SaaS and shadow IT review: finding every cloud app, account and subscription in your SA small business or council

Most South Australian small businesses, not-for-profits and councils now run on far more cloud apps than anyone planned. Alongside Microsoft 365 or Google Workspace and the accounting package, there are scheduling tools, survey forms, file-sharing sites, design apps, e-signature services, browser extensions, free trials that quietly became paid plans and, increasingly, AI tools that staff signed up for themselves. This is often called shadow IT: technology used for work that the business has not chosen, checked or recorded. It usually starts with good intentions, because someone needed to get a job done. The risk is that nobody knows where the organisation’s data lives, who still has access, or what renews next month.

A SaaS and shadow IT review answers three practical questions: which apps do we actually use, which ones should we keep, and how do we stop the list growing out of control again? This guide sets out a method that suits a small team or a council IT unit, without buying a large software asset management platform.

Why an app review is worth doing

• Security. Every app with a separate login is another password that may be reused, another account without MFA, and another place an attacker can try. Apps connected to Microsoft 365 or Google Workspace through “Sign in with” buttons can be granted permission to read mail, files or calendars.
• Offboarding. When a staff member leaves, accounts in apps nobody recorded stay active, sometimes holding customer lists or council records. Our onboarding and offboarding checklist only works if you know which apps to check.
• Privacy and data location. Personal information entered into an unvetted tool may be stored overseas, used to train a model or kept longer than your privacy policy says. See our data residency guide.
• Cost. Duplicate tools that do the same job, unused seats and forgotten auto-renewals add up, and they are easy to miss when each one is billed to a different card.
• Continuity. If a key app is owned by one person’s personal account, the organisation may lose it when that person leaves. The same ownership problem applies to domains and admin accounts, covered in our domain, DNS and admin account checklist.

Where to look: discovery sources

No single source finds everything, so combine several. Start with the ones you already have.

1. Finance records. Search card statements, accounts payable and expense claims for software and subscription payments over the past 12 months. This finds paid apps, including those bought on personal cards and reclaimed.
2. Your identity platform. In Microsoft Entra ID, check Enterprise applications and the permissions each app has been granted; in Google Workspace, check the third-party app access list under API controls. These show every app staff have signed in to with a work account, and what it can read.
3. Cloud app discovery tools. If your Microsoft or other security licence includes cloud app discovery, its reports show which cloud services devices and networks are talking to, including tools nobody signed in to with a work account.
4. Password manager and single sign-on. A shared business password manager quickly shows which services the team logs in to. Our password manager and MFA rollout guide explains how to set one up.
5. Email and DNS. Search mailboxes for “welcome to”, “your trial” and “invoice” messages, and review your domain’s DNS and SPF records for services allowed to send email or verify your domain.
6. Browsers and devices. Review installed browser extensions and desktop apps through your device management tool. Our device management guide covers Intune reporting.
7. Ask people. A short, no-blame survey of each team (“which tools do you use to get your work done?”) finds the apps the other sources miss, and the reasons behind them.

Build an app register

Record what you find in one simple register, a spreadsheet or a list in SharePoint is enough. For each app, capture:

• Name, purpose and the team that relies on it.
• A named business owner and a technical contact.
• Number of users and whether they sign in with work accounts, single sign-on or separate passwords, and whether MFA is enforced.
• What data it holds: personal information, financial data, council records or nothing sensitive, ideally using your information classification levels.
• Where the data is stored and whether the provider uses customer data to train AI models.
• Who pays, the billing account, renewal date and notice period.
• Integrations with other systems and the permissions those connections hold.
• How you would get your data out, and what happens to it when you leave.

Triage: keep, consolidate, replace or retire

Sort each app into one of four outcomes, starting with those holding the most sensitive data or the most users.

• Keep apps that are needed, owned and secure enough, then bring them under single sign-on and MFA where the plan allows.
• Consolidate where two or three tools do the same job, often because a capability already exists in Microsoft 365 or Google Workspace. Our Microsoft 365 licence review helps check what you already pay for.
• Replace apps that fill a real need but fail on security, privacy or data location, with an approved alternative that does the same job.
• Retire apps nobody uses: export any data you need to keep, remove connected permissions, close the account and cancel billing before the next renewal.

Be careful not to switch off a tool a team depends on without an alternative ready. Shadow IT usually signals an unmet need, and banning it without solving the need simply moves it somewhere less visible.

Controls that stop the list growing again

• Restrict app consent. In Microsoft Entra ID, limit user consent to low-risk permissions from verified publishers, or turn it off, and enable the admin consent workflow so staff can request an app instead of being blocked. Google Workspace offers similar third-party app access controls. Our Microsoft 365 security checklist includes this setting.
• A light approval path. Publish a short list of approved tools and a simple request form: what the app is for, what data goes in, and who will own it. Aim to answer quickly so people use the path.
• Single sign-on by default. Prefer apps that support sign-in with your work accounts, so disabling one account removes access everywhere.
• Central billing. Buy software through one account or card, with renewals in a shared calendar and reviewed before notice periods end.
• AI tools in policy. State which AI tools are approved and what information must never be entered into others. Our generative AI acceptable use policy guide has a template structure.
• Link to offboarding. Add the app register to your leaver checklist so every app with an account is closed or transferred.

Extra points for councils and agencies

Councils and SA Government suppliers have additional obligations. Information created in a cloud app may be an official record under the State Records Act 1997 (SA), so it must be captured, retained and disposed of correctly, and be findable for freedom of information requests. Our records management and FOI guide explains the workflow side. Check apps holding personal information against your privacy obligations, and apply your security framework, such as the SA Cyber Security Framework (SACSF), when assessing new cloud services and suppliers. For important services, our service provider due diligence guide covers deeper vendor checks and exit planning.

A 90-day plan

1. Weeks 1 to 3, discover: pull finance records, identity platform app lists, password manager entries and a team survey into one register.
2. Weeks 4 to 6, assess: name an owner for each app, record data held and sign-in method, and flag anything holding sensitive data without MFA or with broad permissions.
3. Weeks 7 to 9, act: retire unused apps and remove their permissions, consolidate duplicates, move kept apps to single sign-on, and restrict user consent with an admin approval workflow.
4. Weeks 10 to 12, sustain: publish the approved tools list and request path, centralise billing and renewals, add the register to offboarding, and schedule a quarterly review.

Questions to ask yourself or your IT provider

• Can we list every app that holds customer, staff or council data, and who owns each one?
• Which third-party apps have permission to read our mail, files or calendars?
• When someone leaves, how do we know every app account has been closed?
• Which subscriptions renew in the next 90 days, and are they still needed?
• What is our process when a team wants a new tool, and how quickly do we respond?

How EITSAA can help

EITSAA is an Adelaide-owned technology company working with SA small businesses, not-for-profits, councils and agencies. We run cloud app and shadow IT reviews: gathering discovery data from your identity platform, finance records and staff, building an app register with owners and data classifications, recommending what to keep, consolidate or retire, and configuring app consent, single sign-on and offboarding controls in Microsoft 365 or Google Workspace. Get a quote for a SaaS and shadow IT review or call 0402 401 584, Monday to Friday, 9am to 5:30pm. Learn more about our managed IT and cyber security, AI governance and training and consultation services.