Shadow Apps

The term "shadow applications" generally refers to software applications that are used within an organization without the explicit knowledge or approval of the IT (Information Technology) department. These applications are often introduced by individual employees or departments to address specific needs or tasks.

A shadow app is an application that has been discovered by AppNavi but is not officially authorized by the company. A shadow app can also violate a company's policies and therefore be "not compliant".

What is a Shadow App

A Shadow App is any software application that:

• Is discovered by AppNavi through user activity
• Has not been officially approved by IT
• Marked as Not Compliant based on internal policies

These apps are often introduced by employees or teams to fulfill specific needs but operate outside the controlled IT environment.

Shadow App vs Company App

Shadow Apps and Company Apps represent different classifications of discovered applications.

For more information about managing authorized applications, see Company Apps.

Accessing Shadow Apps

1. Navigate to the Discovery tab
2. Open the App Overview section
3. Select the Shadow Apps option from the top navigation bar

This displays a dedicated table listing all detected shadow apps.

Shadow App Table Columns

Each row in the table represents a discovered shadow app. The following columns are displayed:

• Title: Name of the application (editable)
• Application: URL of the application
• Business Capabilities: Associated capabilities (if any)
• Category: Application's business category
• Hosting: Indicates hosting type (if available)
• Not Compliant: Highlights whether the app meets compliance requirements

The Title column remains sticky for easy identification while scrolling.

Table Filters and Grid Functionality

The Shadow App table uses AG Grid, which provides powerful filtering capabilities:

• Users can apply Advanced Filters using operators such as:
  • Equals
  • Exists
  • Contains
  • Begins With
• Filters are available for fields like:
  • Business Capabilities
  • Category
  • Hosting
  • Not Compliant

Context Menu Options

Hovering over a row or selecting one or more apps enables the context menu with the following options:

Edit Shadow App

Clicking Edit opens a dialog with the following editable fields:

• Title
• Application URL
• Vendor
• Category
• Hosting
• Privacy policy
• Terms of Service

Note: Enabling Company App will automatically disable the Not Compliant flag. This setting cannot be modified when Company App is active.

Managing Shadow Apps

After reviewing a shadow app, administrators can decide how the application should be handled based on organizational requirements.

Classify as a Company App

If a shadow app is reviewed and approved for official company use, it can be classified as a Company App.

For example, an employee may start using a project-management application that was not previously classified by IT. After IT reviews the application and approves its use, the application can be classified as a Company App.

To learn more about Company Apps and classification rules, see Company Apps.

Review and Manage Risk

If an application is allowed to remain in use but has security, compliance, or legal concerns, administrators can review and assign the appropriate risks.

For example:

• A SaaS application may require a security review because company data is stored with an external vendor.
• An application may have compliance concerns because it does not meet an organization's internal requirements.
• An application may have legal concerns related to licensing or terms of service.

For more information, see Risk Overview.

Archive Shadow App

If an application is no longer relevant or should no longer appear in active discovery results, it can be archived.

For example, an employee may have used a temporary online tool for a completed project. If the application is no longer required, the administrator can archive it instead of keeping it in the active Shadow Apps list.

• Select the app(s) using the checkbox beside the title
• Click the context menu (top-right of the table)
• Choose Archive

Archived apps are removed from the Shadow and Discovered Apps lists. Their data is excluded from visualizations after the nightly system update.

Add an Application to the Blacklist

If an application is known to be non-business-related and should not be tracked as a discovered application, administrators can use the blacklist functionality where appropriate.

For example, applications used exclusively for personal entertainment, private streaming, or gaming may be suitable candidates for blacklisting when they have no business relevance.

Blacklisting is different from archiving. Blacklisting prevents the application from being identified as a discovered app at the client side, while archiving removes an existing application from the Shadow and Discovered Apps lists.

For more information, see Blacklist.

Classification Rules

Shadow apps are not assigned specific classification rules. Any app that does not match the rules for Company Apps is automatically listed as a Shadow App.

Company App classification rules can be managed from Discovery Settings.

Export Shadow App Data

Users can download the list of shadow apps:

1. Click the context menu beside the search bar
2. Select the Download option
3. A CSV file will be generated with the current table view

This feature helps retain a local copy of shadow app insights for auditing or analysis purposes.