Topic starter
12/06/2026 12:18 am
TL;DR: Shadow IT remains a governance problem because employees adopt unapproved SaaS tools faster than IT can inventory, review, and retire them, while MSPs can centralise discovery, controls, and lifecycle workflows, according to Josys. The real issue is not just visibility, but whether access, approval, and offboarding processes can keep pace with unsanctioned usage.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “How MSPs Can Tackle Shadow IT”.
By the numbers:
- One MSP managing 50 client environments identified 30% more SaaS tools than initially known.
Key questions
Q: How should MSPs discover shadow IT across client environments?
A: MSPs should use multiple discovery sources, including traffic scanning, SSO telemetry, finance records, and application inventories.
Q: What happens when shadow SaaS is found but not lifecycle-managed?
A: When shadow SaaS is discovered but not lifecycle-managed, the organisation gains visibility without control.
Q: How do organisations know whether shadow IT controls are actually working?
A: They should look for shrinking gaps between discovered apps and remediated access, not just a larger inventory.
Practitioner guidance
- Build a multi-source SaaS discovery baseline Combine traffic scanning, SSO data, and finance system records to produce one reconciled view of sanctioned and unsanctioned applications.
- Attach every discovered app to a lifecycle owner Require an owner, risk tier, and approval path for each application so discovery always leads to a governance decision.
- Automate SaaS onboarding and offboarding steps Standardise account creation, license assignment, security configuration, data backup, access revocation, and license recovery.
Bottom line: Shadow IT becomes a governance exposure when unapproved SaaS escapes normal approval and retirement controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 9:27 am
Shadow IT is really a lifecycle governance problem disguised as a visibility problem. Discovery matters, but discovery alone does not remove risk if the organisation cannot approve, constrain, review, and retire applications with the same discipline it applies to identities. The article’s MSP framing is useful because it shows that app sprawl becomes manageable only when governance owns the full lifecycle. The practitioner conclusion is simple: inventory without lifecycle control is an incomplete control.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between discovering shadow IT and governing it?
A: Discovery tells you which SaaS tools exist and who is using them. Governance adds policy, access control, lifecycle ownership, and offboarding so the organisation can decide which apps stay, which are restricted, and which are removed entirely.
👉 Read our full editorial: Shadow IT governance for MSPs: visibility, control, and lifecycle