AegisAI Perspectives · 114
Find SaaS apps employees signed up for by searching work mail for sign-up, verification or receipt emails, then checking each against sign-in records.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Search work mailboxes for sign-up, verification, welcome and receipt emails, group them by sender, then check the sign-in record. Microsoft message trace searches up to 90 days back6. AegisAI reads the sign-up mail it already sees and builds an inventory of every app adopted with a company identity1.
Choosing a tool to do it for you is covered in the guide to choosing shadow IT discovery tools.
Run the three in that order, because each list feeds the next.
Shadow SaaS is software staff adopt with a work address, outside the approved list. The shadow IT discovery page on aegisai.com puts the gap plainly: proxies and CASBs, as well as SSO reports, miss the free-tier sign-up made with a work address22.
The sign-in side is open by default. In Microsoft Entra ID, all users can consent to applications for permissions that do not require administrator consent8. Start from the mail, because the sign-up email arrives whether or not the app ever asked for a grant.
Short on time? Watch the explainer, or book a demo.
Email-native discovery reads the trail every app leaves: a welcome email, a receipt or a share2. Email catches the sign-up even when the app never touched single sign-on or your identity provider5.
You can follow the same trail by hand in the admin logs. The Subject filter in message trace takes starts with, ends with or contains7. In Google Email Log Search, the Subject field takes a full or partial subject line12. For a single mailbox, the Gmail subject: operator finds a word in the subject line16, and operators combine to narrow results. Save one search per signal so you can rerun it each month.
A receipt is the one sign-up signal that names a payer. The shadow IT discovery page notes that a receipt shows which tools someone is already paying for, and who23.
Search subjects for receipt or invoice, then group the results by sender domain. Two receipts from the same app in two teams point to a duplicate subscription. Send each duplicate to its two owners with one question: which account stays?
The grant record shows which apps reached into company data, and the email shows which ones exist at all. Microsoft Entra activity logs record activities in your applications, including permissions granted to them10. The Google Workspace OAuth log records each time a third-party application is authorized to access Google Account data14.
Timing matters on the Google side. App details appear 24 to 48 hours after authorization in App access control15. Match each app on your email list to a grant record, and flag the ones with none.
An app that holds regulated data carries a contract duty, so check each one for a contract. Under the GDPR, processing by a processor is governed by a contract that sets out the subject-matter and duration of the processing and its purpose24. Under HIPAA, a covered entity lets a business associate handle protected health information only with satisfactory assurance that it will safeguard it25.
CIS Safeguard 2.1 asks for a detailed inventory of all licensed software18. Add a column to your list for the data each app holds, and send every app with personal or health data to your privacy lead.
Run these steps once in full, then monthly on the saved searches.
Confirm access: Email Log Search needs the Gmail Settings administrator privilege11.
In message trace, widen the time range from the 2 day default to 90 days.
Set the Subject filter to contains, with words such as verify, welcome, receipt or invoice.
In Google Email Log Search, enter partial subject lines in the Subject field.
For Gmail messages older than 30 days, add the recipient address and message ID13.
Export both result sets and group them by sender domain, one row per app.
Pull the Google OAuth log and the Entra activity logs, and match each row to a grant.
Mark every app that is not on the approved list, and name an owner for it.
Keep the export with the date of each search, so the next run starts where this one ended.
Every unapproved app ends in one of three states: approved, replaced or removed. CIS Safeguard 2.3 says unauthorized software is either removed from use or gets a documented exception19.
The UK National Cyber Security Centre says to take a positive and no-blame approach to people forced into shadow IT20. Send each owner the app name, the data it holds and a deadline for the decision.
Each source shows a different part of the picture, so the gaps show where an app still hides.
| Signal | What it shows | Microsoft 365 | Google Workspace | AegisAI |
|---|---|---|---|---|
| Sign-up email | The app exists | Message trace Subject filter | Email Log Search Subject field | Reads the sign-up mail it already sees |
| Receipt | Who pays for it | Message trace Subject filter | Email Log Search Subject field | Shows who is already paying |
| Lookback | How far back you see | Up to 90 days | Recipient and message ID needed past 30 days | Not covered on the product page |
| Grant record | Access to company data | Entra activity logs | OAuth log | Not covered on the product page |
| Outside single sign-on | Apps with no grant | Not covered in the Microsoft pages used here | Not covered in the Google pages used here | Email catches the sign-up |
| Control app access | Limits what apps reach | Allow user consent only for verified publishers9 | App access control, details 24 to 48 hours after authorization | No edge: revocation happens in your identity provider or admin console4 |
Score your own tenant on each row, and use the demo request page to see an inventory built from your own mail.
AegisAI reads the sign-up mail it already sees and builds an inventory of every app adopted with a company identity, AI tools first. Every app announces itself in the inbox with a welcome email, a receipt or a share. Discovery runs on the mail access already in place, with no new agent or proxy3. Shadow IT discovery does not revoke access today, and revocation happens in your identity provider or admin console.
Illustrative example, figures are fictional. A 220 person company runs message trace over 90 days with a contains filter on welcome, verify or receipt. The export holds 310 messages from 47 sender domains. Grouped by domain, that is 47 apps, of which 12 are on the approved list. The OAuth log matches 9 of the other 35; 26 never asked for a grant. Receipts show two teams paying for the same transcription tool. Each of the 35 unapproved apps gets an owner and a two week decision date.
Run the same three searches on your own tenant and compare your counts with these.
Track three numbers from the first full search.
Review all three on day 30 and rerun the saved searches before the next review.
Search admin mail logs for sign-up, verification or receipt subjects, group the results by sender domain, then match each app to a grant record. Message trace searches up to 90 days, and the Google OAuth log records third-party authorizations.
Up to 90 days. The message trace time range defaults to 2 days, and you widen it in the Time range section. Run the search monthly so nothing ages out.
Yes, with more detail. For messages older than 30 days, Email Log Search needs the recipient email address and the message ID. Search recent mail by subject first.
Yes, by default. All users can consent to applications for permissions that do not require administrator consent. Microsoft recommends allowing user consent only for apps from a verified publisher.
No. The UK National Cyber Security Centre advises a positive and no-blame approach to people forced into shadow IT. The UK National Cyber Security Centre also advises giving people a quick way to get services outside the usual list.
