The Shadow IT Problem at Offboarding: Finding Access You Didn't Know Existed

When an employee leaves, you revoke the accounts you know about: Slack, Notion, GitHub, Google Workspace. But 80% of employees use apps that IT never approved (Cisco, 2026). Those accounts don't appear in any admin panel you control. They persist after the person is gone — active, credentialed, and pointing at your company email domain. Before you can revoke shadow IT access, you have to find it. That's the problem most startup offboarding processes never solve.

Why This Hits Startups Hardest

At a 20-person startup, there's no IT department auditing tool usage. Every employee installs what they need to get work done — an AI writing tool here, a project tracker there, a quick data pipeline SaaS the engineering team found last quarter. Organizations estimate they use around 37 apps; the real number is closer to 625 (WalkMe, 2026). For a startup founder running offboarding without dedicated IT, that gap means you're flying blind on the majority of access that actually exists. This isn't a theoretical risk: 50% of companies found former employees still accessing SaaS applications months after their official departure (AccessOwl, 2026).

Why Shadow IT Is Your Offboarding Blind Spot

Standard offboarding checklists are built around your known stack — the tools HR and engineering approved and provisioned. Shadow IT lives outside that list by definition.

Three patterns generate most of the hidden accounts at startups:

1. Personal-account sign-ups with company email. An employee signs up for a new tool using their work email address. The app never touches your identity provider. It won't appear in your SSO admin panel. It won't show up in an Okta or Google Workspace audit. When you disable the Google account on their last day, the tool keeps working if they set a separate password, or stays dormant but re-activatable if they reset credentials via a forwarded email.

2. OAuth grants to personal accounts. The employee connects a personal Google or GitHub account to a company-owned repo or document. Revoking their corporate identity doesn't touch the personal OAuth grant. The repo stays accessible.

3. AI tools and new-category SaaS. 91% of AI tools used in the workplace are completely unmanaged (Torii, 2026). An employee using an AI coding assistant, a data enrichment API, or an AI writing tool may have fed it context from your codebase or customer data. Deprovisioning their email does nothing to those connections.

The result: your "done" offboarding checklist has a hole in it you can't see.

4 Ways to Find SaaS Access You Didn't Sanction

You don't need an enterprise IAM platform to do shadow IT discovery. These four methods work at a startup without dedicated IT — pick the combination that fits your current headcount and risk tolerance.

Method 1: Scan Email Sign-Up Confirmation Threads

Before you revoke the departing employee's Google Workspace or Microsoft 365 account, search their inbox for sign-up confirmation emails and "welcome to [app]" messages sent to their work address. This is crude but highly effective — every SaaS tool sends at least one email when an account is created.

Search terms to use in Gmail or Outlook:

• subject:"welcome to"
• subject:"confirm your email"
• subject:"verify your account"
• subject:"your account is ready"

Build a running list of every tool you find. Cross-reference against your approved stack. Anything not on the approved list is a candidate for revocation.

Time required: 20-30 minutes per employee. Worth it for any departure where the person had broad access to customer data, codebase, or financial tools.

Method 2: Pull OAuth Grants from Your Identity Provider

If you use Google Workspace or Microsoft 365 as your identity provider, both have admin-accessible OAuth grant logs. These show every third-party app that has been authorized using a corporate identity — including apps employees added themselves.

In Google Workspace: Admin Console → Security → API Controls → App Access Control. Filter by user. Export the list before deactivating the account.

In Microsoft 365: Azure AD → Enterprise Applications → filter by user. Look for "User Consent" grants specifically — these are apps users approved themselves, not IT.

OAuth logs catch a different category of shadow IT than email search — specifically tools the employee authenticated into using their corporate SSO, even if you didn't provision them. A data analyst who connected a personal BI tool to your Google Drive via OAuth will appear here.

Method 3: Check Expense Reports and Credit Card Statements

Most SaaS tools charge monthly or annually. An employee who signed up for a paid tool on the company card left a paper trail. Go back 12 months of corporate card transactions and flag recurring charges you can't attribute to your approved stack.

This method catches shadow IT with a subscription — AI tools, premium tiers of freemium products, specialized SaaS the team expensed informally. It won't catch free-tier tools, but paid shadow IT carries higher risk: the vendor has a billing relationship tied to your domain.

Method 4: Ask the Departing Employee Directly

This is underused and effective for voluntary departures. As part of the offboarding process, ask the employee to complete a "tools I use" disclosure form before their last day. Frame it neutrally — you're updating the company's tool inventory, not auditing compliance.

Most people will disclose honestly. The ones who don't will still trigger an obligation you can reference later if a security issue surfaces. For key technical hires (engineers, data, ops), this conversation is worth having with a manager present.

What to Do Once You Find Shadow Access

Finding the accounts is step one. Dealing with them varies by type:

Personal-account sign-ups with company email: Request an account deletion or email change from the vendor. Most tools have a "change email address" option the admin can use. If the person is no longer reachable, contact the vendor's support team with proof of domain ownership — most reputable SaaS companies will respond to a formal account removal request tied to a corporate email domain.

OAuth grants: Revoke from your identity provider's admin panel. In Google Workspace, you can revoke a specific OAuth grant without disabling the account — useful if you want to keep the account active briefly for email forwarding. Do this before you disable the corporate account, not after.

Shared or team-level tools: If the employee had admin rights in a tool your company legitimately uses, demote them to a non-admin role first, then remove them. Removing an admin from a tool can sometimes delete data or break automations — demote first, then audit what they owned, then remove.

Unknown/uncategorized tools: If you find an app you can't identify — the employee used something you've never heard of — take 10 minutes to understand what it is before revoking. An engineer using an obscure internal tooling app may have built something that depends on it. A marketer using a niche analytics tool may have historical data you need to export first.

Add every discovered tool to your company's official tool inventory, even if you're revoking access. This builds the visibility you need for future quarterly access reviews. See our guide on running a quarterly access review as a startup without IT for how to maintain that inventory over time.

Making Discovery Repeatable (Not a Panic at Every Exit)

Doing shadow IT discovery from scratch at every offboarding is exhausting and inconsistent. The goal is to shift from reactive (someone's leaving, now I have to find everything) to proactive (I always know what tools exist, so offboarding is just revocation).

Three practices that reduce your discovery burden over time:

1. Add a "tools disclosure" step to onboarding. When a new hire joins, ask them to document the tools they plan to use that aren't in your official stack. This isn't about policing tool choice — it's about capturing intent before the tool becomes shadow IT. Many startups add this as one line in their onboarding checklist: "List any tools you're bringing in that aren't on the company-approved list." See how to provision new hire access without overprovisioning for where this fits in the first-week workflow.

2. Run an OAuth audit quarterly. Pull OAuth grants from your Google Workspace or M365 admin panel once a quarter. It takes 15 minutes and catches drift before anyone leaves. New OAuth connections that appear between quarters are worth a quick "what is this?" to the relevant employee — usually benign, occasionally not.

3. Capture shadow IT on the way in when someone exits voluntarily. For planned departures with two weeks' notice, you have time to run the email scan and OAuth pull before their last day. For immediate terminations, the 30-minute SaaS revocation protocol covers the triage priority order.

The underlying problem — that most startups don't know what tools employees are using — is part of a broader SaaS access sprawl issue that shadow IT discovery is one piece of solving.

Discovery Method Comparison

Recommendation: For departures at 20-person startups, run the email scan + OAuth pull on every exit. Add expense review quarterly. Use disclosure forms at onboarding and as part of final-week exit process for voluntary departures.

FAQ

What is shadow IT in the context of employee offboarding? Shadow IT refers to software, SaaS tools, and apps that employees use without formal IT or management approval — typically because they signed up independently using their work email. At offboarding, shadow IT is the access you can't revoke because you don't know it exists. Discovery methods like email scanning and OAuth log review help surface it before you close out an employee's accounts.

Can revoking a corporate email account also revoke shadow IT access? Only partially. Revoking a corporate Google or Microsoft account will block email delivery and disable SSO logins that route through that identity provider. But it won't affect apps the employee accessed with a separate password, personal OAuth connections, or tools that cached authentication tokens before the account was disabled. Discovery and explicit revocation per tool are still required for complete coverage.

How do I know which shadow IT apps are actually risky? Prioritize by data exposure. Tools that had access to customer data, source code, financial records, or production systems are highest priority regardless of whether they were sanctioned. Tools used for personal productivity (note-taking, personal task management) are lower risk. When in doubt, revoke access and let the employee know what you're doing — for voluntary departures, this is a normal part of the offboarding conversation.

Do I need a dedicated SaaS management tool to discover shadow IT? Not at startup scale. Enterprise tools like Nudge Security, BetterCloud, or Torii automate shadow IT discovery continuously — useful at 200+ employees. At 10-50 people, the email scan + OAuth pull combination covers the majority of risk. The cost-benefit math for a dedicated tool changes around the 100-employee mark, or earlier if your team has particularly high SaaS adoption (engineering-heavy teams, growth teams using a lot of marketing SaaS).

How Optserv Handles This

Optserv builds shadow IT discovery into the offboarding workflow — not as a separate audit step, but as part of the same flow where you deactivate the employee's core accounts. When you trigger offboarding in Optserv, it surfaces connected apps via OAuth log integration and prompts you to resolve each one before closing out the employee record. The goal: offboarding that's actually complete, not just the tools you happened to remember.

Start a free trial at app.optserv.ai — no IT team required.

Sources

• Cisco: 80% of company employees use shadow IT — via IBM Think "What Is Shadow IT?" (2026)
• WalkMe: Organizations estimate 37 apps; actual average is 625 — enterprise SaaS adoption research (2026)
• Torii: 91% of AI tools used at work are unmanaged — Torii 2026 SaaS benchmark
• AccessOwl: 50% of companies found former employees still accessing SaaS months after departure — AccessOwl offboarding automation research (2026)

Optserv Team