Last verified April 2026
Method 2 of 4
SSO Gap Analysis: Surfacing Unauthorized Apps from Your IdP
The fastest first read on shadow IT. Export the app list from your identity provider, cross-reference against your approved catalog, catalog the gap. Half a day's work, typically 40 to 70 percent coverage.
Why this method is first
Every mid-market organization has an identity provider (Okta, Microsoft Entra ID, Google Workspace, JumpCloud, OneLogin, or similar). The IdP maintains a directory of applications it federates for single sign-on, plus a separate directory of OAuth consent grants for third-party apps users have connected. Both directories are immediately available, require no new tool procurement, and are actual evidence of use (a user had to authenticate for the entry to exist).
This method is first because it is cheap, fast, and produces a baseline you then compare everything else against. Running expense audit or CASB without the SSO gap baseline creates re-work: you end up reconciling the same apps multiple times across methods.
The step-by-step method
- Export your IdP's federated application list. Okta: Applications export via admin API or console. Entra ID: Enterprise Applications blade, All Applications, export. Google Workspace: Security > SAML apps.
- Export your IdP's OAuth consent grant list. This is often the more valuable list. Entra ID: Enterprise Applications, filter for 'Application Type: All Applications', then cross-reference with the OAuth consent report. Google Workspace: Security > API Controls > App access control. Okta: under the OAuth app grants section.
- Merge the two lists, de-duplicating by app name. Add a column for authentication type (SAML, OAuth, both).
- Load your approved application catalog from whichever source owns it (GRC tool, IT asset management system, or a spreadsheet). Normalize app names across the two sources (the IdP calls it 'Google Drive', the catalog calls it 'Google Workspace'; unify before comparing).
- Compare. The gap is the set of apps in the IdP list that do not appear in the approved catalog. That is your shadow IT baseline from this method.
- For each gap app, capture: user count, first-seen date if available, and obvious department concentration (if 80 percent of users of an app come from one department, that department owns the disposition conversation).
- Decide disposition per app: approve, consolidate, retire, require controls. Record in the consolidated registry template from the discovery methods overview.
What this method misses
Apps that are not configured for SSO and not integrated via OAuth. Free-tier apps where users signed up with work email but never connected to the IdP. Browser-based tools that require no account at all. Apps authenticated via passwords stored in a password manager. Apps on personal devices. These blind spots mean SSO gap alone is usually 40 to 70 percent of the total portfolio. Expense audit captures most of the remainder with a financial trail; browser inventory and survey close the last-mile gap for free-tier and hidden use.
Shadow AI angle
OAuth consent grants are the single most valuable source for shadow AI discovery in most mid-market organizations. AI assistants, meeting bots, and agent platforms typically onboard users via OAuth rather than SAML. The Entra ID or Google Workspace OAuth consent report often surfaces dozens of AI-category OAuth grants that have never been through IT review. Prioritize this export early in the sprint.
Rough time budget
- Export SAML/OAuth app lists: 30 minutes
- Normalize names and merge with approved catalog: 2 hours
- Assign dispositions and owners: 2 to 4 hours (depends on gap size)
- Document in consolidated registry: 1 hour
Method 1
CASB / network analysis ->
Method 3
Expense audit ->
Cost bucket
Observable spend ->