Shadow IT

How it works

Nobody plans shadow IT. It accumulates, one reasonable decision at a time. A free SaaS tier signed up with a work email and a personal password. A scanner app from the store that uploads every document to a cloud nobody vetted. A shift schedule living in a WhatsApp group because the rota tool is painful on a phone. Since 2024, a growing share of it is AI chatbots, with customer data pasted into a consumer account because the answer was better than the internal tool's.

A bad internal app store is one of the biggest producers of it. Four apps in the catalog, two of them outdated, a request form that takes three days, names like APP_PROD_V2 that mean nothing to a user, no search, and a login screen before you can even look. Put that in front of a technician who needs a working tool before his next site visit, and he will install something from the public store. He isn't wrong. The sanctioned path failed him first.

BYOD makes it worse for a structural reason: you can't inventory a device you don't manage, and you shouldn't try. Android's work profile is designed so the management server sees work-profile apps and nothing on the personal side. Apple's User Enrollment reports managed apps only. That's correct privacy behavior, and it also means a personal-device fleet gives you a partial picture by design.

Why it matters for a fleet

The data goes where you can't follow it. No retention rules, no legal basis recorded for a GDPR register, no way to revoke access when the person leaves, and an unanswerable question during an incident: which third parties held a copy of this file. Gartner has been saying since 2023 that by 2027 three quarters of employees will acquire or build technology outside IT's visibility, and mobile is where that happens first.

Measuring it is mostly plumbing. App inventory from the MDM on company-owned devices gives you the ground truth there. Your identity provider's logs show OAuth grants to applications nobody approved. Expense reports and card statements reveal paid subscriptions. DNS or proxy logs show the SaaS domains in daily use. Cross those four and the real list is usually twice what anyone expected.

The fix is not a longer blocklist. Bans push the same behavior onto personal devices where you have no visibility at all. What works is making the sanctioned route faster than the unsanctioned one: a catalog people can search, self-service installs with no ticket, a request path answered in two days, an equivalent offered when an app is refused, and a written reason so the refusal doesn't look arbitrary. Block the handful of apps that genuinely leak data, and spend the rest of the effort on the catalog.

How Appaloosa handles it

On managed devices, Appaloosa reports the installed app inventory, so you know what's actually out there instead of guessing. The counter-offer is the catalog: public apps through Managed Google Play and Apple VPP, your private builds, assigned per group and installable by the user without a ticket. Apps you don't want can be kept out of a managed device, and work data can be removed selectively when someone leaves. Start with the Mobile Application Management page.