When a Team Buys Its Own AI Tool: Detecting Shadow Licenses

Your identity provider is the highest-yield place to start because a shadow AI signup that used a work email almost always leaves a trace, even when the team never asked IT for anything.

Four artifact types matter.

Application registrations and enterprise applications. In Entra ID, a SAML or OIDC integration exists as a service principal with a ServicePrincipalName, and the Issuer element of an authentication request must exactly match one of those names (Microsoft Entra SAML protocol). That means any app a team stood up through self-service registration has a named object you can enumerate, with a creation timestamp and a creator field.

OAuth consent grants. An employee clicking "Sign in with Microsoft" or "Sign in with Google" on a free AI tool creates a consent grant that reaches into their mailbox, calendar or files. These grants persist after the employee stops using the tool, and they are commonly missed because nobody reviews the consent blade.

Sign-in logs filtered to unmanaged or non-approved applications. Even when a tool is not integrated with SSO, users who sign in with a work email through a consumer flow may generate authentication events you can pivot on.

Failed SSO attempts. A team that tried to configure SAML itself and got it wrong produces a steady stream of authentication errors. The failure surface is often a generic page that hides which specific check failed: Status, Destination, Audience, Recipient and the assertion time window are the high-signal fields to read first when a login fails without explanation (NHI Mgmt Group). A cluster of these from one department is a strong tell that someone is wiring up their own integration.

Two practical cautions. First, structured error logging is what makes any of this queryable at all. Without consistent fields, SAML failures become single incidents that each consume an engineer for a day, which is exactly the scenario described in this writeup on SAML error logging strategies (Scalekit). Second, not every app registration is a problem. A pilot provisioned by IT, an approved vendor's secondary tenant, and a stale integration from a departed employee's project all look similar at first glance. That is why identity alone is a weak signal.

Follow the money because the money is already reconciled, already attributed to a cost center, and already approved by someone in finance who will answer a question about it.

The mechanics are straightforward. A recurring card charge to a vendor that appears nowhere in your procurement or SaaS management system is the cleanest single indicator you will get. SaaS license management guidance consistently names untracked purchases made through departmental budgets and corporate cards as a distinct category of hidden licensing cost and compliance risk, separate from negotiated contracts (CloudFuze). License management practitioners make the same point about expense records specifically: waste is created at the moment of a card swipe or a departure, not on an audit calendar, and a model that only checks in periodically will always be paying for the gap between the event and the check-in (Zluri).

What to query, in order:

1. Transactions where the merchant name or descriptor contains AI-suggestive terms, deduplicated against your procurement vendor list. Merchant descriptors are messy, so search on the vendor's legal entity and billing descriptor, not the product name.
2. Recurring charge detection: same merchant, same approximate amount, more than two cycles. A small monthly charge repeated four times is a subscription, not a one-off meal.
3. Expense report line items with vendor names in the description field, across all cost centers, for the trailing four quarters.
4. Card charges in the same billing cycle as a spike in egress to the vendor's domain. This is the correlation that turns two weak signals into one strong one.

Expense fraud detection platforms already do a version of this at transaction level. Anomaly detection models learn each employee's established spending pattern and flag significant deviations, and the same technique surfaces a new recurring merchant that no policy covers (Navan). You do not need a fraud platform to run the recurrence query; you need the query to run on a schedule.

A worked example makes the value concrete. Say finance finds 14 recurring card charges across 3 departments averaging 30 dollars per seat per month for 6 seats each. That is 14 times 6 times 30, or 2,520 dollars per month, roughly 30,000 dollars annualized, for tools procurement has never reviewed. The number is not the point. The point is that this number is defensible in a budget conversation in a way that "we heard marketing is using something" never is.

Network telemetry catches what identity and money miss: personal-account usage, browser extensions that proxy page content through an external model, and tools purchased on a personal card that never appears in an expense report.

The scale here is documented. Among enterprise employees, roughly 45% use generative AI tools, and 77% of those users paste data into prompts, with 82% of that paste activity originating from unmanaged personal accounts, according to the LayerX Enterprise AI and SaaS Data Security Report 2025 as summarized by Acronis (Acronis on shadow AI). That single statistic explains why expense records and SSO logs alone will never give you a complete inventory. Most of the traffic is happening on accounts your identity provider has never seen.

What to measure, and how to avoid drowning:

• New destination domains per cost center, week over week. Rank by request count and by bytes outbound. A steady rise over three to four weeks is the pattern you want; a single spike is usually a trial or a misconfigured client.
• Bytes outbound relative to bytes inbound. Prompt pasting produces one asymmetry: small text uploads with small responses. Document uploads to a summarization tool produce a different one. Track both separately.
• API key usage from non-corporate source IPs. If a team built an integration on a personal trial key, the calls may originate from a laptop on a home network.
• Proxy and CASB logs classified as generative AI. Most secure web gateways now carry an AI category. The categorization is imperfect, so treat it as a hint rather than a verdict.

The reason to weight egress lower than the other two is that generic AI endpoints and shared CDN infrastructure create noise. Domain-based detection misses traffic that a full inspection would catch, because one vendor's API and another vendor's static assets can resolve to overlapping address ranges. This is precisely the gap that prompt-aware inspection fills. Legacy data loss prevention was built around files, email and network transfers, while AI DLP inspects the prompt and upload before the content reaches the model, which is the only place some of this traffic is visible (Acronis on AI DLP). If your organization already runs DLP, check whether it has prompt-level coverage before you build a separate egress pipeline.

Endpoint inventory deserves its own line. Agent skills, MCP servers and rules files can sit on an employee laptop as plain markdown, with no installer, no purchase order and no vendor contract, which means procurement review and the application inventory have nothing to register (Backslash Security). If your definition of a shadow license excludes tools that cost nothing and never touch a card, you will miss this entire category.

Detection without a decision rule produces a queue of unresolved findings, and the queue rots. Use a scoring pass first, then a three-way branch.

Score each finding on four factors: number of distinct users in the same cost center, presence of sensitive data categories in the tool's typical use, existence of a sanctioned alternative that meets the need, and whether the vendor offers a business agreement with data handling terms. Then apply the branch.

Absorb is the branch organizations underuse. When an organization provisions sanctioned AI tools, unauthorized use drops substantially, which is the strongest evidence available that supply-side governance outperforms detection and blocking (CSA research note). If the shadow tool existed because the approved stack could not do the job, absorbing it converts a finding into a capability.

A triage script that runs weekly against an exported CSV is enough to start. Keep it boring and auditable:

import csv
from collections import defaultdict

# One row per signal: (cost_center, vendor, channel, detail)
signals = defaultdict(lambda: defaultdict(set))

with open("signals.csv") as f:
    for row in csv.DictReader(f):
        key = (row["cost_center"], row["vendor_normalized"])
        signals[key][row["channel"]].add(row["detail"])

def branch(channels, user_count, has_sanctioned_alt, sensitive_data, has_agreement):
    if len(channels) < 2:
        return "monitor"
    if not has_agreement and sensitive_data:
        return "block"
    if user_count >= 5 and has_sanctioned_alt:
        return "migrate"
    return "absorb"

for (cc, vendor), channels in signals.items():
    print(cc, vendor, sorted(channels.keys()))

The len(channels) < 2 guard is the important line. It encodes the decision rule from the short answer: one signal is noise, three aligned signals on one cost center within a few weeks is a shadow license.

Detection is a repeating loop, not a project. Three things have to be true for the loop to close.

Consent review becomes routine. Add an OAuth grant review to the same cadence as access recertification. When an employee requests a grant to an unlisted AI vendor, route it to a review step rather than allowing it silently. This is the same continuous approval model that skill and MCP vetting requires: allowlist approved components, denylist risky ones, block violating actions inline, and retain audit records of runs (Backslash Security).

Procurement owns a vendor list that finance can query. A shadow license is only detectable against a list of what is legitimate. Publish the approved AI vendor list, with product names and billing descriptors, in a place the card reconciliation query can join against.

Reclamation runs continuously rather than at renewal. Licenses frequently remain assigned after departures because deactivating an identity in the directory does not release a seat in the application itself, which is why practitioners argue for reclaiming at the lifecycle event instead of on an annual audit (Zluri). The same logic applies to AI tools: a cancelled pilot leaves an OAuth grant, a card charge and a steady trickle of egress behind it.

If the triage list keeps producing the same product names across multiple cost centers, the finding is not a set of rogue teams. It is a gap in the sanctioned stack, and the cheapest long-term fix is to close that gap with an approved option. Teams that want one governed endpoint for text, image, audio and embedding models, with usage attributed to a single billing entity instead of scattered cards, can point their engineers at Quanta Inference as the sanctioned alternative, which removes the most common reason a team signs up for a consumer plan in the first place.