Shadow IT Assessment Workshop — Cloud App Visibility & Control

The Shadow IT Assessment Workshop is a structured IT Partner engagement that helps organizations discover and review cloud applications and services used without IT’s knowledge. IT Partner uses Microsoft Cloud App Security to evaluate cloud usage from the organization’s network and then provides findings, recommendations, and a prioritized Cloud Usage Visibility and Control road map.

This workshop is designed for organizations that want better visibility into cloud applications and services being used by employees, especially services that may not be approved or managed by IT. It is most relevant when the organization wants to improve cloud security posture using Microsoft Cloud App Security and align people, process, and technology controls around cloud usage.

The engagement includes a remote kickoff, a pre-assessment questionnaire, Microsoft Cloud App Security readiness and setup, review of discovered cloud usage, and creation of assessment deliverables. The main deliverables are a Shadow IT Discovery Report and a prioritized Cloud Usage Visibility and Control road map with recommendations for further investigation and action.

IT Partner provides a kickoff presentation, a pre-assessment questionnaire, a Shadow IT Discovery Report, and a Cloud Usage Visibility and Control road map. The discovery report lists possible Shadow IT usage and recommendations for further investigation, while the road map prioritizes actions for improving visibility and control of cloud usage in the customer environment.

The listed service duration is 3 weeks, with 4 consulting days and 3 days on-site. In practice, the assessment typically includes an up to two-hour remote kickoff followed by on-site workshops over Day 1, Day 2, and Day 3, and the full schedule may extend up to four consecutive weeks depending on log collection and analysis timing.

The kickoff is an up to two-hour remote meeting that introduces the engagement objectives, flow, responsibilities, and governance. IT Partner also provides and explains the pre-assessment questionnaire and works with the customer to decide what resources and tools will be used during the assessment.

Day 1 is focused on education and setup. IT Partner reviews the questionnaire with the customer, discusses cloud usage and security objectives, provides an introduction to Microsoft Cloud App Security, demonstrates visibility and control capabilities, and helps with technical setup such as tenant setup, log upload, or Log Collector deployment if needed.

Day 2 is focused on exploration and discovery. IT Partner reviews Microsoft Cloud App Security reports with the customer, explores specific cloud usage cases in the portal, creates the Shadow IT Discovery Report, and prepares the Cloud Usage Visibility and Control road map.

Day 3 is focused on review, road map discussion, and close-out. IT Partner presents the Shadow IT Discovery Report, reviews the Cloud Usage Visibility and Control road map with the project team, discusses next steps, and performs cleanup activities such as removing uploaded logs, decommissioning the Log Collector, or closing trial environments if applicable.

The customer needs a Microsoft 365 tenant and Microsoft Cloud App Security, either through a production Microsoft 365 tenant with Cloud App Security such as an E5-enabled environment or through trial Microsoft 365 and Cloud App Security services for up to 30 days. The customer also needs access to firewall or proxy logs and infrastructure to host the Log Collector if that collection method is used.

A production Microsoft 365 tenant with Microsoft Cloud App Security, such as through E5 licensing, can be used for the assessment. If the customer does not use a production Cloud App Security environment, the workshop may use a trial Microsoft 365 tenant and Cloud App Security trial for up to 30 days, but the specific setup should be confirmed with IT Partner before the engagement.

The assessment requires access to logs from the customer’s firewalls or proxies because Microsoft Cloud App Security uses those logs to analyze cloud application and service usage. If the Log Collector is used, the customer also needs infrastructure to host it and knowledgeable personnel who can provide credentials, assist with log extraction, and alter firewall rules if necessary.

At least one week is needed between kickoff and Day 1 so the customer can complete the questionnaire and IT Partner can prepare engagement tools. Between Day 1 and Day 2, at least 2 to 3 days are needed for manual log uploads, while Log Collector-based collection typically needs at least two weeks, ideally three, to collect and analyze a reasonable amount of data.

The service is an assessment and discovery engagement, so it is not described as requiring production downtime or user cutovers. Business impact is primarily the time required from security, network, and Microsoft 365 administrators, plus access to firewall or proxy logs and any required Log Collector setup.

The stated scope is assessment, discovery, reporting, and road map creation, not a full remediation or enforcement rollout. The road map may recommend actions such as user awareness campaigns, blocking or control mechanisms, or broader Microsoft Cloud App Security deployment, but implementation of those actions should be confirmed separately with IT Partner.

IT Partner is responsible for understanding the customer’s cloud security objectives, assessing real cloud application and service usage, and providing guidance on using Microsoft Cloud App Security to mitigate cloud usage risks. IT Partner also provides recommendations, best practices, and a prioritized road map that maps Cloud App Security capabilities and partner services to the findings.

The customer is responsible for providing accurate and timely information, completing the pre-assessment questionnaire, and giving access to knowledgeable personnel, systems, networks, work locations, and required applications. The customer also needs to provide access to firewall or proxy logs and personnel who can manage firewalls, provide log extraction credentials, and adjust firewall rules if needed.

The project team should include stakeholders who understand cloud usage, security requirements, Microsoft 365 administration, and network or firewall operations. The Day 1 technical setup typically involves security architects, security engineers, network engineers if applicable, and a Microsoft 365 tenant administrator.

The listed price for the Shadow IT Assessment Workshop is $4,500. Because the source service description does not list additional-cost items or explicit exclusions, customers should confirm with IT Partner whether any special requirements, travel assumptions, licensing, or follow-on implementation work would affect the final commercial terms.

After completion, the customer has a Shadow IT Discovery Report and a prioritized Cloud Usage Visibility and Control road map to guide next steps. The close-out also includes cleanup activities such as removing uploaded logs, decommissioning the Log Collector, and closing Microsoft 365 or Cloud App Security trials if they were used.