Microsoft Entra ID
Enterprise applications, sign-ins and cloud application relationships.
Free SaaS discovery utility
Bring unmanaged SaaS out of the shadows.
Reveal cloud applications employees are actually accessing—even when those apps never appeared in procurement, your CMDB, or the official software catalog.
YOUR
REAL
SAAS
REAL
SAAS
Notion
Miro
Loom
Dropbox
Figma
Typeform
Identity signals + access evidence → application discovery
UNKNOWN APPSOAUTH CONNECTIONSSSO ACTIVITYUNREVIEWED VENDORSDUPLICATE TOOLSACCESS LOGSSAAS INVENTORY GAPSSHADOW IT
Shadow IT rarely looks “shadowy.”
It often starts with a useful app, a free trial, an OAuth click, or a team subscription. The problem is simple: IT may never see it.
01
Free plans
Employees can start using cloud software without a purchase order, contract, or license request.
02
OAuth connections
Third-party apps can enter through “Sign in with Google” or consent flows long before they are reviewed.
03
Team purchases
Departments can buy point solutions independently, creating duplicate vendors and fragmented ownership.
04
Direct web access
Some SaaS leaves little identity-provider evidence at all. That is where access logs become valuable.
Scan where SaaS leaves evidence.
The scanner looks beyond purchasing systems and checks the systems that actually record application access.
Okta
SSO assignments, application access and authentication activity.
Google Workspace
OAuth grants, third-party connections and app-related identity signals.
Access logs
Proxy, firewall, browser or other traffic records that expose SaaS domains.
How it works
Discovery without a giant rollout.
Use the scanner to establish a fast baseline, then decide which applications deserve deeper review.
1
Point it at a source
Connect Entra ID, Okta, Google Workspace, or supply a supported log file.
2
Collect access clues
Analyze application records, authentication events, OAuth relationships and domains.
3
Resolve products and vendors
Translate technical records into recognizable SaaS services your team can investigate.
4
Compare against what you know
Identify apps missing from your official inventory and flag candidates for ownership, spend or risk review.
Scanner output
Get an inventory you can work with.
Instead of another raw log dump, the scanner organizes discovered SaaS into a simple review list: what was found, where it appeared, how many users were seen, and whether it already exists in your known inventory.
AssetLoom Shadow IT Scanner
SCAN #0142SaaS Discovery Report
137applications detected
46missing from inventory
23recommended for review
Application
Users
Source
Status
Notion
61
Google
UNMANAGED
Figma
74
Okta
KNOWN
Loom
19
Logs
UNMANAGED
Miro
33
Entra
KNOWN
Typeform
11
Google
REVIEW
What happens after discovery?
Use the findings as an input to inventory cleanup, vendor governance and software optimization.
Add applications nobody had documented.
Spot duplicate tools and decentralized subscriptions.
Send unknown vendors through the right review process.
Improve ownership and offboarding for cloud applications.
Find what your SaaS inventory missed.
Run the free AssetLoom Shadow IT Scanner against identity data or access logs and uncover the applications already inside your environment.
Download the scanner →FAQ
Before you scan.
What does the scanner discover?
It is designed to identify SaaS and cloud applications visible through identity records, OAuth grants, sign-in activity and supported access logs.
Does every discovered application count as a problem?
No. Shadow IT can include legitimate tools that simply sit outside the official inventory. Discovery gives IT a chance to understand, classify and govern them.
Why scan both identity systems and logs?
Identity platforms capture strong SSO and OAuth evidence, but not every SaaS service uses centrally managed authentication. Logs can expose additional application domains.
Can the results feed AssetLoom?
The scan can serve as a starting point for IT asset intelligence and SaaS inventory workflows. Connect this CTA to your import flow when available.