Could you name every cloud service your staff use for work, who owns each account, and what business information is stored there? Your approved software list may give you part of the answer. Employees may also use services purchased by a department, free accounts, browser extensions, or tools introduced by a customer or vendor.
An unapproved cloud app is a service being used for business before it has gone through your organization’s review process. This is often called shadow IT. It can leave you with business records outside your normal access controls, recovery arrangements, and employee departure process.
Start by finding those services and understanding their purpose. Then make a documented decision about how each can be used, who is responsible for it, and what needs to change.
Ask your staff how work actually gets done
Your employees know which tools they use to finish a task. Ask department managers and staff about file sharing, online forms, document conversion, project tracking, electronic signatures, messaging, and other services used during everyday work.
Include free tools and temporary accounts. A service does not need to appear on an invoice to receive customer records or internal documents.
Ask practical questions:
- Which services do you use when the approved tools do not meet a particular need?
- Do customers or vendors ask you to upload information to another portal?
- Have you connected an app to your business email, calendar, or shared files?
- Are any work accounts registered to a personal email address?
- Who would take over those accounts if you were unavailable or left?
Explain that you need an accurate picture to protect business information and keep work moving. Give staff a straightforward way to identify a service that needs review. If a task is difficult with your approved tools, record that need as well as the app they chose.
Compare their answers with your business records
Check your software inventory, purchase records, expense reimbursements, and recurring charges. Ask your IT provider to review available reports from managed business systems, such as sign-in records, connected applications, installed browser extensions, and network or endpoint activity.
These sources provide different pieces of evidence. A network record may show that a device contacted a service; application records may show an account or permission grant. Your provider should explain what its reports cover and where visibility is missing, including unmanaged devices or remote activity outside monitored systems.
Keep the review authorized, limited to its business purpose, and restricted to the people responsible for it. Staff should know your rules for business-device use and monitoring. Avoid asking employees to hand over personal passwords or collecting unrelated personal information.
A website visit alone does not establish that someone uploaded company records. Treat an unfamiliar service as a lead to investigate, and confirm its use before deciding what action is needed.
Record the account, the information, and the owner
For each service, create a short entry in your inventory. You should be able to answer:
- Purpose: What work does it support, and which staff use it?
- Ownership: Who administers the account, and can your business recover access?
- Information: What records are uploaded, stored, or processed?
- Access: Who can sign in, view records, or share them externally?
- Connections: Does it have permission to access another business system?
- Recovery and exit: Can you export your records, restore missing information, and transfer ownership?
- Decision: Is it approved, restricted to a defined use, awaiting review, or scheduled for removal?
Keep credentials in your approved credential system rather than in this inventory. Record an owner for the review itself so an app does not remain indefinitely in “awaiting review.”
Review access as well as uploaded files
An app may receive access to business information through a connection your employee authorizes. For example, a scheduling service could request calendar access, or an add-on could request permission to read files. Check the permissions actually granted and whether they fit the business task.
Your technical administrator should review those connections and remove unnecessary access through the appropriate system. Microsoft’s guidance on application consent explains why permission requests need evaluation before approval.
Review public sharing links, external users, administrator accounts, and recovery contacts too. Check whether your business can remove an individual employee’s access without losing the records everyone else needs.
If an app has already received or stored information, revoking a connection does not necessarily remove its existing copy. Your review should address the information already held there and the provider’s retention and deletion options.
Prioritize the services with the greatest business exposure
Begin with services holding sensitive customer or employee records, apps with broad access to business systems, public sharing, and accounts your company cannot administer. Also consider how much work would stop if a service or its account owner became unavailable.
Evaluate the provider’s security controls, the configuration you are using, and the permitted business use together. A product’s reputation or a dashboard risk score cannot tell you whether your own sharing settings and account ownership are appropriate.
Include new features in existing apps. An approved document service may introduce an AI feature or a new integration that changes how information is processed. Review the actual feature and its settings before allowing sensitive business information to be used with it. Keep that review within your wider application approval process.
If you find evidence of unauthorized disclosure or suspicious account activity, escalate it to the person responsible for incident response. Investigate and contain the issue rather than treating it only as an inventory update.
Choose a workable action and document it
A useful service may be suitable once it has a business-owned account, appropriate permissions, and clear rules about the information it can handle. Other services may need restricted use or replacement with an approved option.
Record the decision, the responsible owner, and a completion date. If you are replacing a service, identify the business records to preserve, how you will transfer them, and which integrations or customer workflows depend on it. Verify the transfer before removing the old account.
For an unacceptable exposure, your IT provider may need to restrict access promptly. Coordinate the response with management and give affected staff instructions for continuing essential work.
Verify that the chosen controls actually take effect. Marking an app “unapproved” in an inventory or dashboard does not by itself guarantee that access is blocked everywhere. Enforcement depends on your systems, configuration, and coverage.
Make future approvals easier to manage
Give staff one place to request a new service and explain what information they should provide: its purpose, intended users, the records involved, and any access it requests. Name the person who makes the business decision and the technical contact who reviews security and support requirements.
Keep an accessible list of approved services and permitted uses. Include application reviews when employees join or leave, responsibilities change, new integrations are enabled, or a department introduces a new process.
Revisit the inventory regularly and follow up on unresolved entries. The same record can support your subscription and renewal review, while keeping the security decision tied to the way your business actually uses each app.
Bring your cloud apps into your wider IT plan
Your business should know where its information goes and retain a practical way to control access, preserve records, and continue working when people or services change.
At Unified Technology Solutions, our managed IT services support ongoing technology oversight, alongside cybersecurity considerations. If your business in Vero Beach or elsewhere on the Treasure Coast needs a clearer view of the apps its staff use, contact UTS to discuss your current setup and the review it needs.