From Zero to Full SaaS Visibility in 15 Minutes: The Discovery Setup Guide

Originally published in 2025, when SaaSVista focused on shadow SaaS discovery. Edited and republished in October 2026.

Remember the last time you tried to audit your company’s SaaS applications?

It probably involved a spreadsheet, a survey to department heads, a few afternoons in expense reports, and some choice words about shadow IT. And when you finished, you still had the nagging feeling that the list was short.

It was short. It always is.

I need to be honest about the title before we go any further. Fifteen minutes doesn’t get you a finished inventory. It gets you a first pass from your identity provider, and that first pass is usually the biggest single chunk of the picture. The rest takes longer. I’ll show you where to look for it.

You don’t need to buy anything to do this. Every step below uses admin consoles you already have.

---

Why the Usual Approaches Come Up Short

I’ve spent 30 years in IT security and infrastructure, and I’ve watched teams run the same three plays over and over.

The manual audit. Somebody gets assigned a spreadsheet and starts asking around. It takes weeks, it’s out of date the day it’s done, and it only captures the apps people think to mention.

The user survey. You ask every team what they use. People forget. People leave off the tool they signed up for last month with a company card. A few leave things off on purpose because they don’t want it taken away.

Expense-report digging. Finance data is real evidence, which is more than you can say for a survey. But it lags, it misses anything on a free tier, and a line item that reads like a payment processor’s name tells you nothing about which app it is.

All three share the same flaw. They ask people, or paperwork, what’s in use. The better question is where the evidence already sits. Every SaaS app leaves a trail when someone signs in to it, when it sends an email, and when it runs in a browser. Go read the trail.

---

Source One: Your Identity Provider

Start here. This is your fifteen minutes.

Your identity provider records two things you care about. First, the apps IT connected on purpose for single sign-on. Second, and more interesting, the third-party apps that employees authorized on their own by clicking “Sign in with Google” or “Sign in with Microsoft” and approving a permissions prompt. That second group is where shadow SaaS lives.

You need admin rights, or at least a read-only admin role, in whichever of these you run.

Microsoft Entra ID (formerly Azure AD)

Open Enterprise applications in the Entra admin center. That list is every application with a presence in your tenant, including the ones a user consented to without asking anybody. For any app that looks unfamiliar, open it and look at its permissions. You’ll see what was granted and whether an admin granted it for the whole organization or individual users granted it for themselves.

The sign-in logs tell you whether anyone still uses the app. An app with broad permissions and no recent sign-ins is the first thing I’d clean up.

Google Workspace

In the Admin console, look in the Security area for the API controls, where Google manages third-party app access. It shows the outside apps your users have authorized with their Workspace accounts and which Google services each one asked to reach, such as Drive, Gmail, or Calendar.

Sort by the access requested, not by the number of users. One person granting an unknown app full access to Drive matters more than fifty people using a calendar scheduler.

Okta

Okta’s application list and its application usage reporting show you what’s integrated and who’s signing in. The System Log is where you go to see authentication activity in detail.

One caution. Okta only knows about apps that authenticate through Okta. If your users also sign in to things with their Google or Microsoft accounts, those grants are recorded in Google or Microsoft, not in Okta. Plenty of companies run Okta in front of Workspace or Microsoft 365. If that’s you, check both.

What you have after fifteen minutes

A list of app names, what each one can touch, and roughly who uses it. Export it or copy it into a sheet.

That isn’t everything. It’s missing every app someone signed up for with an email address and a password. That’s the next source.

---

Source Two: Email Signals

Every SaaS product sends mail. Sign up, and you get a confirmation. Start a trial, and two weeks later you get a notice that it’s ending. Pay, and you get a receipt every month. Those messages land in company mailboxes whether or not the app ever touched single sign-on.

The patterns worth looking for:

• Sign-up confirmations and “verify your email” messages
• Welcome messages from a product you don’t recognize
• Trial-ending notices
• Renewal reminders
• Invoices and payment receipts

Start with the mailboxes that belong to the company and not to a person. The accounts payable inbox, the shared IT inbox, any billing or purchasing alias. Invoices and renewal notices pile up there, and searching them doesn’t raise a privacy question.

Beyond that, both Microsoft 365 and Google Workspace give admins a way to search mail flow by sender without opening anybody’s messages. Microsoft calls it message trace. Google calls it email log search. Searching for mail from a known vendor’s domain tells you which employees have accounts there.

Slow down before you go further than that. Reading the contents of employee mailboxes is a different activity with different rules, and in a lot of places it’s a legal question as much as a technical one. Talk to HR and legal first. Sender-level metadata and company-owned inboxes will get you most of what you need anyway.

---

Source Three: Endpoint and Browser Signals

The first two sources tell you what people signed up for. This one tells you what they open.

Where you look depends on what you already run:

• Managed browsers. If you manage Chrome or Edge centrally, you can inventory installed extensions. Extensions are an overlooked category. Many of them are SaaS products with access to every page the user visits.
• Device management. Your MDM or endpoint management tool keeps a software inventory. Desktop clients for SaaS products show up there.
• DNS and web gateway logs. If you run a DNS filter or a secure web gateway, its reporting shows which SaaS domains your network talks to, and how often.

This source is the noisiest of the three. A domain in a DNS log could be one person reading a vendor’s blog. Use it to confirm and fill in what the other two found, and to catch the stragglers neither one saw.

No gateway and no MDM? Skip it for now. Two sources done well beat three done badly.

---

What to Do With the List

A list of app names isn’t worth much on its own. Four columns turn it into something you can act on.

Owner. Who in the business is responsible for this app? Not who signed up. Who would notice if it disappeared. If nobody claims it, that’s your answer about whether you need it.

Data touched. What does the app hold or reach? Customer records, source code, employee data, files in your shared drive. The permissions you saw in the identity provider answer part of this. The owner answers the rest.

Duplicates. You’ll find several tools doing the same job. Three project trackers. Two e-signature products. A handful of note-takers. You don’t have to consolidate them this week. Just mark them.

Renewal date. For anything paid, when does it renew? This column decides the order you work in. An app that renews next month gets a decision now.

Then sort by data touched. The apps that reach sensitive data and have no owner go to the top. Deal with those first, and let the duplicate note-takers wait.

One more thing. Don’t open with a ban. People bought these tools because they had work to do and the approved option was slow, missing, or bad. If the first thing they hear from IT is “that’s not allowed,” the next tool just gets hidden better.

---

Make It a Habit

A discovery pass is a snapshot. New apps arrive every week.

Put the identity provider review on a recurring calendar slot. It’s the fifteen-minute part, so it’s cheap to repeat. If your identity provider lets you require admin approval before users can grant access to third-party apps, think hard about turning that on. It moves the conversation to the moment someone wants the tool, which is a much easier conversation than the one you have a year later.

And keep the list somewhere people can see it. An inventory nobody reads goes stale as fast as one nobody wrote.

---

Key Takeaways

• Fifteen minutes gets you a first pass from your identity provider, not a finished inventory
• Audits, surveys, and expense reports ask people what’s in use. The better evidence is already in your admin consoles
• The identity provider gives you the largest share of the picture: SSO-connected apps plus the third-party access users granted on their own
• Okta only sees what authenticates through Okta. Check Google Workspace or Microsoft Entra ID too if your users sign in with those accounts
• Email signals catch the apps that never touched single sign-on. Start with company-owned inboxes and sender metadata, and involve HR and legal before going further
• Endpoint and browser signals are noisy. Use them to confirm and fill gaps
• For every app, record an owner, the data it touches, its duplicates, and its renewal date. Then work the list by data sensitivity
• The same habit applies to AI tools. You can’t govern what you haven’t inventoried, and that’s where AI governance starts

See how SaaSVista approaches AI governance today →