Ask most IT teams how they discover the SaaS apps running in their company, and they'll name one method: SSO logs, or finance records, or an audit spreadsheet somebody updates twice a year. Any one of these will find real apps. None of them will find all of them. This guide walks through all 10 discovery methods that exist today, what each one is genuinely good at, where each one goes blind, and why two of them (email parsing and desktop agents) cause more problems than they solve for most organizations.
Every SaaS discovery method was built to answer a narrower question than "what apps does this company use." SSO answers "what apps did someone log into through our identity provider." Finance answers "what apps are we being billed for."
A method built to answer a narrow question will always miss whatever falls outside it, and shadow IT lives almost entirely in that gap: the tool an employee signed up for directly, paid for on a personal card, and never mentioned to IT.
This guide covers all 10 methods, what each is built to catch, where each leaves a blind spot, and for two of them, why the cost of running them usually outweighs what they add. The point isn't to rank them; it's to show why "which single method should we use" is the wrong question, and why more methods isn't automatically better either.
1. SSO and Identity Provider (IdP) Discovery
The most common starting point, and usually the first discovery method any company has. Every time an employee logs into an app through federated single sign-on (Okta, Microsoft Entra, Google Workspace as an IdP), that login gets logged, giving IT a real-time record of authorized app usage tied to a specific person.
What it's good at: high-confidence data on sanctioned, federated apps, plus the user and role context that comes bundled with an IdP.
Where it's blind: anything an employee signs up for with a plain email and password never touches the IdP. Since that's most of what shadow IT actually is, SSO-only discovery typically finds a fraction of the real stack, the sanctioned fraction, and reports it as complete.
2. Direct Integrations
API-level connections into specific applications, pulling detailed data directly from the source. Where SSO tells you someone logged in, a direct integration can tell you their license tier, their activity level inside the app, their permissions, and more, because it's reading the application's own data rather than inferring from a login event.
What it's good at: depth. For any app with a direct integration in place, the data is far richer than login logs alone could ever provide.
Where it's blind: coverage. A direct integration only exists for apps someone has deliberately connected, so it discovers nothing about apps outside that connected set. It's a depth method, not a discovery method, in isolation; it needs another method to first surface the app before it can go deep on it.
3. HRMS Integration
Not an app-discovery method in the traditional sense, since it discovers people rather than apps, but foundational to making every other method's findings usable. An HRMS integration provides the authoritative roster: who's actually employed, in what role, in what department, as of today.
What it's good at: giving every other method something to match against. An app signal tied to someone who left the company six months ago is a very different finding than the same signal tied to a current employee, and only an HRMS connection tells you which one you're looking at.
Where it's blind: app usage itself. The HRMS knows who exists; it has no visibility into what any of them are actually using.
4. Mobile Device Management (MDM)
Discovery through what's installed on company-managed devices. An MDM platform already tracks installed applications as part of device management, and that inventory doubles as a discovery source: any app installed on a managed laptop or phone shows up, whether or not it ever touched SSO.
What it's good at: catching native applications, the ones installed rather than accessed through a browser, which several other methods on this list miss entirely.
Where it's blind: unmanaged devices and browser-based tools. If it isn't installed on a device the MDM manages, it's invisible to this method, and BYOD or unmanaged-device usage passes underneath it completely.
5. Finance and Expense System Discovery
Discovery by following the money. Connecting to finance and expense platforms surfaces every SaaS charge running through a corporate card, an expense report, or an approved invoice, including apps an employee bought entirely on their own initiative.
What it's good at: catching paid shadow IT specifically, the subscriptions that exist because someone had a business need and a corporate card, with no IT involvement at any point.
Where it's blind: anything free. A no-cost tier, a trial that never converts to paid, a free-forever plan, none of these generate a transaction, so none of them show up here no matter how actively they're used.
6. Cloud Access Security Broker (CASB)
Network-level visibility into cloud application traffic. A CASB sits between users and cloud services, monitoring traffic patterns to identify which cloud applications are actually being accessed, independent of whether those apps were ever formally sanctioned.
What it's good at: real-time, usage-based visibility that doesn't depend on the app ever touching a login system or a finance system, purely traffic-based detection.
Where it's blind: anything outside the monitored network path. Traffic that never crosses the CASB's vantage point, common with remote work, personal devices, or apps accessed outside managed network infrastructure, doesn't get seen.
7. Directory Services
Structural identity and group data pulled from connected directory services, adjacent to but distinct from SSO login data. This method surfaces organizational structure, group memberships, and identity attributes that inform who should have access to what, even when it doesn't directly reveal app-level usage.
What it's good at: identity and access structure, the scaffolding that access decisions and reviews get built on.
Where it's blind: app usage detail. Like HRMS, this method is closer to identity infrastructure than app discovery, valuable context rather than a direct source of new applications.
8. Browser Extensions
Real-time detection of app signups and logins as they happen, directly in the browser. A browser extension can catch an employee creating a new account the moment it happens, which makes it uniquely fast at catching brand-new shadow IT, including free and unbilled tools that finance-based discovery would never see.
What it's good at: speed and coverage of exactly the category most other methods miss, free tools, and doing it in real time rather than after the fact.
Where it's blind: anything outside a browser session. Desktop-native software and mobile-app-only usage pass underneath it entirely.
9. Email Parsing
Scanning employee inboxes for the signup confirmations, receipts, and welcome emails that SaaS tools generate automatically. A new account almost always triggers an email, so in theory, reading that traffic surfaces tools no other method would catch, including free signups that never touch a browser extension because they were made from a phone or a different device entirely.
What it's good at: catching the specific signals other methods miss, confirmation emails for tools signed up for outside any monitored browser or device.
Why it's usually a bad trade. Email parsing means granting a tool read access to employee inboxes, which is one of the most sensitive data stores in the company, containing personal correspondence, HR communications, legal discussions, and client conversations, not just SaaS receipts.
That's a steep privacy cost for a discovery method, and it shows up in practice as real problems: employee trust erodes fast once people learn their inbox is being scanned, even for a narrow purpose, and the perception often outruns the reality. It raises genuine compliance exposure in jurisdictions with strict data and communication privacy laws, since inbox content isn't neatly separable into "SaaS signals" and "everything else" at the point of access. And the signal quality is poor: marketing emails, forwarded newsletters, and old confirmations for tools nobody uses anymore create a high false-positive rate that still needs a human to sort through.
Most of what email parsing catches, paid subscriptions and active signups, finance systems and browser extensions already catch with far less invasive access.
10. Desktop Agents
Software installed directly on an employee's device to monitor local application activity, an older approach to catching native, non-browser software that other methods miss.
What it's good at: visibility into desktop-native applications on the specific devices it's installed on, a category browser extensions and CASBs can't see.
Why it's usually a bad trade. A desktop agent has to be installed on every device individually, which means ongoing deployment and maintenance work for IT: pushing it to new hires, keeping it updated across every OS version, troubleshooting the inevitable conflicts with other endpoint software. It consumes device resources continuously in the background. And it reads, at minimum, as employee monitoring software, because that's structurally what it is, which creates the same trust problem as email parsing, just aimed at the device instead of the inbox.
On top of the cost, the coverage gap doesn't even close: a desktop agent still only sees managed devices, so BYOD and unmanaged hardware remain invisible regardless, the same blind spot MDM already has. Most organizations that evaluate this method find that MDM's existing installed-app inventory plus browser extensions cover the overlapping ground without needing a second, dedicated agent running on every machine.
Why No Single Method Gets You to Complete
Line up the first eight methods' blind spots and a pattern jumps out: none of them overlap. SSO misses direct signups. Finance misses free tools. MDM misses unmanaged devices. CASB misses untracked network paths. Every method's blind spot is exactly the thing a different method on this list is built to catch.
That's why "which single method is best" is the wrong question. A company running SSO-only discovery isn't running a weaker version of complete discovery; it's running a fundamentally partial one, and no amount of tuning that one method closes the gap another method exists to cover.
Notice that email parsing and desktop agents aren't in this table. That's deliberate: the question for those two was never really "what does it miss," it's "what does it cost to run," and for most organizations the honest answer is more than the coverage gain is worth once seven or eight less invasive methods are already combined.
How to Check Your Own Discovery Coverage
Before comparing tools, it's worth auditing what your current setup actually sees, and what it costs to run. Four questions surface most of the gap:
Does your discovery run through your IdP alone, or does it also touch finance records? If it's IdP-only, unbilled and unfederated shadow IT is invisible by default.
Can you see apps installed on managed devices that were never logged into through SSO? If not, native applications outside your identity provider's view are a blind spot.
Is there any real-time signal for brand-new signups, or does your inventory only update on a periodic scan? Point-in-time discovery methods miss the apps that appeared and got adopted between scans.
Does your current tool read employee email content or require installing an agent on every device to get there? If so, it's worth asking whether that coverage is actually unique, or whether a less invasive combination of methods already catches the same ground.
A "no" (or an uncomfortable "yes") on any of these usually maps directly to a gap or a cost in the table above.
Where Zluri Fits
Zluri runs eight of these ten methods continuously and in parallel, deliberately leaving out email parsing and desktop agents for the reasons above. SSO and IdP data, direct integrations, HRMS, MDM, finance systems, CASBs, directories, and browser extensions all feed one combined inventory, backed by a SaaS app library of 240,000+ applications so that a signal from any method can be matched to a real, identified app rather than left as an unrecognized transaction or login.
The mechanics of how those eight streams get reconciled into one record per app and per identity, including how HRMS data anchors ownership and how overlapping signals from multiple methods strengthen confidence in a finding, are covered in more depth in how Zluri's discovery engine works.
Frequently Asked Questions
What are the main SaaS discovery methods?
Ten in total: SSO and IdP integration, direct app integrations, HRMS integration, MDM, finance and expense system discovery, CASB, directory services, browser extensions, email parsing, and desktop agents. Most SaaS management platforms combine a subset of these rather than all ten, since two of them carry real drawbacks.
Why is email parsing a risky SaaS discovery method?
It requires reading employee inbox content to detect signup and receipt emails, which is highly invasive given how much sensitive, non-SaaS-related communication lives in the same inbox. It creates real employee trust and compliance exposure, and produces a high false-positive rate from marketing and forwarded email, while catching little that finance systems and browser extensions don't already surface with far less invasive access.
What are the downsides of desktop agents for SaaS discovery?
They require installing and maintaining software on every individual device, consume device resources continuously, and read as employee monitoring software to most users, creating trust problems. They also don't solve the underlying coverage gap, since they still only see managed devices, leaving BYOD and unmanaged hardware invisible just like MDM alone does.
Which SaaS discovery method is the most accurate?
None of them alone. Each method is highly accurate within its own category (SSO for federated logins, finance for paid subscriptions, browser extensions for free signups) but blind outside it. Accuracy at the level of "the whole SaaS stack" requires combining several less invasive methods, not picking the single most invasive one.
Why does SSO-based discovery miss so much shadow IT?
Because shadow IT is defined by never having been centrally set up, and most of it is never federated through SSO in the first place. An employee signing up for a tool directly, with their own email and password, generates no SSO event at all, so SSO-only discovery structurally cannot see it.
How many discovery methods does Zluri use?
Eight, run continuously and in parallel: SSO/IdPs, direct integrations, HRMS, MDM, finance systems, CASBs, directories, and browser extensions, combined into one inventory. Email parsing and desktop agents are deliberately excluded for the privacy, trust, and maintenance reasons covered above.
.svg)
