On this page0
Guide
Find the apps your company uses
See every app your people sign in to, how many use each one, which accounts have gone quiet, and which accounts belong to nobody in your directory.
Before you start
- This is an IT task, but reading the page needs no technical knowledge. Acting on what you find is done in the app itself or in your identity provider, so if you do not look after those yourself, share the list with the person who does.
- A role that lets you view SaaS Discovery. (SaaS means software you use over the internet and pay for by subscription.) In the built-in set, administrators have that permission. The “integration_manager” role has it too; no group carries it, so an administrator gives it to a person by hand, as Roles, groups and permissions shows.
- Okta or Google Workspace connected on the “Identity Hooks” page. These are the two connections that can report which apps people sign in to. See Connect Okta, Entra or Google.
- For Google Workspace, the connection needs one extra read permission in Google Admin before it can report app usage. The exact permission is on the SaaS Discovery reference page.
- Nothing is installed on anyone’s computer. The list is built from the sign-in records your identity provider already keeps.
Steps
Step 1: Open SaaS Discovery
Go to Access GovernanceSaaS Discovery. If a blue box says no identity provider is reporting usage yet, click “Connect a provider” to go to “Identity Hooks” and connect one first.
Step 2: Read the four numbers at the top
“Apps discovered” is how many different apps were seen, and from how many sources. “Apps with unmatched accounts” counts apps that hold at least one account which is not a person in your directory. “Dormant accounts” counts accounts with no sign-in in 30 days. “Active users” counts people seen in the last 30 days.
Step 3: Read the list of apps
Under “Discovered applications”, each row is one app. “Seen via” shows which connection reported it; a green “2 sources” label means both reported it. “Users”, “Active” and “Dormant” are counts of accounts, and “Last used” is the most recent sign-in.
“Directory match” reads “All users matched” when every account belongs to someone in your directory, or “Unmatched accounts” when at least one does not. An unmatched account is usually a contractor, a personal email address or someone who has left.
Step 4: See who uses an app
Click a row to unfold it. Under “People using” and the app’s name you get one line per account: the email address, which connection saw it, whether it is active or dormant, and the last sign-in. An account that is not in your directory carries an “unmatched” label.
Step 5: Act on what you find
This page only reports; it has no buttons that change anything. For a dormant account, ask the person whether they still need the app, then remove the licence in the app itself or in your identity provider. For an unmatched account, find out whose it is. If it belongs to someone who has left, see Offboard someone. To check access app by app with a record of each decision, run an access review.
Step 6: Get fresh numbers
The list is rebuilt each time the Okta or Google connection syncs. The page checks for new results by itself about once a minute while it is open; click “Refresh” to check now.
What you should see
The four tiles show numbers, not dashes, and “Apps discovered” names at least one source.
The table lists your apps, and unfolding a row shows the accounts behind it.
If something goes wrong
- The table says "No app usage discovered yet. It refreshes after each provider sync."
- The connection has not finished a sync that could read usage. Open Access Governance, Identity Hooks, sync the Okta or Google connection, wait for it to finish, then click Refresh here.
- Google Workspace is connected but no apps appear
- The extra read permission for app usage is missing in Google Admin. Add it as described on the SaaS Discovery reference page, then sync the connection again.
- The tiles show dashes and "not loaded"
- The page could not read the results. Click Refresh. If it keeps failing, check System, System Health.
- An app everyone is allowed to use shows "Unmatched accounts"
- This is not a verdict on the app. It only means one account in it does not match a person in your directory. Unfold the row to see which account, and decide whether it should be there.
- SaaS Discovery is not in the sidebar
- Your role does not let you view it, or your plan does not include it. An administrator can check the plan under System, License & Entitlements.
Still stuck? See When something goes wrong, or Contact Zonitix support.