> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/app-discovery.md).

# App discovery

DoControl displays a birds-eye-view of all shadow apps that were at any time installed in your organization. The Shadow Apps module discovers all interconnected SaaS apps installed via Google Workspace, and exposes a full mapping and inventory of internal, first-party and third-party applications.

{% hint style="info" %}
If users install shadow apps via non-authenticated OAuth methods, such as user credentials and Chrome extensions, these apps will not be discovered. Only apps installed via Google Workspace can be discovered.
{% endhint %}

The DoControl Shadow Apps module covers these functional aspects:

* [Alerts from shadow apps](#alerts-from-shadow-apps)
* [Shadow app evaluation lifecycle](#shadow-app-evaluation-lifecycle)
* [Shadow app data](#shadow-app-data)
* [Filter shadow apps](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/filter-shadow-apps.md)
* [Shadow app usage](#shadow-app-usage)
* [Shadow app users](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/shadow-app-users.md)
* [Risk snapshot ](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/risk-snapshot.md)
* [Classify shadow apps](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/classify-shadow-apps.md)
* [Remediate shadow apps](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/remediate-shadow-apps.md)

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FIkQQ6hu6JMO4iJfKXT25%2Fshadow%20apps.png?alt=media&amp;token=d64b6449-86e2-4fb4-89a5-179980118df7" alt=""><figcaption><p>DoControl gives you full visibility to manage shadow apps installed in your organization's cloud</p></figcaption></figure>

## Alerts from shadow apps

Shadow apps installed in Google Workspace can trigger alerts in a user's name. These apps are indicated in the expanded [Alert list](/docontrol-user-guide/risk-management/alerts/view-alerts.md#actor-info) with a link to the app in the Shadow app module:

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FQMu9ncS25Vrl9YVHRYE8%2Fon%20behalf%20of.png?alt=media&amp;token=156220d6-e112-416f-9a14-ac8c64682ef5" alt=""><figcaption></figcaption></figure></div>

When users in an organization install collaborative apps, they sometimes interact with Google Workspace and Google Drive to perform actions and access on behalf of the user.&#x20;

For example,  Google Drive desktop apps can download assets to the end user's endpoint. These non-human identities can trigger alerts in the same way as a human user.

The integration between alerts and shadow apps gives your organization better context to analyze the origin of your alerts.

#### Why was an app not detected?

{% hint style="warning" %}
Sometimes an app is not detected by DoControl, due to any of these reasons:

* **App was installed by an admin user** - Only apps that are installed by regular users are detected by the Shadow app module.
* **Organization-wide apps** - If an app, such as gmail or Zoom, is used across the organization, it won't be detected as a shadow app.
* **Service accounts in Google Workspace** - The Shadow app module does not detect service accounts.
* **Evaluation process** - When an app is in the process of being evaluated, it takes some time until the app appears in the Shadow app module.
  {% endhint %}

## Shadow app evaluation lifecycle

The governance lifecycle for evaluating apps installed on your organization's cloud involves these steps:

1. Assess the [potential risk](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/risk-snapshot.md) of the application, based on the number of users, usage, permission levels, and app risk score.
2. Decide if the app is risky or not, and manually apply the relevant [classification](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/classify-shadow-apps.md) (sanctioned, unsanctioned, or banned).
3. Handle unsanctioned apps with [remediation actions](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/remediate-shadow-apps.md), by notifying all affected users to remove the app, or implementing an automated workflow to block or remove these apps.

## Shadow app data

DoControl has reduced the time it takes to detect new app installation events to **15 minutes**, ensuring more accurate and comprehensive data. With up-to-date visibility into your organization’s shadow apps, you can:

* Respond more quickly to unauthorized app usage
* Improve security posture by identifying potential risks earlier
* Optimize your workflows with accurate and timely data

{% hint style="info" %}

* New apps are tagged with the **In review** label while they are being evaluated by the DoControl data science team. During this time, only basic app data is available and the risk calculation is based on incomplete risk factors.

  It may take several days until we review the app.&#x20;
* Once reviewed, the label is removed and the complete risk picture is exposed.
* For organizations that are integrated with a **single org unit**, it can take up to **25 minutes** to detect shadow apps due to Google limitations.
  {% endhint %}

Data for shadow apps is displayed according to these columns:

<table><thead><tr><th width="229">Shadow app column</th><th>Description</th></tr></thead><tbody><tr><td>Review status (label)</td><td><p>DoControl's review stage of each app:</p><ul><li><strong>In review</strong> - This app is being evaluated</li><li><strong>New</strong> - The app is new to the organization (from the last 7 days)</li></ul></td></tr><tr><td>App name</td><td>Name of shadow app.<br>Click the app name to open the <a href="/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/risk-snapshot.md">app details</a>.</td></tr><tr><td>Type</td><td><p>Indication of the application client type for which the app was developed, including Android, Chrome extension, iOS, native desktop, and more. </p><p>If there is a security breach for a specific app type, you can isolate the affected shadow apps per type. See <a href="#filter-options">Filter options</a>.</p></td></tr><tr><td>Users</td><td>Number of users who installed or have access to the shadow app. Clicking the number opens the <a href="#shadow-app-users">Shadow app users</a> window.</td></tr><tr><td>Usage</td><td><p>Calculation how much the app is in use relative to the global use of all applications in your organization's SaaS platform over the last 30 days: </p><ul><li>Unknown</li><li>None</li><li>Low</li><li>Medium</li><li>High </li></ul><p>For more details, see <a href="#shadow-app-usage">Shadow app usage</a>.</p></td></tr><tr><td>App risk</td><td>Score from 1-10 that evaluates how risky the shadow app is in your organization (1 - least risky, 10 - most risky). The app risk score is based on several risk elements, such as app usage, permissions, marketplace approvals, origin, and publisher compliance certification. See the <a href="/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/risk-snapshot.md#risks">Risk</a> card for more details.</td></tr><tr><td>Origin</td><td><p>The app publisher origin based on the publisher domain, as well as your internal and trusted domains:</p><ul><li><strong>Internal</strong> - The app publisher includes your organization's domain.</li><li><strong>1st party</strong> - The app publisher includes a trusted domain or the SaaS platform domain; for example, a Google app that's developed by google.com.</li><li><strong>3rd party</strong> - The app publisher domain is not internal or trusted. A private domain, such as gmail, might be an indication of a risky app. </li><li><strong>Unknown</strong> - The app publisher is not known. </li></ul><p><br><strong>Tip</strong>: Hover above the origin name to copy the publisher email address.</p></td></tr><tr><td>Last used</td><td>Date when the shadow app was last used in your organization</td></tr><tr><td>Classification</td><td><p>Manual classification category for each app:</p><ul><li><strong>Banned</strong> - App is risky and app use is not allowed by your organization.</li><li><strong>Sanctioned</strong> - App use is allowed by your organization.</li><li><strong>Unclassified</strong> - App isn't yet classified.</li><li><strong>Unsanctioned</strong> - App use is not allowed by your organization.</li></ul><p>For more details, see <a href="/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/classify-shadow-apps.md">Classify shadow apps</a>.</p></td></tr><tr><td>Remediate</td><td><p>Use these inventory actions for Google Workspace shadow apps:</p><ul><li><a href="/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/remediate-shadow-apps.md#remove-app">Remove app </a>- Manually remove a banned or unsanctioned app from your organization's Google Workspace, one-by-one or in bulk.</li><li><a href="/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/remediate-shadow-apps.md#remove-user-app-token">Remove user app token</a> - Manually remove specific users from an unauthorized shadow app in Google Workspace, one-by-one or in bulk.<br><br>After you remove an app or user app token, data is deleted for the affected users.</li></ul></td></tr><tr><td>View users</td><td><p>Displays data about users who have installed or are using a specific shadow app.</p><p>Based on the displayed data, you can manually change the classification of a specific shadow app. <br>See <a href="#shadow-app-users">Shadow app users</a>.</p></td></tr><tr><td>Data feedback</td><td>Provide data feedback about shadow apps to help us improve our app risk scoring, and general app data.</td></tr></tbody></table>

{% hint style="success" %}
To download all displayed shadow apps, click the <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F8QxHQppNorCnfsRFOYKU%2Fdownload%20icon.png?alt=media&amp;token=5b846f8f-0661-4a5b-b406-dc96e0816fa4" alt="" data-size="line"> **Export to CSV** icon. You can download up to 50,000 shadow apps at a time.
{% endhint %}

## Shadow app usage

The shadow app usage indicates much the app is in use relative to the global use of all applications in your organization's SaaS platform (over the last 30 days):

<table><thead><tr><th width="182.33333333333331">Usage</th><th width="89">Icon</th><th>Description</th></tr></thead><tbody><tr><td>Unknown</td><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FbUaiVHYFgvEvx7R1y59f%2FShadow%20apps%20unknown%20usage.png?alt=media&amp;token=26505f6c-b2c1-4d6d-a14b-9389dc116aef" alt=""></td><td>App is using sign-in only scopes, so activity is not being tracked</td></tr><tr><td>None</td><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FLOLhGmnD3BmaE0HlEnzJ%2FShadow%20app%20no%20usage.png?alt=media&amp;token=85c89a47-75be-4d0f-a76d-af0831c9d9c5" alt=""></td><td>No usage might imply an abandoned app, which increases the attack surface</td></tr><tr><td>Low</td><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F0bFjmpZsjI41We2NeqV7%2FShadow%20apps%20low%20usage.png?alt=media&amp;token=e4cc9760-37a7-4544-baec-6580e99e1e1c" alt=""></td><td>The app usage is relatively low compared to the global use of all apps in your organization</td></tr><tr><td>Medium</td><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPWdmfNFik10LPeg4NIDG%2FShadow%20apps%20medium%20usage.png?alt=media&amp;token=0c996e23-5d19-4002-a734-6fd22f7d4b55" alt=""></td><td>The app usage is medium compared to the global use of all apps in your organization</td></tr><tr><td>High</td><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FiXckBkYAkHuFSmGgNWhk%2FShadow%20apps%20high%20usage.png?alt=media&amp;token=63b8811c-6241-466b-9475-590370eb667a" alt=""></td><td>A higher app usage might apply a higher risk</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/app-discovery.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.