Skip to main content

Detected: Understanding shadow IT detection and management in Substly

Learn more about the Detected feature set in Substly, and how it can help you both monitor and actively handle shadow IT in your environment.

Written by Sabina Mehmedovic


What is Detected?

Substly can automatically detect new services in use, through our integrations with Workspace and Entra as well as our powerful Substly Extension.

You can see all discovered services on the Detected services page in your account. Detected gives you the tools to handle them, too.

Detected - see, monitor and manage your shadow IT with Substly

Handling Detected services

The Detected services page functions as an active checklist of shadow IT discoveries to handle, so you can maintain oversight and reduce the risk of usage flying under the radar.

A Detected service is handled by changing its default status of "Detected" to something else. This ensures an administrator has manually looked at each service, and made a decision on how to proceed.

You can move a detected service to one of three possible statuses:
Approved, Ignored or Flagged.

Shadow IT detection in Substly - approving, ignoring and flagging new SaaS in your environment




Understanding the default Detected status

All discovered services have an initial status of Detected. This means the service has been discovered, but is not yet handled. ​

To make it easier for you to tackle new services, the Detected services page will by default filter your view to display only these services.

Substly shadow IT detection and management - understanding the Ignored status


Understanding the Ignored status

There are plenty of services that are not worth the trouble to actively monitor or manage. You can choose to Ignore such services in order to declutter your view.

This assigns them the Ignored status, keeping the service available in your Detected services view for later review but otherwise out of sight.

Substly shadow IT detection and management - understanding the Ignored status


​You will still be able to visit their Service detail page to follow up on usage levels, and assign them another status if needed.

Substly shadow IT detection and management - deep detail dive on shadow SaaS usage per service


🤔 Are Ignored services still monitored?

Yes! Ignoring a service will not stop tracking usage data - this will still get updated and remain accessible under the service page.


Understanding the Flagged status

Some discovered services might be dangerous, redundant or otherwise inadvisable due to organizational policies.

You can Flag such services to access additional tools for monitoring and management. This will assign the service the Flagged status.

Substly shadow IT detection and management - understanding the Flagged status for high risk SaaS

👋 A service will not get Flagged until you confirm

Do not worry about pressing Flag by accident! On pressing Flag, a modal will pop up where you can set additional options and confirm the action.

Using monitoring and communication tools for Flagged services

On Flagging a service, you will have options for additional monitoring and communication. Don't worry - nothing happens until you press "Flag".

Monitoring and communication tools for unapproved or high risk SaaS and shadow IT through Substly


There are many services which may not be dangerous, but simply are inadvisable to use in your specific organization. Perhaps you would prefer your colleagues use more collaboration friendly, cost effective or safer alternatives.

Substly is a great complement to more heavyweight IT solutions for managing such service usage. Instead of blocking services outright, you can keep an eye on usage and communicate with users as they are using unapproved services.


Get notified about usage

Currently, Substly offers three notification options:

  • Never - Do not send a notification when new usage is detected

  • Weekly Digest - Summarize detected usage, on a weekly basis

  • Slack - Send a notification through our SlackBot when new usage is detected

🤔 Why these specific notification options?

Based on customer feedback, different services need monitoring on different time horizons (where the Weekly Digest tends to be enough for most).

For services with a high risk profile, we recommend discussing stronger and immediate measures with your IT manager or IT partner.

👉 Want notifications in Teams, or further options? Let us know!


Show message to service users

Through the Substly Extension, you can choose to show a browser message to users of a Flagged service - as they are using it.

Communicate and manage users using shadow IT and unapproved apps with Substly Detected for shadow IT management

  • Use the default message as a starting point, or write your own.

  • You can reset to the default message at any time.

  • The message is specific to this service.

Show a custom warning message to users through the browser with Substly as they are using shadow IT and unapproved SaaS apps


Under advanced settings, you can also set how often to show the message to users. By default, this is set to Once and never again.

We recommend being cautious about increasing the frequency unduly: if the users experience annoyance or message saturation, they may opt for workarounds.


Customizing the Flagged message further

By default, the message will use the company logo you have uploaded under Company & Subscription Company settings and refer to the email of the Substly user that activated the Extension.

You can adjust what email is shown in the browser message under
Substly Extension Settings:

Customize what message is shown and pops up in the browsers as users are using an unapproved or new shadow IT SaaS service


Now you're ready to manage your shadow IT!

We hope the Detected feature set in Substly will help you not just monitor, but actively handle, new services as they enter your environment.

Most tools on the market today are complex, heavyweight and adapted for Enterprise clients at the cost of offering a usable alternative for smaller businesses and organizations.

Our vision for Detected is to give fast moving teams the tools to manage the shadow side of rapid SaaS adoption - without slowing productivity down.


📗 Further reading

Did this answer your question?