Shadow IT is any app, cloud service or device your staff use for work without the business knowing about it or approving it. A personal Dropbox holding client files, a free project board the sales team signed up for, a WhatsApp group used for customer orders: all of it counts. It is rarely sinister, but anything you do not know about is something you cannot secure, back up or take back when someone leaves.
Quick answer: Shadow IT means technology used for business purposes without the organisation’s knowledge or sign-off, most often free cloud apps, personal storage accounts, messaging groups and devices plugged into the office network. The NCSC says it usually comes from staff working around tools that do not meet their needs. The fix is to find it, then approve, replace or retire each item, not to punish people.
In this guide: what counts as shadow IT, why it appears, the specific risks for a UK business, and a practical way to find what your staff are already using and decide what to keep.
What counts as shadow IT in a small business?
The National Cyber Security Centre’s shadow IT guidance describes it as unknown assets used for business purposes that sit outside asset management and outside your IT policies. The important word is unknown. A tool can be perfectly reputable and still be shadow IT, because the issue is that nobody responsible for your systems knows it holds company data.
In a business of 10 to 100 people it tends to fall into four groups.
| Type | Everyday example | What you lose |
|---|---|---|
| Personal cloud storage | Files synced to a personal Google Drive so someone can work from a home PC | Any copy of that data once the person leaves |
| Free or trial SaaS apps | A project board, e-signature tool or survey service signed up for with a work email | Control over who can sign in, and whether MFA is on |
| Messaging and video tools | A WhatsApp group used to pass customer details or take orders | Any record of what was said or shared |
| Unmanaged devices | A spare Wi-Fi extender, a smart speaker or a personal laptop on the office network | Updates, passwords and visibility of what it connects to |
AI chatbots belong in the same family. The NCSC now names “shadow AI” separately, meaning AI services used with company data without permission.
It is worth separating shadow IT from bring-your-own-device (BYOD). The NCSC is clear on this: with a proper BYOD policy the business has agreed rules and some control over company data on the personal device. With shadow IT there is no agreement at all. The risk might be tiny or it might be serious, and the point is that you cannot tell.
Why staff go around the approved tools
Almost nobody installs an unapproved app to cause harm. They do it because they have a job to finish and the official route is slower, missing or awkward. The NCSC’s own list of common causes reads like a helpdesk queue: not enough storage, no easy way to share files with a third party, no approved video calling or chat tool, a request process that is slow or does not exist, and staff simply not realising that a free online tool carries any risk.
That makes shadow IT useful information. Every unapproved app you find is a record of a need the business has not met. If the design team are all on a personal file-transfer service, the real finding is that your approved setup cannot send a 4 GB file to a client.
It also explains why a heavy-handed response backfires. The NCSC warns that if you blame or punish people, their colleagues stop telling you about their own workarounds, and you end up knowing less than before. A no-blame approach is the only way to get an accurate picture.
What actually goes wrong with shadow IT
“Creates risk” is too vague to act on. These are the specific problems that surface when unapproved tools are found.
The data leaves when the person does
If client files live in an account registered to an employee’s personal email, the business has no right of access to it and no way to disable it. When that person leaves, your offboarding checklist cannot cover an account it does not know exists. The same applies to anything they set up with a work address but personal payment details.
No MFA, weak passwords, no logging
Your Microsoft 365 tenant may enforce multi-factor authentication on every sign-in, but a separate app someone joined with a password they reuse elsewhere does not inherit any of that. If the app holds customer data, it is now the weakest door into it.
Apps with access to your mailbox
This is the one most owners have never heard of. When someone clicks “Sign in with Microsoft” on a third-party tool, they may be asked to let that app read their mail, calendar or files. Microsoft’s documentation confirms that, by default, users can grant apps access to their own data for any permission that does not need an administrator. A well-meaning click on a scheduling tool and a malicious app impersonating one look much the same on that consent screen.
UK GDPR obligations you cannot meet
If an app stores or processes personal data on your behalf, its provider is acting as your processor. The ICO’s guidance on contracts says that whenever a controller uses a processor there must be a written contract in place. For most SaaS products that means accepting the provider’s data processing terms, which someone signing up on a free plan will almost never have read on the business’s behalf. You also cannot answer a subject access request properly if you do not know where the data is.
Cyber Essentials scope
Version 3.3 of the Cyber Essentials requirements, current at the time of writing, states that cloud services holding your organisation’s data cannot be excluded from scope, and that sign-ins to cloud services must always use MFA. An unknown app with company data and no MFA is therefore a gap in the controls you are declaring. If you are working towards certification, the guide to what Cyber Essentials covers explains how scope is set.
How to find the shadow IT you already have
No single report shows everything, but a few cheap sources together get a small business most of the way. Start with the one that costs nothing.
-
Ask staff, with an amnestySend a short form asking which apps, sites and accounts people use for work that IT did not set up. Say clearly that nobody will be in trouble and that the aim is to provide proper tools.Check: ask managers to fill it in for their team as well, since people forget the tools they use daily.
-
Read the card statements and expense claimsSmall monthly charges to software companies are the easiest trail to follow. Look back 12 months, because annual plans only show up once.Check: search for “subscription”, “pro plan”, “per user” and familiar SaaS brand names.
-
List the apps users have consented toIn the Microsoft Entra admin centre, the Enterprise apps list shows third-party applications people have signed in to with their work account, and the permissions each one holds.Check: look for apps with mail or file permissions that you do not recognise.
-
Look for mail forwarding rulesAn inbox rule forwarding mail to a personal address is shadow IT in its simplest form, and also a common sign of a compromised account.Check: review forwarding settings and inbox rules on every mailbox, not just the ones you suspect.
-
Check what is on the networkYour router or firewall keeps a list of connected devices. Anything you cannot name, such as an extra access point or a smart device, needs an owner.Check: compare the device list against your asset register line by line.
-
Review browser extensions and installed softwareExtensions can read every page a user opens, including your web apps. If your devices are managed, an inventory report lists what is installed.Check: flag any extension that can read and change data on all websites.
Record everything you find in one place. If you already keep an IT asset register, add a section for cloud services with the owner, what data each one holds and who approved it. If you do not have one, this exercise is a good reason to start.
Tighten app consent in Microsoft 365
For most Microsoft 365 businesses, the single most useful setting is who may approve third-party apps. Out of the box, users can consent to apps for permissions that do not require an administrator, which includes reading their own mailbox. Microsoft’s own advice, in its user consent documentation, is to limit user consent to apps from verified publishers.
The setting lives under Enterprise apps, then Consent and permissions, then User consent settings, and changing it needs a Global Administrator or Privileged Role Administrator. There are three realistic positions for a small business:
- Allow user consent for verified publishers only. Microsoft’s recommended baseline. Staff can still connect reputable tools; unverified apps are blocked from asking.
- Turn user consent off and switch on admin consent requests. Users see a “request approval” option instead of a block, and a named person reviews each request. This suits businesses handling sensitive client data.
- Leave the default. Only reasonable if someone reviews the Enterprise apps list regularly, which in practice rarely happens.
Before you change it: review the apps already consented first. Restricting consent stops new grants; it does not remove access that existing apps already hold. Revoking an app people rely on without warning will create a helpdesk queue and new workarounds.
Our Microsoft 365 support team can review consent, sharing and forwarding settings together, so one change does not undo another.
Approve, replace or retire: deciding app by app
Once you have a list, every item needs a decision and a named owner. Most fall into one of three outcomes.
| Decision | When it fits | What to do next |
|---|---|---|
| Approve | The tool does a job nothing you own does, the provider is reputable and its terms cover personal data | Move it to a business account the company owns, turn on MFA or single sign-on, accept the data processing terms and add it to the register |
| Replace | You already pay for something that does the same job, such as Teams instead of a free video tool or SharePoint instead of personal storage | Show people how to do the task in the approved tool, move the data across, then close the old account |
| Retire | It is unused, duplicated or too risky to keep | Export anything worth keeping, delete the account, revoke any app consent and remove saved passwords |
Approving a tool is not the same as leaving it as it is. The account has to belong to the business, with an admin who is not the person who signed up. Otherwise you have only documented the problem.
Stop it coming back
The NCSC’s mitigations are mostly about process rather than technology, and they suit small firms well. Avoid locking things down so tightly that people cannot share a file with a client or message a colleague. Give staff a quick, simple way to ask for a new tool, with an answer in days rather than weeks. Publish a short list of approved apps for common jobs so the obvious question already has an answer. Then repeat the discovery checks every quarter, since new sign-ups happen all the time.
Write the rule into your cyber security policy in one or two plain sentences: what needs approval, who approves it, and how to ask. A rule people can find and follow does more than a long one they never read.
Frequently asked questions
Is shadow IT illegal?
No, using an unapproved app is not illegal in itself. The legal exposure comes from what happens to personal data inside it. If customer or staff data sits in a service with no processing terms, no access control and no record of where it is, the business may struggle to meet its UK GDPR duties, including security, breach reporting and answering subject access requests.
Is a personal phone used for work email shadow IT?
Not if the business knows about it and has rules for it. A phone covered by a bring-your-own-device policy, with the work apps managed and a passcode enforced, is a managed risk. The same phone with work files saved to personal cloud storage, or customer chats in a personal messaging app, has shadow IT on it.
Should we just block every unapproved app?
Blocking everything tends to push the workaround somewhere you cannot see, such as a personal phone on mobile data. Block the things that are clearly risky, such as unverified apps asking for mailbox access, and make it easy to request everything else. The NCSC advises against unnecessary lockdowns for exactly this reason.
How often should we check for shadow IT?
A full discovery exercise once a year and a lighter check every quarter works for most small businesses. The quarterly check can be short: review new consented apps in Microsoft Entra, scan the card statement for new software charges and ask managers whether their teams have started using anything new. Also check whenever someone leaves.
Shadow IT is a sign that people are trying to get work done, so treat it as feedback. Find it, decide on each item, and make the approved route the easy one.
Get Your Apps and Accounts Under Control
Our managed IT support includes keeping track of the apps, accounts and devices your business relies on, and a clear route for staff to ask for new tools.
