SaaS discovery maps the SaaS used across your company: which tools, which employees and which work identities. Use it to uncover shadow IT (tools nobody approved) and licences nobody uses.
Feature/Functionality
Overview
You can turn on discovery in three ways. They work independently of each other.
| Method | What it sees | What you need |
|---|---|---|
| Google Workspace | SaaS opened with Google sign-in | Google Workspace connected |
| Microsoft Entra ID | SaaS opened with Microsoft sign-in | Entra ID connected, plus a Microsoft Entra ID P1 or P2 licence |
| Chrome extension | Any SaaS opened with a work email | Devices managed by Factorial IT |
How to use: Google Workspace
Once Google Workspace is connected, discovery switches on by itself. Factorial IT lists every SaaS where employees use their Google work account to sign in.
- Connect Google Workspace, if it is not connected yet. See "Connect your email provider".
- Open SaaS > Directory to see the SaaS found.
There is nothing else to set up. Discovery keeps running in the background.
What it collects:
- The SaaS opened through Google sign-in with a work account
- The work email used for each one
- Nothing else: no messages, files, passwords or browsing history
How to use: Microsoft Entra ID
Once Entra ID is connected, discovery switches on by itself. Factorial IT reads the sign-in logs of your tenant and lists every SaaS where employees sign in with Entra ID.
- Connect Microsoft Entra ID, if it is not connected yet. See "Connect your email provider".
- Open SaaS > Directory to see the SaaS found.
There is nothing else to set up. Discovery runs once an hour in the background, and its first pass looks back over the previous 30 days of sign-ins.
To turn it off, open Entra from SaaS > Directory, go to the Settings tab and switch off Enable Saas discovery under Setup.
Microsoft only shares sign-in logs through its API with tenants that hold a Microsoft Entra ID P1 or P2 licence. Microsoft 365 Business Premium and E3/E5, for example, include one.
What it collects:
- The SaaS opened through Microsoft sign-in with a work account, counting successful sign-ins only
- The user principal name (the employee's work sign-in name) for each one
- Microsoft's own services, such as Office, Teams and Edge, are left out of the list
- Nothing else: no messages, files, passwords or browsing history
How to use: Chrome extension
The Chrome extension goes further than Google sign-in. It picks up any SaaS an employee opens with their work email, whatever sign-in method they use.
Requirements:
- Devices managed by Factorial IT. The extension is sent through the Google Chrome control.
- An active SaaS Management subscription.
You do not need Google Workspace or Entra ID connected to use it.
To deploy it:
- Go to MDM > Controls and open the Google Chrome control. If there is none yet, click Add new control and choose Google Chrome.
- Switch on Factorial IT Extension.
- Choose which devices get it: all devices, specific device groups or a custom target.
- Click Save. The extension installs silently on the chosen devices. Give it a few minutes.
What it collects:
- SaaS opened with the work email address
- The work identity used for each one
What it leaves out:
- Personal Chrome profiles and personal email
- Passwords, message content and any browsing not tied to work
- Anything outside the managed Chrome profile
To check it works:
- Open SaaS > Directory.
- Make sure recent SaaS and identities are showing.
- Filter by device group to review each targeted rollout.
What to tell employees
- Factorial IT only looks at work SaaS used with the company email address.
- Personal profiles and personal addresses are out of scope.
- No content, passwords or non-work browsing is collected.
Availability and billing
- The Google Workspace integration costs nothing.
- SaaS discovery needs an active SaaS Management subscription.
- The Chrome extension needs devices managed by Factorial IT. Administrators control it from the Google Chrome control.
Tips and Best Practices
- Combine methods for wider coverage. Google and Microsoft sign-in only catch SaaS opened through them. The extension catches the rest.
- Check your Microsoft licence before relying on Entra ID. Without P1 or P2, Microsoft does not share the sign-in logs.
- Tell employees before you deploy the extension. Use the points above so they know what is and is not collected.
- Roll the extension out to one device group first. Check the results in SaaS > Directory, then widen the target.
Troubleshooting and FAQ
Troubleshooting
-
No SaaS show up after you turn discovery on.
- Google Workspace: make sure it is connected.
- Any method: make sure the SaaS Management subscription is active.
- Entra ID: make sure it is connected, the tenant has a P1 or P2 licence and Enable Saas discovery is on in the Settings tab of Entra. If Entra ID was connected before discovery through Entra ID existed, disconnect it and connect it again. A Global Administrator then has to grant Factorial IT access to the sign-in logs.
- Chrome extension: make sure the devices are in the target of the Google Chrome control and the extension switch is on.
-
The extension does not install.
- Check the device belongs to the targeted device group.
- Wait a few minutes for Chrome to sync its policies.
- An employee uses several Chrome profiles. Only the managed profile you targeted is covered. Ask the employee to switch to their managed work profile.
FAQ
-
Do I need to configure anything after connecting Google Workspace or Entra ID?
No. Discovery starts on its own and keeps running in the background.
-
How far back does Entra ID discovery look?
Its first run covers the last 30 days of sign-ins. After that it runs every hour.
-
Does the extension need Google Workspace or Entra ID?
No. Each discovery method works on its own.
-
Does discovery read emails or files?
No. None of the three methods collects message content, files or passwords.