps**
This card displays the summary and trends for apps discovered by DoControl, including:
* Total number of apps, with the percentage increase in the last 30 days
* Number of new apps discovered in the last 30 days
* App status according to these categories:
* **Installed** - Total number of installed apps
* **Reinstalled** - Removed apps that were reinstalled by users
* **Removed** - Apps that were removed by your organization
* **Not installed** - Apps that were removed by users
### **Risky findings**
DoControl provides aggregations of insights users should be aware of. Clicking each finding filters the apps, allowing you to handle the risk.
Risky findings includes these categories:
* **Abandoned apps** - Inactive or dormant apps that weren't used for at least 30 days.
* **Risky apps** - Apps with a risk score between 7-10.
* **Removed and reinstalled apps** - Apps that were removed by DoControl and then reinstalled later by a user.
### **Classification**
DoControl displays the total number of apps per classification status.
* **Unclassified** - App isn't classified yet.
* **Unsanctioned** - Installed app isn't approved by your organization.
* **Sanctioned** - App use is allowed by your organization.
* **Banned** - App is risky and should not be installed in your workspace.
### **Top risky users**
DoControl indicates which users installed the largest number of risky apps vs. the total number of apps they installed, and provides a very important risk angle.
{% hint style="info" %}
Risky apps have a risk greater than 7
{% endhint %}
### **App origin**
This card displays the distribution summary of the app publisher, where each publisher has its own risk implications. App publishers include:
* **3rd party** - App publisher domain is not internal or trusted.
* **1st party** - App publisher includes a trusted domain, or SaaS platform domain.
* **Internal** - App publisher includes your organizational domain.
### **Top risky categories**
DoControl aggregates and classifies apps according to app category to indicate which industry category is the riskiest.
Each industry category shows how many apps it has with a risk score between 7-10.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
