> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/shadow-app-users.md). # Shadow app users DoControl allows you to drill down into data about the users who have installed or are using a specific shadow app. Based on the displayed data, you can manually change the classification of a specific shadow app.

{% hint style="success" %} To remove a specific user from a specific shadow app, you can implement an automated workflow to revoke the user token. See [Google Workspace remediation](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-workspace-remediation.md#remove-user-app-token) actions. {% endhint %} #### To display user data for each shadow app: 1. In the DoControl sidebar, go to **Shadow apps > Google Workspace**. 2. Apply any relevant filters to narrow your display of shadow apps. 3. In the **Users** column, click the number of users. The Shadow app users window is displayed. 4. Click the **Search**

icon to look for an item in the currently loaded results. ## Data for shadow app users DoControl displays metadata for each user using a specific shadow app:

User metadata	Description
Installed by	Number of users who installed the shadow app
Type	Application client type for which the app was developed
Usage	How much the app is in use relative to the global use of all applications in your organization's SaaS platform over the last 30 days: Unknown None Low Medium High For more details, see Shadow app usage.
Permissions	The permission level indicates to what extent these permissions are intrusive (low, medium, or high). See Permissions and scopes.
Origin	The app publisher origin based on the publisher domain, as well as your internal and trusted domains.
Risk score	Score from 1-10 that evaluates how risky the shadow app is in your organization. What is the score based on? See the Risks card for more details.
Classification	Manually apply the classification category for each app: Banned - App is risky and app use is not allowed by your organization. Sanctioned - App use is allowed by your organization. Unclassified - App isn't yet classified. Unsanctioned - App use is not allowed by your organization. For more details, see Classify shadow apps.
Data feedback	Provide data feedback about shadow apps to help us improve our app risk scoring, and general app data
User email	Email address of the shadow app user. Clicking the email opens the internal user details.
First name	User's first name
Last name	User's last name
Individual usage	How much a specific user used the app in the last 30 days, compared to other users of the app.
Last used	Date when the user most recently accessed the shadow app
Status	If the app is currently installed for the user: Installed - User has an installed app. Reinstalled - After an app was removed, the user reinstalled the app. Not installed - User uninstalled the app. Removed - User was removed from the app. You can also filter shadow app users according to status.
Remediate	You can manually remove specific users from an unauthorized shadow app in Google Workspace. You can remove users one-by-one or in bulk. After you remove a user app token, data is deleted for the affected users.

## Filter shadow app users You can filter shadow app users for a specific app based on these parameters: 1. DoControl sidebar, go to **Shadow apps > Google Workspace**. 2. Apply any relevant filters to narrow your display of shadow apps. 3. In the **Users** column, click the number of users. The Shadow app users window is displayed. 4. Click the **Filters** button, and select a parameter: * **Removed by DoControl** - All shadow app tokens that were revoked for specific users are displayed. * **Status** - You can display shadow apps that are installed or not installed for specific users. Problematic statuses are displayed with a warning icon:

App status	App removed by DoControl?	Description
Installed	No	User installed the app
Reinstalled	Yes	After the app was removed, the user reinstalled the app
Not installed	No	User uninstalled the app
Removed	Yes	User was removed from the app

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/shadow-app-users.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.