---
title: Shadow IT Discovery · Cloudflare Zero Trust docs
description: Shadow IT Discovery provides visibility into the SaaS applications and private network origins your users are visiting. This information allows you to create identity and device-driven Zero Trust policies to secure your users and data.
lastUpdated: 2025-01-08T22:36:42.000Z
source_url:
  html: https://patricia-pcx17119-l7-overrides.preview.developers.cloudflare.com/cloudflare-one/insights/analytics/shadow-it-discovery/index.md
  md: https://patricia-pcx17119-l7-overrides.preview.developers.cloudflare.com/cloudflare-one/insights/analytics/shadow-it-discovery/
---

Shadow IT Discovery provides visibility into the SaaS applications and private network origins your users are visiting. This information allows you to create identity and device-driven Zero Trust policies to secure your users and data.

To view Shadow IT Discovery in [Zero Trust](https://one.dash.cloudflare.com), go to **Analytics**, then select **Shadow IT Discovery**.

## Turn on Shadow IT Discovery

To allow Zero Trust to discover shadow IT in your traffic:

* Turn on the [Gateway proxy](https://developers.cloudflare.com/cloudflare-one/policies/gateway/proxy/) for HTTP and network traffic.
* Turn on [TLS decryption](https://developers.cloudflare.com/cloudflare-one/policies/gateway/http-policies/tls-decryption/) to inspect HTTPS traffic.
* Ensure any network traffic you want to inspect is not routed around Gateway by a [Split Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/).

## SaaS applications

For an overview of SaaS applications your users have visited, go to **Analytics** > **Access** > **SaaS**. This tab displays the following information:

* **Unique application users**: Chart showing the number of different users who accessed SaaS applications over time.
* **Top approved applications**: SaaS applications marked as [**Approved**](#approval-status) which had the greatest number of unique visitors.
* **Top unapproved applications**: SaaS applications marked as [**Unapproved**](#approval-status) which had the greatest number of unique visitors.
* **Zero Trust**: Metrics for your Access applications including the total number of accessed applications, failed logins, and connected users over the selected time period.
* **Logins**: Chart showing the number of logins for an individual Access application over time.
* **Top applications accessed**: Access applications with the greatest number of logins.
* **Top connected users**: Users who logged in to the greatest number of Access applications.

### Review discovered applications

You can view a list of all discovered SaaS applications and mark them as approved or unapproved. To review an application:

1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Analytics**, then select **Shadow IT Discovery**
2. Go to **SaaS**.
3. In the **Unique application users** chart, select **Review all**. The table displays the following fields:

| Field | Description |
| - | - |
| Application | SaaS application's name and logo. |
| Application type | [Application type](https://developers.cloudflare.com/cloudflare-one/policies/gateway/application-app-types/#app-types) assigned by Cloudflare Zero Trust. |
| Status | Application's [approval status](#approval-status). |
| Secured | Whether the application is currently secured behind Cloudflare Access. |
| Users | Number of users who connected to the application over the period of time specified on the Shadow IT Discovery overview page. |

1. Select a specific application to view details.
2. Assign a new [approval status](#approval-status) according to your organization's preferences.

The application's status will now be updated across charts and visualizations on the **SaaS** tab. You can block unapproved applications by creating a [Gateway policy](https://developers.cloudflare.com/cloudflare-one/policies/gateway/).

## Private network origins

To see an overview of the private network origins your users have visited, go to **Analytics** > **Access** > **Private Network**. This tab displays the following information:

* **Unique origin users**: Chart showing the number of different users accessing your private network over time.
* **Top approved origins**: Origins marked as [**Approved**](#approval-status) which had the greatest number of unique visitors.
* **Top unapproved origins**: Origins marked as [**Unapproved**](#approval-status) which had the greatest number of unique visitors.
* **Zero Trust**: Metrics for your Access applications including the total number of accessed applications, failed logins, and connected users over the selected time period.
* **Logins**: Chart showing the number of logins for an individual Access application over time.
* **Top applications accessed**: Access applications with the greatest number of logins.
* **Top connected users**: Users who logged in to the greatest number of Access applications.

### Review discovered origins

You can view a list of all discovered origins and mark them as approved or unapproved. To review a private network origin:

1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Analytics**, then select **Shadow IT Discovery**
2. Go to **Private Network**.
3. In the **Unique origin users** chart, select **Review all**. The discovered origins that appear on this page are defined by unique combinations of IP address, port, and protocol.

| Field | Description |
| - | - |
| IP address | Origin's internal IP address in your private network. |
| Port | Port used to connect to the origin. |
| Protocol | Protocol used to connect to the origin. |
| Hostname | Hostname used to access the origin. |
| Status | Origin's [approval status](#approval-status) |
| Users | Number of users who connected to the origin over the period of time specified on the Shadow IT Discovery overview page. |

1. Select a specific origin to view details.
2. Assign a new [approval status](#approval-status) according to your organization's preferences.

The origin's status will now be updated across charts and visualizations on the **Private Network** tab. You can block unapproved origins by creating a [Gateway policy](https://developers.cloudflare.com/cloudflare-one/policies/gateway/).

## Approval status

Within Shadow IT Discovery, applications are labeled according to their status. The default status for a discovered application is **Unreviewed**. Your organization can determine the status of each application and change their status at any time.

Note

Approval status does not impact a user's ability to access the application. Users are allowed or blocked according to your Access and Gateway policies.

| Status | Description |
| - | - |
| Approved | Applications that have been marked as sanctioned by your organization. |
| Unapproved | Applications that have been marked as unsanctioned by your organization. |
| In review | Applications in the process of being reviewed by your organization. |
| Unreviewed | Unknown applications that are neither sanctioned nor being reviewed by your organization at this time. |
