If you want to uncover unsanctioned cloud apps, don’t begin with a policy. Start with your browser history.
The cloud environment most businesses actually use rarely matches the one shown on the IT diagram. It’s built through countless small shortcuts. Someone shares a file “just this once.” A team signs up for a free tool that solves a problem faster. A plug-in gets installed to meet a deadline. An AI feature quietly activates inside an application you already pay for.
In the moment, none of it feels like a problem. It feels efficient. Helpful.
Until it isn’t.
That is when businesses discover their data is scattered across tools that were never formally approved, accounts that cannot be easily offboarded, and sharing settings that no longer reflect the real level of risk.
For many businesses in New Zealand, this situation does not happen through carelessness. It grows through small decisions that slowly reshape the technology environment.
Why Unsanctioned Cloud Apps Are a 2026 Problem
Unsanctioned cloud apps have always existed. What has changed in 2026 is the scale, the speed, and the rise of AI features built directly into everyday applications.
Start with scale. Microsoft’s guidance on cloud app usage highlights that most IT teams assume employees use around 30 or 40 cloud apps. In reality, the average organisation uses more than 1,000 separate applications.
The same research notes that roughly 80 percent of employees use apps that have not been formally reviewed against company policy.
That gap between what businesses believe is happening and what is actually happening is often far wider than expected.
Now add the 2026 twist. Artificial intelligence is no longer only a separate tool that employees actively choose to adopt.
The Cloud Security Alliance explains that AI capabilities are increasingly embedded inside everyday business applications rather than appearing only as standalone tools. In other words, AI exposure can appear without anyone signing up for a new AI product.
Research referenced by the alliance indicates that 54 percent of employees admit they would use AI tools even without company approval.
The risk is measurable. IBM research cited in the same discussion found that around 20 percent of organisations have experienced breaches linked to unauthorised AI use, increasing breach costs by an average of $670,000.
Finally, the traditional strategy of simply blocking applications is becoming less effective. Cloud services are deeply integrated into everyday work. If secure alternatives are not available, employees often find other ways to accomplish the same task.
Don’t Start with Blocking
The fastest way to push unsanctioned app usage further out of sight is to treat it purely as a rule-breaking problem and respond with bans.
Some applications do need to be blocked. However, if blocking is the first move, two common outcomes appear.
- People become better at hiding what they are doing.
- They switch to a different tool that carries the same or greater risk.
In both cases, the exposure remains while visibility decreases.
A more effective starting point is understanding what is actually happening and why.
Cloud app risk should be evaluated against objective criteria. The focus should be on how people are using the application and whether that behaviour creates exposure.
Once visibility improves, the response becomes clearer. Some applications may be approved. Others might need restrictions. Some will need to be replaced with more secure alternatives.
The truly high-risk tools can then be blocked thoughtfully, with clear communication and a secure option that still allows employees to complete their work.
The Practical Workflow to Uncover Unsanctioned Cloud Apps
This process works best as an ongoing workflow rather than a one-time clean-up. Running it quarterly or continuously helps organisations stay ahead of new tools and changing habits.
Discover What Is Actually in Use
Start by generating an accurate inventory using the signals you already collect. These can include endpoint telemetry, identity logs, network and DNS activity, and browser data.
Microsoft emphasises a dedicated discovery phase because businesses cannot manage applications that have not yet been identified.
Analyse Usage Patterns
Once the applications are identified, look at how they are being used.
Review questions such as:
• Who is accessing these cloud apps
• What administrative activity is occurring
• Whether data is shared publicly or with personal accounts
• Whether former employees still have active connections
These details reveal where risk is most likely to appear.
Score and Prioritise Risk
Not every unsanctioned application carries the same level of risk.
A practical risk assessment should consider:
• The sensitivity of the data involved
• How information is being shared
• The strength of authentication controls
• The level of administrative oversight
• Whether AI features could ingest or expose business data
Tag Applications
Clear tagging helps make decisions consistent.
Microsoft recommends tagging applications as sanctioned or unsanctioned so organisations can filter results, track progress, and apply the same standards over time.
Take Action
Once an application is tagged, the organisation can enforce the decision.
Microsoft’s governance guidance highlights two practical responses. One option is issuing user warnings, which encourage safer behaviour without immediately restricting access. The second option is blocking applications that present unacceptable risk.
Changes should be implemented carefully. Planning communication and transition steps helps avoid sudden disruptions.
Your New Default: Discover, Decide, Enforce
Unsanctioned cloud apps will not disappear in 2026. In fact, they will likely continue to multiply as new AI capabilities appear inside the tools employees already rely on.
The goal is not to block everything. The goal is to establish a repeatable operating model.
First discover what applications are in use. Then decide what is acceptable. Finally enforce those decisions with clear guidance and secure alternatives.
When applied consistently, cloud app sprawl stops being an unexpected problem and becomes another manageable part of the business environment.
If you would like help building a practical cloud application governance process, contact us for a consultation. We can help identify risks, improve visibility, and introduce sensible guardrails without slowing productivity.
Article used with permission from The Technology Press.