Lab 1 — Visibility into Shadow IT and SaaS Usage

🔄

Switch to Enterprise Tenant (Tenant 1)
Lab Setup was completed in the Lab Tenant. Labs 1–4 use the Enterprise Tenant (Tenant 1). Log out of the Lab Tenant and log in at https://sdc.zslogin.net/ using your Enterprise Tenant Admin credentials before proceeding.

Lab 1⏱ 15 min🏢 Enterprise Tenant · Read-Only👤 Alex

Visibility into Shadow IT and SaaS Usage

Dataparity's security team currently has limited visibility into which cloud applications employees are using. Unmanaged or unsanctioned applications may introduce significant security and data protection risks. You are Alex, a Security Analyst responsible for identifying shadow IT usage before it becomes a data exfiltration or compliance risk.

🔍

Alex — Security Analyst

Enterprise Tenant (Read-Only) — Observation Mode

You are Alex. Your first objective is to understand the scale of SaaS application usage across the organization and identify which applications are sanctioned versus unsanctioned.

🎯Establish foundational visibility into SaaS usage, application instances, and sensitive data activity across the organization.

Task 1: Discover Shadow IT using the SaaS Security Report

🎯Identify unsanctioned cloud applications and understand their potential risk to the organization.

Analytics → Experience Center

Experience Center — centralized visibility into network, SaaS, and application usage across the organization.

The Experience Center aggregates data from multiple security services to provide a unified visibility platform.

Locate the Switch to Existing Reports toggle in the lower-left corner and ensure it is enabled.

Switch to Existing Reports toggle — enables detailed operational visibility into SaaS usage and shadow IT discovery.

Analytics → SaaS Security Report

Analytics → SaaS Security Report — primary tool for discovering shadow IT activity across the organization.

💡 Facilitator Notes

Explain that this report is the primary tool used to discover shadow IT activity across the organization. Everything visible here was discovered passively — no agents, no network taps.

Observe the following metrics in the Overview section, then review Top Application Categories and Applications by Risk Index:

Metric	What it tells you
Total Applications	Number of unique SaaS applications detected
Total Bytes	Total volume of data transferred
Upload Bytes	Data leaving the organization
Download Bytes	Data entering the organization

Overview metrics and Risk Index distribution — a large number of applications combined with significant upload activity may indicate increased risk of data exposure.

💡 Key Insight

Risk Index scoring helps prioritize investigation and remediation efforts based on potential security impact. Focus on high-risk unsanctioned apps with upload capability first.

Locate an application marked as Unsanctioned — for example, Dropbox — and click the application name to view detailed risk information.

Clicking an unsanctioned application to drill into its risk profile.

Review the application risk details:

• Application Status — Sanctioned or unsanctioned
• Risk Index — Relative risk level
• Activities Supported — Upload, Download, Share, Edit, Delete

Application risk details — status, Risk Index, and supported activities for the selected unsanctioned app.

💡 Facilitator Notes

Emphasize that applications supporting file upload and sharing capabilities present higher data exfiltration risk. An unsanctioned file-sharing app with upload capability is a potential exfiltration vector for files like Dataparity's payroll report.

💬 Discussion

• How many unsanctioned applications exist in the environment?
• Which application categories present the highest risk?
• What types of data could be exposed through unsanctioned file-sharing applications?
• Should all unsanctioned applications be blocked, or should risk-based prioritization be applied?

💡 Key Takeaway

You cannot protect what you cannot see. Shadow IT discovery provides the visibility required to identify potential data exfiltration vectors before applying security controls.

---

Task 2: Discover Application Instances

🎯Identify individual SaaS application instances (domains) and understand which users are accessing them.

Analytics → Instance Discovery Report

Select the desired time range (for example, Last Quarter) and choose an application such as Gmail to review detected instances.

Instance Discovery Report — multiple instances of the same SaaS application may exist, including corporate and personal accounts.

Review the list of detected domains associated with the selected application. Click a domain such as gmail.com to investigate usage details. Then click the Analyze More button to drill deeper into the domain activity.

Detected domains — click a domain then click Analyze More to investigate user-level activity details.

💡 Facilitator Notes

Explain that each domain represents a distinct application instance. A user accessing gmail.com via a personal account vs. a corporate workspace.google.com account represents two different risk profiles — this report surfaces both.

Observe the list of users interacting with the selected domain and review their activity:

• Upload Bytes
• Download Bytes
• Number of Transactions
• Last Accessed

User activity — instance-level visibility helps security teams identify unmanaged or personal account usage.

💡 Key Insight

Instance-level visibility goes beyond just knowing which apps are in use — it reveals whether employees are using corporate-managed instances or personal accounts, which have entirely different risk and compliance implications.

---

Task 3: Automatic Content Classification Using ML-Based Detection

🎯Observe how sensitive content is automatically classified using machine learning, even when no policy is configured.

Analytics → Data Discovery Report

Ensure Switch to Existing Reports is enabled. Review the dashboard showing detected sensitive files and ML categories.

Data Discovery Report — automatically identifies sensitive content without requiring a predefined policy.

Review the dashboard widgets — Top 10 Users, Timeline for Files in Top ML Categories, Top 10 Applications — and click Analyze More to investigate further.

Top 10 Users, Timeline, and Top 10 Applications — activity trends reveal where sensitive data is being created or uploaded.

💡 Facilitator Notes

Highlight how activity trends reveal where sensitive data is being created or uploaded. The timeline view is particularly powerful — a spike in ML-classified file activity often correlates with a specific user event or business process.

Select a Content Type such as Immigration and a Subcategory such as Asylum and Refugee. Review the associated Application and User.

Content type drill-down — full data lineage from classification to the responsible application and user.

💬 Discussion

• Which ML content categories appear most frequently in your environment?
• Does seeing user-level attribution change how you would approach a data exposure investigation?
• How does automatic classification without a predefined policy change the traditional DLP deployment model?

💡 Key Insight

Full data lineage from content to user. This drill-down demonstrates the complete chain — content classification → application → user — without any policy configuration. It's the foundation that makes targeted enforcement in Labs 6, 7, and 8 possible.

💡 Facilitator Notes

Lab 1 summary: "We can now see every app (Task 1), every instance including personal accounts (Task 2), and automatically classified sensitive content without writing a single policy (Task 3). This is the visibility foundation everything else builds on."

Transition to Lab 2: "Next we look at the security posture of the SaaS apps themselves — not just what employees are using, but whether those apps are configured securely."

---

Lab Summary

In this lab you established foundational visibility into SaaS usage and sensitive data activity:

Task	What you did
Task 1	Discovered shadow IT applications and reviewed risk profiles
Task 2	Identified application instances and user-level activity
Task 3	Observed automatic ML-based content classification

These capabilities provide the visibility required before implementing data protection and enforcement controls in subsequent labs.