A coordinator signs up for a free design tool with a work email. A salesperson sends a quote through a personal file-transfer site. Someone pastes a client email into a free AI chatbot. These are everyday examples of shadow IT: work apps and services used without the business having agreed how they should be used. Here are practical ways to understand and manage it, without turning the issue into a lecture.
What is shadow IT? Shadow IT is any software, hardware or information technology (IT) resource used on an enterprise network without the IT department’s approval, knowledge or oversight.
H2: What is shadow IT?
Shadow IT describes apps, cloud services and online accounts used for business tasks without being reviewed or approved through the organisation’s usual process. It can include free software, personal accounts and browser add-ons, as well as subscriptions paid on a personal card. This article focuses on apps, accounts and the data held in them.
This is a different issue from malware or hacking: shadow IT can involve ordinary tools being used without the business knowing where work information is stored or who can access it. Our separate guide covers unmanaged devices.
Common examples of Shadow IT in Small Businesses
| Category | Typical examples | What usually happens |
|---|---|---|
| File sharing | Personal Dropbox or Google Drive, free file-transfer sites | Client files leave Microsoft 365 and sit in personal accounts |
| Messaging | WhatsApp groups, personal Gmail | Client conversations live on personal phones and accounts |
| Project and design tools | Free task boards, note apps, design tools | Work data sits in a free account tied to one person |
| AI tools | Free AI chatbots, AI note-takers, AI browser add-ons | Client or staff details are pasted into tools that may keep them |
| Browser extensions | PDF converters, grammar checkers, downloaders | Extensions with access to everything open in the browser |
| Personal-card subscriptions | Paid tools expensed or never claimed | The business pays for tools it doesn’t control |
These are categories, not a list of unsafe brands. The risk comes from unmanaged use and unclear data handling, not from a product name by itself.
Why Staff Turn to Shadow IT?
Shadow IT is often a symptom of people trying to get useful work done. If an approved tool feels slow, is missing a feature or is hard to request, people may choose another option. This is separate from personal browsing or email on a work computer; see our article on using a work computer for personal things.
- The approved tool is slower or missing a feature: A team may need a quick way to collect feedback, share a large file or organise a project. If the approved option does not meet that need, a free alternative can look like the easiest answer.
- Getting a new tool approved takes too long: A long approval process can make people feel they have to choose between waiting and keeping work moving. A simple request route helps the business hear about the need before an account is created.
- Staff do not know an approved option already exists: A business may already have a suitable feature in its Microsoft 365 subscription. If people have not been shown where to find it or how to use it, they may sign up elsewhere.
- Habits carried over from a previous job or home: People often reuse familiar tools because they know how they work. The business can make the transition easier by explaining its approved tools and offering practical guidance.
- A free trial “just for this one project” never ends: A one-off trial can become part of a regular workflow. Without a clear owner and review date, the account and its data may remain after the original need has passed.
Shadow IT Risks for Your Business
Shadow IT risks usually come from a lack of visibility and ownership. A business may not know where client information is stored, who can still access it, or which subscriptions are being paid for. A practical review can help identify these gaps and decide whether to approve a tool, replace it or move work information into a suitable business service.
| Risk | What it looks like | Why it matters |
|---|---|---|
| Data you can’t see | Client files in a personal Dropbox | You can’t search it, recover it or prove where it went |
| Data that leaves with staff | A free project board owned by a former employee | Client history walks out the door (link offboarding checklist) |
| Weak account security | Reused passwords, no MFA on free tools | One leaked password opens several doors (link password manager) |
| Privacy obligations | Customer details pasted into a public AI tool | May breach Privacy Act obligations; see the OAIC guidance |
| Record-keeping gaps | Contracts or approvals in personal email | Hard to find when a client, auditor or insurer asks |
| Wasted spend | Three teams paying for three similar tools | Money spent without anyone deciding to spend it |
The table shows why visibility and ownership matter. A sensible response starts by understanding the tools in use, then deciding what should be approved, replaced or closed. Approved file locations help staff know where business files should live. Review app ownership as part of the offboarding checklist, and consider a business password manager for account credentials. For privacy context, see the OAIC’s guidance on commercially available AI products.
Shadow AI: the Newest Kind of Shadow IT
Free AI tools are an increasingly visible form of shadow IT because they are useful and take seconds to try. The OAIC’s guidance says, as a matter of best practice, organisations should not enter personal information, particularly sensitive information, into publicly available generative AI tools. Banning AI outright can push use out of view, so give staff a clear rule and an approved option instead.Read the OAIC guidance on commercially available AI products.
What to put in place:
- Choose an approved AI tool for work, where it suits the business.
- Write a one-page AI rule: do not enter client or staff personal details into public AI tools.
- Keep a simple list of which AI tools are in use and what they are used for.
- Review AI browser add-ons and meeting note-takers along with other apps.
Not sure what your team is really using? We can review the apps and AI tools in use across your business and recommend approved options that fit the way your team works.
How to Detect Shadow IT
Most small businesses can find the bulk of their shadow IT without buying any new software. These are four checks the business or its IT partner can run.
- Check connected apps in Microsoft 365: Review which third-party apps staff have signed into using their work account. These appear in the Microsoft Entra admin centre.
- Read the card and expense statements: Look for software subscriptions nobody approved.
- Review browser extensions on work computers, especially ones that can read page content.
- Ask your team: A short, no-blame survey (“What tools do you use to get your job done?”) often finds more than any scan.
Warning signs to watch for
- Files arriving as links from services the business doesn’t use
- Colleagues emailing from personal addresses about work
- Client documents that only one person can open
- Logins requested for tools nobody has heard of
Treat these as prompts for a conversation and a practical check, not a reason to monitor staff. The goal is to understand which apps support work and where business information is being kept.
How to Manage Shadow IT
Good shadow IT management combines visibility with useful alternatives. Start by asking what staff need to do, then review the tools they use and agree on a small set of approved options. Make it straightforward to request something new, explain the rules and revisit the list as the business changes.
Build an approved app list
An approved app list gives staff a practical first choice for common tasks. The examples below show options that may already be available in Microsoft 365; confirm the right licensing, configuration and suitability for your organisation before adopting them.
| What staff need | Common shadow IT tool | Approved alternative in Microsoft 365 |
|---|---|---|
| Send large files to clients | Free file-transfer sites, personal Dropbox | OneDrive or SharePoint sharing links |
| Team chat | WhatsApp groups | Microsoft Teams |
| Task boards | Free task-board apps | Microsoft Planner |
| Forms and surveys | Free form builders | Microsoft Forms |
| Notes | Personal note apps | OneNote |
| AI writing and summaries | Free AI chatbots | Microsoft Copilot |
The right choice depends on how your business works and what its Microsoft 365 plan includes. Microsoft Copilot may need an add-on licence on most Business plans, so check licensing before recommending it.
Make requesting a new tool easy
If asking for a tool is quick, people are more likely to ask instead of signing up quietly. Give staff a short form or named contact and explain when they can expect an answer.
The 4 questions to ask before approving any tool:
- Where is our data stored, and can we export it?
- Does it support multi-factor authentication or Microsoft sign-in?
- Who owns the account: the business or one person?
- What does it cost once the free tier runs out?
Control which apps can connect to Microsoft 365
Microsoft 365 administrators can require approval before staff connect third-party apps to work accounts. This is a configuration decision for the business and its IT partner, based on which integrations staff need. Insight IT can help set up approved alternatives in Microsoft 365 as a separate Microsoft 365 service.
Train staff and set expectations early
Cover the approved app list and AI rule during onboarding, then reinforce them in regular awareness sessions. Include new starter IT habits and practical staff security awareness training so people understand both the options and the reasons behind them.
Close shadow IT accounts at offboarding
Add “which apps did this person sign up for?” to the leaving checklist, and move any business data into an approved location before access is closed. See the offboarding checklist for other steps to include.
Can You Eliminate Shadow IT Completely?
Completely eliminating shadow IT is difficult, but you can minimise it through regular monitoring and clear policies. Conduct a quarterly review of connected apps, subscriptions, and staff software usage to identify unauthorised tools and address potential security risks.
Shadow IT Checklist for Small Businesses
- List the apps and AI tools your team actually uses
- Check which third-party apps are connected to work accounts
- Review card and expense statements for unapproved subscriptions
- Publish an approved app list with Microsoft 365 alternatives
- Set a one-page AI rule for client and staff information
- Create a quick way to request new tools
- Add app accounts to the offboarding checklist
- Repeat the review every quarter
How Insight IT Can Help in Preventing Shadow IT?
Shadow IT is a sign that your team may need better tools or a clearer route to get them. The practical goal is visibility plus approved alternatives: understand what is in use, recommend suitable options, set them up where needed and train staff to use them. Insight IT can review the apps your team uses and help your business decide what to approve, replace or close.
What is shadow IT in simple terms?
Shadow IT is software, online services or accounts people use for work without formal approval or oversight from the business. It might be a file-sharing account, a free project tool or an AI chatbot. The term describes how the tool is being used, not whether the product itself is unsafe.
Is using a free AI chatbot at work shadow IT?
It can be. If a staff member uses a publicly available chatbot for business tasks without an agreed process, it may be shadow IT. The key concern is what information is entered and how the service handles it. The OAIC recommends, as a best practice, not entering personal information into publicly available generative AI tools.
Is shadow IT always bad?
No. An unapproved tool may solve a genuine problem and help someone complete work. The issue is that the business may not know where work information sits, who controls the account or what happens when a subscription ends. Reviewing the need and offering a suitable approved option is usually more useful than blaming staff.
How do you detect shadow IT?
Start by reviewing third-party apps connected to work accounts, card and expense statements, and browser extensions. Then ask staff which tools they use to get work done. These checks can reveal unapproved services without monitoring staff. Record what each tool is for, who owns it and whether it should be approved or replaced.
Who is responsible for managing shadow IT in a small business?
The business owner or a nominated manager should set expectations and decide which tools are approved. An IT partner can help review app use, recommend suitable alternatives, configure Microsoft 365 options and train staff. Employees also need a clear way to ask for tools that are missing, so the process supports work rather than slowing it down.
