# How do we find SaaS apps that nobody approved?

Combine a few cheap sources, because none of them sees everything. The identity provider shows which apps people sign into with their company account, including OAuth apps they connected to mail or files. Expense reports and card statements reveal subscriptions bought by teams. Browser and endpoint management can list installed extensions and desktop apps. DNS logs and firewall or proxy logs show which services company devices reach. Then sort the list: tools that duplicate an approved one, tools that hold company or customer data, and harmless ones. For each tool that handles data, decide to approve it properly, with a contract and admin control, replace it, or retire it, and tell the users why. Doing this once a quarter keeps the list short. A network view helps with the reach part: NetSenX shows which hosts connect to which destinations, with a dedicated view for AI services from the Pro plan; it does not identify every SaaS application by name, and it does not see sign-ins or app consents, which live in the identity provider.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/how-to-find-saas-apps-nobody-approved

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [What are CSPM, CASB and SSPM, and do we need them?](https://netsenx.com/en/faq/what-are-cspm-casb-and-sspm)
- [What should we ask a SaaS vendor about security before signing?](https://netsenx.com/en/faq/what-should-we-ask-a-saas-vendor-about-security)
- [Who is responsible when our SaaS provider is breached?](https://netsenx.com/en/faq/who-is-responsible-when-a-saas-provider-is-breached)
- [Does NIS2 make us responsible for our cloud providers' security?](https://netsenx.com/en/faq/does-nis2-make-us-responsible-for-our-cloud-providers)
- [What do we do if a cloud or SaaS account is compromised?](https://netsenx.com/en/faq/what-to-do-if-a-cloud-account-is-compromised)