ShadowSaaS
Detects shadow SaaS / unsanctioned cloud application usage in the tenant.
What it does
Combines Microsoft Graph signals to surface unsanctioned SaaS applications accessed by the workforce: 1. OAuth2 permission grants -> apps users (or admins) consented to 2. Sign-in logs -> apps users actually authenticated to 3. Service principal catalog -> first-party vs third-party publishers A simple risk score classifies each application: High - third-party + user-consented + accessed in last 30 days Medium - third-party + accessed in last 90 days OR user-consented inactive Low - first-party / verified publisher / unused Unsanctioned - no admin consent and no app role assignment, but used Outputs: - ShadowSaaSApps.csv : per-application aggregate with risk band - ShadowSaaSConsents.csv : raw OAuth2 consent grants - ShadowSaaSOAuthScanner.csv : per-app OAuth risk scoring (Snow Atlas / Flexera parity) scope-risk classification, exposure score (0-10), high-risk scope flags (Mail.ReadWrite, Files.ReadWrite.All, Directory.ReadWrite.All, Sites.FullControl.All, etc.) ENRICHED: Pure testable functions for query building and response mapping. Multi-strategy collection with graceful fallback - both paths emit same columns.
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/shadow-saa-s Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.