5 Critical Questions MSPs Should Be Asking Customers About Shadow IT

Table of Contents

Changes in IT Procurement are creating opportunities for MSPs

LogicMonitor’s most recent research report shows that “customers top needs include 24/7 IT monitoring support (29%), support for remote work (24%), and decreased IT downtime (24%) —many of which could be automated, integrated, and further supported by their MSPs.”

A growing trend across organizations is that IT purchase decisions no longer reside with the IT department. Nowadays, internal teams have their own IT budgets and can purchase their own devices and software applications without having direct approval from internal IT departments. These independent purchases or “shadow IT” create a challenge for companies because they do not always know what has been purchased and deployed. The de-centralization of IT procurement plus “moving to the cloud” is creating great opportunities for Managed Service Providers (MSPs) to offer additional services to protect their clients and add visibility to their own IT landscape.

If your objective is to help your clients with this challenge, we recommend you start by asking your clients these 5 critical questions about their SaaS applications and shadow  IT.

1. How many SaaS applications is your company using?

Most clients have some idea of how many SaaS applications are being used throughout their organization, but they don’t know the full scope.

“IT departments estimate their companies use an average of 51 cloud services when the reality is they’re using an average of 730 cloud services.”

You can provide better service to them if you can identify what SaaS applications they are using across their departments. We also recommend using Augmentt Discover which helps discover SaaS applications with just a few clicks.

2. Do you know where your corporate data resides?

Most clients understand that their data is everywhere and that it’s potentially a big problem. If your client doesn’t feel confident about where their data is, or what is coming in and going out then it’s a good time to recommend doing an audit to find all the points of entry/exit. CloudRadial can help you plot out your audit assessment in a client-friendly way so that your clients can keep tabs on their data.

3. Do you have an established disaster recovery plan?

Many clients have ad-hoc disaster recovery plans in place and many do not properly document the process or the internal points of contact should something happen. Defining and documenting a plan is critical to being able to bring a client back online post-breach. Another danger of SaaS sprawl and its lack of visibility is that you can’t recover what you didn’t know existed. It’s critical to ensure SaaS is a key component of your disaster recovery plan.

4. Do you know how shadow IT can affect your compliance?

Many clients need to adhere to industry-specific compliance rules and regulations. Shadow IT makes compliance harder by introducing additional security risks of data leakage to an organization. Along with tracking the SaaS apps your clients use, you should focus on the security risks of these applications to help create a priority of which apps need to be addressed first. CloudRadial can show your customers their SaaS app risk via Augmentt on the individual user level.

5. Do you have a plan to manage shadow IT?

Clients need both visibility and a plan of action when it comes to their shadow IT. Reducing the risks will require constant collaboration between the MSP and the client. We recommend giving the client a central location to see and manage their SaaS, hardware, and more.


Conclusion

Augmentt Discover eliminates shadow IT by revealing the full list of SaaS applications in your client’s environments. To make SaaS management even easier, CloudRadial provides a central location for your customers to access critical SaaS information. Managing shadow IT becomes easy and effective when you use these two platforms together.

Author
Gavin Garbutt
Co-Founder & Chairman of Augmentt

FAQ

Using our GDAP tool & Magic Link, setting up is easy! You can integrate with your CSP partner portal in minutes
Augmentt uses a combination of Microsoft Secure Score best practices as well as industry standards such as NIST & CIS. You can use the out of box templates to get started right away and even build your own custom templates to match your client requirements.
Out of box, Augmentt comes pre-configured to not be noisy. Very few Microsoft alerts are critical in nature so you will be receiving tickets for account breaches and not minor user log related events. That said, everything is customizable and you can turn alerts on & off to match your clients’ needs.
No. You can choose to schedule alerts to any stakeholder you want and at the frequency you want or manually download reports when you need them.
Regardless of how MFA is managed across your tenants, we have you covered. Augmentt supports Conditional Access Policies, Security Defaults, Entra ID per user (Legacy) MFA as well as 3rd party MFA services like DUO.
No. You can use Augmentt to monitor and manage all clients regardless of their licensing. For environments with no premium licensing you can still provide alerts and monitoring for account breaches and configure security best practices. For environments with premium licensing, you can leverage Microsoft’s premium alerts and premium security configurations such as Conditional Access Policies.
Augmentt is one of the few vendors SOC 2 Type II, and GDPR compliant.
Site licenses to make sure you can deliver standardized service across all clients very affordably.

SUBSCRIBE for more resources

Related Content

Policy Sprawl Is Killing MSP Efficiency
Policy sprawl is quietly draining your margins, creating security gaps, and eroding client trust. The good news? Standardization is the cure.
Does Microsoft Secure Score Tell the Whole Story?
Do you have a complete understanding of your security? See why MSPs need to understand the role licensing plays in Secure Score results.
Top 10 M365 Security Best Practices for MSPs
Here are the top M365 security best practices to help you enhance protection, ensure compliance, and stay ahead of emerging threats.