Shadow SaaS
Detects shadow SaaS / unsanctioned cloud application usage in the tenant.
What it does
Combines Microsoft Graph signals to surface unsanctioned SaaS applications accessed by the workforce: 1. OAuth2 permission grants -> apps users (or admins) consented to 2. Sign-in logs -> apps users actually authenticated to 3. Service principal catalog -> first-party vs third-party publishers A simple risk score classifies each application: High - third-party + user-consented + accessed in last 30 days Medium - third-party + accessed in last 90 days OR user-consented inactive Low - first-party / verified publisher / unused Unsanctioned - no admin consent and no app role assignment, but used Outputs: - ShadowSaaSApps.csv : per-application aggregate with risk band - ShadowSaaSConsents.csv : raw OAuth2 consent grants - ShadowSaaSOAuthScanner.csv : per-app OAuth risk scoring (Snow Atlas / Flexera parity) scope-risk classification, exposure score (0-10), high-risk scope flags (Mail.ReadWrite, Files.ReadWrite.All, Directory.ReadWrite.All, Sites.FullControl.All, etc.) ENRICHED: Pure testable functions for query building and response mapping. Multi-strategy collection with graceful fallback - both paths emit same columns.
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/shadow-saa-s Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.