# Shadow AI Remediation User Help > Shadow AI Remediation User Help # Shadow AI Remediation User Help # Shadow AI Remediation Shadow AI Remediation provides real-time visibility and control over how AI tools are being used by employees, and just-in-time remediation through guided [playbooks](https://documentation.sailpoint.com/sair/help/playbooks/index.html). AI detection includes: - GenAI and AI orchestration web applications. - GenAI applications registered to the IdP. - GenAI browser extensions. ## Configuration Phases To get started you must complete the following steps: **Deployment Configuration** - [Configure your Identity Provider and connect to Shadow AI Remediation](#configuring-your-identity-provider) to provide visibility into AI usage and risk in your organization. - [Deploy the Browser Extension](#deploying-the-browser-extension) to discover GenAI user-related activities. **Discovery and Visibility Configuration** - [Review the out-of-the-box list](#discovery-and-visibility-configuration) of GenAI applications. - [Add additional applications](#discovery-and-visibility-configuration) to capture and log your organization's GenAI activity in the inventory’s and dashboards. **Policy Configuration** - [Define the sanctioned GenAI applications](#define-the-sanctioned-genai-applications) that your organization’s policy permits. - [Decide](#decide-desired-policy) your desired policy. - [Configure and test](#policy-configuration-and-testing) your policy. ## Deployment Configuration To get started, you first need to configure your Identity Provider and connect it to Shadow AI Remediation. Once connected, deploy the browser extension in your environment to allow Shadow AI Remediation to discover and monitor user-related AI activities. ### Configuring Your Identity Provider To get started, you must first configure your Identity Provider and connect to Shadow AI Remediation to provide visibility into AI usage and risk in your organization. - [Microsoft Entra ID](https://documentation.sailpoint.com/sair/help/idp/entra_idp.html) - [Okta](https://documentation.sailpoint.com/sair/help/idp/okta_idp.html) - [Other IdP](https://documentation.sailpoint.com/sair/help/idp/other_idp.html) ### Deploying the Browser Extension After configuring your Identity Provider and connecting to Shadow AI Remediation, you must deploy the [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) in your environment to discover user-related activities. Notes - The browser extension does not distinguish between a user’s personal activities and business activities, and will capture personal activities conducted using any browser in which the extension is deployed. It is your responsibility to ensure that the collection and use of personal activity data complies with applicable law and contract terms. Contact your legal department with any questions. - All privacy-related features can be managed and optionally disabled. Refer to [Configuring Privacy Controls](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html) for additional information. ## Discovery and Visibility Configuration Shadow AI Remediation comes with a pre-populated list of common GenAI applications. You must ensure all GenAI applications, including home-grown, that are permitted by your organization’s policy are added to Shadow AI Remediation. This will ensure that all GenAI applications, including home-grown will be included in [inventory’s](https://documentation.sailpoint.com/sair/help/inventory/index.html), [dashboards](https://documentation.sailpoint.com/sair/help/data_analytics.html#viewing-dashboards), and [activity logs](https://documentation.sailpoint.com/sair/help/data_analytics.html#activity-logs). Thick Client Discovery Shadow AI Remediation can discover thick client GenAI applications installed on endpoints that require browser based authentication, such as Windsurf, GitHub Copilot, Claude Code, and Cursor. Installation of thick client GenAI applications may also be identified by the browser extension by identifying application download pages and authentication against an IdP. First [review](https://documentation.sailpoint.com/sair/help/lists.html) the **generative-ai-apps** list. If a sanctioned GenAI application is not listed, create a [Custom Application](https://documentation.sailpoint.com/sair/help/custom_apps.html) to add the application, and then [add it to the following list](https://documentation.sailpoint.com/sair/help/lists.html#view-and-add-apps-to-list): - **generative-ai-apps** - Ensures the application will appear in the GenAI inventory and dashboards. If you are unable to add a custom application because its URL overlaps with an existing domain of a SaaS application in the global application database, add the application to the following lists instead: - **generative-ai-hostnames** - Ensures the application is covered by the GenAI dashboards and logs. For example, application.acme.com. ## Policy Configuration To implement your organization's GenAI policy, you must first identify sanctioned applications and define usage rules. Once established, these policies are enforced by configuring, testing, and enabling playbooks that manage how users interact with both approved and non-sanctioned AI tools. ### Define the sanctioned GenAI applications To ensure GenAI applications are permitted and blocked inline with your organization's AI policy, you must configure Shadow AI Remediation with your organization’s sanctioned GenAI applications. Sanctioned GenAI applications, whether a well-known mapped SaaS application, such as Microsoft Copilot, or a [custom application](#create-custom-app) you have added, must be [added](https://documentation.sailpoint.com/sair/help/lists.html#view-and-add-apps-to-list) to the following list: - **generative-ai-sanctioned-apps** - Ensures playbooks are not triggered by sanctioned applications. Sanctioned applications that were mapped by their domains should be added to the following list: - **generative-ai-sanctioned-hostnames** - Ensures playbooks are not triggered by sanctioned applications that were mapped based on their hostnames. ### Decide Desired Policy Before configuring and enabling playbooks, you must [determine your GenAI policy](https://documentation.sailpoint.com/sair/help/playbooks/index.html#policy-related-considerations). This will help you decide which playbooks to enable and whether to limit the number of times the playbook should be triggered for non-sanctioned applications. ### Policy Configuration and Testing Once you have determined your organization's GenAI policy, you can [configure and enable](https://documentation.sailpoint.com/sair/help/playbooks/index.html) the desired playbooks. After they're configured, you can [deploy, and test](https://documentation.sailpoint.com/sair/help/playbooks/index.html#deployment-best-practice) them. ## User Levels and Permissions To administer Shadow AI Remediation, users must be assigned the Org Admin user level. For read-only access, users must be assigned either the Cert Admin, Helpdesk Admin, or Report Admin user level. For more information about these user levels and their permissions, refer to [User Level Access Matrix](https://documentation.sailpoint.com/saas/help/common/users/user_level_matrix.html). - **Global Administrator** - Has full access to the admin console and can configure and manage all aspects of the product. Can also configure system configurations and define privacy controls. - **Read-only Administrator** - Has limited access to the admin console. They can retrieve and view data, but cannot make modifications or deletions. ## Accessing Shadow AI Remediation The method to access the Shadow AI Remediation portal depends on your tenant region. Choose your next step based on the URL provided in your initial connectivity instructions **To access the Shadow AI Remediation portal:** 1. Open a browser and enter `https://app.us-east4.savvy.security/`. 1. Enter your admin credentials. The Shadow AI Remediation portal is displayed. **To access the Shadow AI Remediation portal:** 1. Open a browser and enter `https://app.savvy.security/`. 1. Enter your admin credentials. The Shadow AI Remediation portal is displayed. # Managing Custom Applications The Shadow AI Remediation [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) can detect accounts associated with any application, whether public SaaS platforms or private, internal systems. Inventory entries for private applications are created automatically based on their apex domain (the highest-level domain name without any subdomains). For example, the apex domain of portal.hr.example.com is example.com. You can define a custom application to provide a clear, human-readable name and manage it as part of your SaaS inventory. In some cases, you may want to define multiple custom applications, each corresponding to different subdomains or URL paths, especially for on-premises or self-hosted environments. By default, the **Custom apps** tab is displayed listing discovered and manually created custom applications. The **Overwritten apps** tab displays applications that have been edited, such as adding or removing URLs. The view can be searched by application name or part name. To edit a custom application, select **Actions** **> Edit**. To delete a custom application, select **Actions** **> Delete**. Once a custom application is defined: - The [SaaS inventory](https://documentation.sailpoint.com/sair/help/inventory/saas.html) will automatically rebuild to include the new entries. - Future [activity logs](https://documentation.sailpoint.com/sair/help/data_analytics.html#activity-logs) detected under the defined URLs will be attributed to the custom application. Note The default Custom apps view updates automatically within 24 hours. To verify inventory changes immediately, switch the [SaaS inventory view](https://documentation.sailpoint.com/sair/help/inventory/saas.html) to **Live**. **To create a custom application:** 1. Go to **Settings > Custom apps**. 1. Select **New App**. 1. In the **App Name** field, enter a unique name. 1. In the **URLs** field, enter URLs for domains, subdomains, or paths. 1. Select the **Reputation** dropdown, and select the risk that applies to this application. 1. Select the **Category** dropdown and select the or the category of the application. 1. Select **Save**. # Viewing Data Analytics Shadow AI Remediation analytics are a flexible method for admins to log, query, and visualize data insights for security teams to track priority risks for their organization. The Shadow AI Remediation platform provides aggregated data in both [streaming log](#activity-logs) and [visualized dashboard](#creating-visualizations) representations. All data represented in Shadow AI Remediation is sourced from a centralized audit log and presented in either a visualization or streaming log format. ## Activity Logs When a user views a website in their browser, the [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) records metadata of the activity such as browser version and URL of the website, and stores it as an event in the activity log. Logs can be filtered based upon the web category of user event. Log web filters include: - **GenAI** - All GenAI audit logs associated with a Shadow AI Remediation tenant. Note [Discovery and Visibility Configuration](https://documentation.sailpoint.com/sair/help/index.html#discovery-and-visibility-configuration) is required to ensure all GenAI related activity is recorded. - **Identity** - Identity specific GenAI user events that displays typed usernames, login methods, application URLs, and identity risks. - **Data** - Data-specific user events around user download/upload events, applications/URLs used, and filenames. - **OAuth** - Authorization specific user events that show whenever user's perform authorization-level events and scopes associated from a provider such as Microsoft, Google, etc. [Log queries](#building-a-basic-log-query) can be created to further filter the activity log, and you can create a [visualization](#creating-visualizations) to show a graphical representation of the log data. Select the **Grid** / **Visualization** toggle to switch between view types: - **Grid View** - The default tabular view displaying detailed application and account metrics. - **Visualization Mode** - Keeps the same underlying query but allows you to create visualization charts and visual summaries based on SaaS attributes, usage, or risk indicators. Select the Export data as CSV icon to export the grid view as a CSV file for further analysis and reporting. Selecting a log entry opens the detail panel with detailed contextual information. **To view an activity log:** 1. Select **Logs** from the left hand pane. 1. Select **Web** and choose the desired web filter tab. 1. Select an entry to view the events metadata. ## Building a Basic Log Query Basic log queries can be created by selecting the filter dropdowns to refine your search criteria. **To build a basic log query:** 1. Select **Logs** from the left hand pane. 1. Select **Web** and choose the desired web filter tab. 1. Select the filter dropdowns to refine your search. - **Last 7 days** - select the desired time frame for the logs to be evaluated within. - **Department** - select the desired department. - **Log Level** - select the desired log level. 1. Select **More Filters** to further filter based upon specific domains, users, risky actions, and applications. The log results are displayed based upon your selected log query. To save your query, select the Database icon next to the search box, and select **Save as new query**. ## Building Advanced Log Queries Custom log queries can be created using the log search box. Log queries for specific use cases can be built using [predefined search query syntax's](#search-query-syntax) and combined with AND, OR, NOT, AND NOT, and TO operators. **To build an advanced log query:** 1. Select **Logs** from the left hand pane. 1. Select **Web** and choose the desired web filter tab. 1. Enter the required syntax into the search box. 1. Select the Database icon next to the Log search box, and select **Save as new query**. Once the advanced log query has been saved, you can [create a visualization](https://documentation.sailpoint.com/sair/help/data_analytics.html#creating-visualizations) to view a graphical representation of the log data. The table below shows example advanced queries for common use cases. | **Category** | **Use Case** | **Syntax Example** | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | App-Based Log Query | Parse out for all logs associated with Microsoft apps, excluding SharePoint. | `app:Microsoft AND NOT app:"Microsoft Sharepoint"` | | Risk-Based Log Query | Users entering weak corporate credentials. **NOTE**: Password strength is determined by a [zxcvbn password strength evaluator](https://github.com/dropbox/zxcvbn). | `action.keyword:"Risky Sign-in" AND password_strength:{1 TO 3} AND is_business:true` The syntax example surfaces whenever a user has performed a Risky Login action (`action.keyword`), has a very weak, weak, or medium password (`password_strength:{1 TO 3}`), and only looks for corporate credentials with a corporate username (`is_business:true`). | | Reused Passwords Query | Surface corporate credential reuse where Shadow AI Remediation has a medium or high confidence level of this risk. | `action.keyword:"Risky Sign-in" AND is_business:true AND reused_passwords:* AND NOT risk_confidence:RISK_CONFIDENCE_LOW` This syntax example surfaces corporate credential reuse (`action.keyword,is_business,reused_password:*`filters) and prioritizes more accurate confidence of credential reuse (`risk_confidence`). Note that in this query a wildcard character is used next to the `reused_passwords` attribute to cover all applications that a user re-uses their password against. Additionally, this query uses a series of `AND` operators to connect the query as well as an `AND NOT` operator to remove all logs that have a low confidence associated with password reuse. | Note Use syntax `app:[app name]` when searching for applications in logs, and `app_name:[app name]` when searching the SaaS Inventory and Accounts Inventory. ## Viewing a Specific User's Session You can view the user details for a specific event. This allows an administrator to trace the URL path the user followed to get to the logged event. This can be helpful when tracing context on how a user navigated and logged into an application. **To follow a specific user's session:** 1. Select **Logs** from the left hand pane. 1. Select **Web** and choose the desired web filter tab. 1. Right-click on the desired log and select **Follow Session**. 1. Select **X** next to Session to return to the previous log view. ### Search Query Syntax The table below shows commonly used search query syntax's that can be constructed within the search box. These can be combined using AND, OR, NOT, and AND NOT operators. These operators must be capitalized within the format of a search query. The following is an example advanced search query that combines multiple attributes: `action.keyword:sign-in AND NOT login_method:("Enterprise single sign-on", "Auto detected") AND is_business:true AND NOT app:{{list.IdP}}` | Query Attribute | Description | Values | Examples | | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | | `app` (when searching logs) `app_name` (when searching inventory’s) | Application Name tied to a Shadow AI Remediation Log event. This can be presented as the direct application name, a partial name with a wildcard, or referencing a [list](https://documentation.sailpoint.com/sair/help/lists.html) using brackets. | Any Application Name or List value `Google` `{{list.idp-apps}}` | `app:Dropbox` `app:Microsoft*` `app:{{list.idp-apps}}` | | `app_labels` | Application category associated with application log events. | Any application category value `"Cloud Storage"` `"Project Management"` `"File Sharing"` | `app_labels:"Cloud Storage"` `app_labels:"Cloud Storage" OR app_labels:"File Sharing"` | | `action.keyword` | Action a user is performing on a Shadow AI Remediation Log event. | `Browse` `Sign-in` `"Risky Sign-in"` `"Credentials Submitted"` `Download` `Upload` `Share` `"Authorization Success"` | `action.keyword:Browse` `action.keyword:"Credentials Submitted"` | | `user` | A username identifying which user is associated with a login event. This is the user that the Shadow AI Remediation extension has authenticated. | `paul.bunyan` | `user:paul.bunyan` | | `session_user` | The account’s username. The value a user enters into a login form on a web page, or retrieved through SSO. | `paul.bunyan@company.com` `paul*` `admin` | `session_user:"paul.bunyan@company.com"` `session_user:paul*` | | `profile_user` | The username associated with the end user's browser profile. This is not a commonly-used log filter attribute. | `paul.bunyan@gmail.com` | `profile_user:"paul.bunyan@gmail.com"` | | `url` | URLs associated with Shadow AI Remediation log events. | `[www.bing.com](http://www.bing.com/)` `*google.com` `mail.google.com/u/0` | `url:[www.bing.com](http://www.bing.com/)` `url:*google.com` `url:"mail.google.com/u/0"` | | `domain` | Domains associated with Shadow AI Remediation log events. | `bing.com` `*microsoft.com` | `domain:bing.com` `domain:*microsoft.com` | | `is_business` | A boolean value that determines if a username is within the corporate domain. If this is set to true it will only display log query events for usernames that match the list of business domains. i.e. if the domain of company.com is in the list of business domains, all users with a username of [user@company.com](mailto:user@company.com) will display. Setting this to false will remove all business accounts from this. | `true` `false` | `is_business:true` `is_business:false` | | `login_method` | Attribute that determines how a user authenticated into an application. | `"Login form"` `"Enterprise single sign-on"` `"Consumer single sign-on"` `"Auto detected"` | `login_method:"Login form"` `login_method:("Enterprise single sign-on", "Auto detected")` | | `permissions` | Scope associated with Permissions allowed with a user's authorization event. | Any OIDC scope associated with an authorization event `openid` `profile` `offline_access` | `permissions:offline_access` | | `credential_risk_types` | Attribute that determines what type of risky sign-in associated with a Shadow AI Remediation login event. | `Reused` `Weak` `Compromised` `"Shared account"` `"No pwd manager"` `"No MFA"` `"Contains keyword"` | `credential_risk_types:Weak` `credential_risk_types:Reused AND NOT credential_risk_types:"No pwd manager"` | | `password_compromised` | A boolean value determining if a user's credentials are compromised. | `true` `false` | `password_compromised:true` `password_compromised:false` | | `password_contains_keyword` | A boolean value determining if a user's credentials contain a value populated within the password-substrings list. | `true` `false` | `password_contains_keyword:true` `password_contains_keyword:false` | | `password_strength` | Numerical Attribute from 0-6 that represents password strength as outlined against the [zxcvbn password strength evaluator](https://github.com/dropbox/zxcvbn). Use brackets and a TO operator to define a range of values. 0: Single Sign-On 1: Very Weak 2: Weak 3: Medium 4: Strong 5: Very Strong | `0` `{1 TO 5}` | `password_strength:0` `password_strength:{1 TO 5}` | | `reused_passwords` | Application name where Reused Password occurs. Set this to a wildcard value to query all apps with password reuse.Query this on a per-app basis to query around which apps specifically are having a reused credential risk. | `*` `Microsoft*` `Google` | `reused_passwords:*` `reused_passwords:Microsoft*` `NOT reused_passwords:Google` | | `risk_confidence` | Confidence of the Shadow AI Remediation platform around Risk level. | `RISK_CONFIDENCE_LOW` `RISK_CONFIDENCE_MEDIUM` `RISK_CONFIDENCE_HIGH` | `risk_confidence:RISK_CONFIDENCE_HIGH` `NOT risk_confidence:RISK_CONFIDENCE_LOW` | | `download_file_type` | Type of file performed via a file download event. Wildcard and NOT logic are available to perform against this log attribute query. | `pdf` `*ml` `html` | `download_file_type:pdf` `download_file_type:*ml` `NOT download_file_type:html` | | `upload_file_type` | Type of file performed via a file upload event. Wildcard and NOT logic are available to perform against this log attribute query. | `pdf` `*ml` `html` | `upload_file_type:pdf` `upload_file_type:*ml` `NOT upload_file_type:html` | | `clipboard_data_size` | The file size of the pasted string. | `25 bytes` | `clipboard_data_size:>25` | | `clipboard_sensitive_keywords` | The detected sensitive keyword(s). | `acquisition` `forecast` | `clipboard_sensitive_keywords: acquisition, forecast` | ## Creating Visualizations Visualizations are a way to create a graphical representation of log data that the Shadow AI Remediation platform has captured. There are two methods of constructing visualizations: - **Visualization Preview** - A temporary visualization of log data for a quick visualization of streaming log data. - **Visualization Library** - A more permanent graphical view of log data. This can be shared with other admins and be used within Dashboards. **To create a visualization preview from the log menu:** 1. Select the visualization icon  from the top right. 1. Select **Visualization type** from the left pane. 1. Select the type of visualization. Options include Bar, Counter, Donut, Line, Pie, and Table. 1. Additional fields are displayed based upon the selected visualization type. 1. Configure the additional fields that are required. You can break down data on a per slice, axis, or row/column basis depending on the visualization type selected. **To create a table of apps visualization from the visualization library:** 1. Go to  **Settings > Visualization Library**. 1. Select **+ New visualization**. 1. In the New visualization window choose **Web visualization** and select **Create**. 1. Select the type of vitalization. Option include Bar, Counter, Donut, Line, Pie, and Table. 1. Additional fields are displayed based upon the selected visualization type. 1. Configure the additional fields that are required. 1. Select **Save** in the top right corner of the visualization editor. 1. Enter a name. 1. Select **Save** to save the visualization. ## Viewing Dashboards Shadow AI Remediation comes with out-of-the-box dashboards, providing visibility into SaaS usage, security posture, and identity hygiene across your organization. Each dashboard presents interactive widgets, trend charts, and data. Use quick filters to refine the visualization data by department and time frame. **To view an out-of-the-box dashboard:** 1. Go to **Dashboards**. 1. Select the desired dashboard tab from the dashboard ribbon. To view the underlying data for a visualization, select **Actions** **> Show data**. ### GenAI Overview Dashboard The GenAI Overview dashboard provides an overview of GenAI activity and security risks across your organization. It monitors the total volume of applications, active users, and monitors file uploads to detect potential data exfiltration. Additionally, it categorizes usage by highlighting common text generation tools, identifying high-risk applications with poor privacy postures, and listing the most popular AI tools currently in use. Key insights include: - The total number of GenAI applications in use. - The number of users interacting with GenAI tools. - File uploads to GenAI services, helping detect potential data exfiltration. - Categorized usage breakdowns, including: - Text generation tools, such as ChatGPT. - Risky AI applications, where data handling or privacy posture requires special attention. - GenAI applications used by most users. ### GenAI Breakdown Dashboard The GenAI Breakdown dashboard provides a categorized breakdown of Generative AI activity and security risks across your organization. The dashboard monitors critical security elements such as the authentication methods used for logins, specific credential risk types associated with generative AI, and high-risk applications that require closer attention. Key insights include: - Categorized usage breakdowns, including: - Text generation tools, such as ChatGPT. - Coding AI tools. - Authentication methods used to login to AI tools. - Marketing and sales AI tools. - Note-taking or summarization AI tools. - Risky AI applications, where data handling or privacy posture requires special attention. - GenAI applications credential risk types. # Managing Departments Departments allow admins to create groups of users based upon business area, which can be used to filter [dashboards](https://documentation.sailpoint.com/sair/help/data_analytics.html#viewing-dashboards) and [logs](https://documentation.sailpoint.com/sair/help/data_analytics.html#activity-logs). Departments do not affect policy scoping or any configuration within Shadow AI Remediation. **To create a department:** 1. Go to **General settings > Target** groups. 1. Select **New department**. 1. On the New department window, complete the following: - In the **Name** field, enter a name to identify the department. - (Optional) In the **Description** field, enter a description for the department. 1. Select **Create**. 1. On the **Departments** page, select the newly created list item. 1. On the list details page, select **Add users**. 1. On the Add users or groups window, complete the following: - Select **Users** to add users from your IdP. - Select **Groups** to add groups from your IdP. 1. Select **Add**. The department is available to be selected in the Departments filter on [dashboards](https://documentation.sailpoint.com/sair/help/data_analytics.html#viewing-dashboards) and [logs](https://documentation.sailpoint.com/sair/help/data_analytics.html#activity-logs). # Managing Lists Lists allow admins to create reusable sets of values such as domains, applications, or identifiers, that can be used in [global allow lists](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#managing-global-allowlist), [playbooks](https://documentation.sailpoint.com/sair/help/playbooks/index.html), and [search queries](https://documentation.sailpoint.com/sair/help/data_analytics.html#building-advanced-log-queries) for log analysis. Lists enable admins to: - Update and manage values in a single place within Shadow AI Remediation. - Reduce repetitive entry and human error. - Define policy conditions once and apply them across multiple controls. **To create a list:** 1. Go to **General settings > Lists**. 1. Select **+ New > List**. 1. In the **Choose list type** window, select the desired list type. 1. Select **Next**. 1. On the New list window, complete the following: - In the **Name** field, enter a name to identify the list. - (Optional) In the **Description** field, enter a description for the list. 1. Select **Create**. 1. On the **Lists** page, select the newly created list item. 1. On the list details page, select **Add items**. 1. Add the desired items and select **Add**. The list is available to be used in [global allow lists](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#managing-global-allowlist) and [search queries](https://documentation.sailpoint.com/sair/help/data_analytics.html#building-advanced-log-queries). **To view and add applications to an existing list:** 1. Go to **Settings > Lists**. 1. Select the desired list to view applications included in the list. 1. On the list details page, select **Add items**. 1. Add the desired applications and select **Add**. # Managing Target Groups Target Groups allow admins to control which users and areas of your organization Shadow AI Remediation discovery and enforcement actions apply to. This removes the need to create and maintain new groups in your IdP provider, such as Okta and Microsoft Entra ID. Once defined, the target group can be used for policy scoping in [Playbooks](https://documentation.sailpoint.com/sair/help/playbooks/index.html). A Target Group can include: - Individual users - Existing IdP groups - Any combination of the above **To create a target group:** 1. Go to **General settings > Target groups**. 1. Select **New target group**. 1. On the New target group window, complete the following: - In the **Name** field, enter a name to identify the target group. - (Optional) In the **Description** field, enter a description for the target group. 1. Select **Create**. 1. On the **Target Groups** page, select the newly created list item. 1. On the list details page, select **Add users**. 1. On the Add to target group window, select the **Search for group names** field and complete the following: - Select **Users** to add users from your IdP. - Select **Group** to add groups from your IdP. 1. Select **Add**. The target group is available to be used in [Discovery settings](https://documentation.sailpoint.com/sair/help/settings/security_settings.html#configuring-discovery-settings). # Browser Extension The Shadow AI Remediation browser extension provides visibility and supports GenAI governance processes across both managed and unmanaged SaaS environments. It operates in the browser to detect, correlate, and enhance governance of GenAI-related activities, without requiring any end-user configuration or interaction. Note The browser extension must be deployed in a currently-supported browser. Contact your Customer Success Manager for more information. ## Deployment and Operation Deployment is supported by any MDM solution, including Intune, Jamf, and Workspace ONE (to be provided by the customer). Once deployed, the browser extension installs and begins operation. It is recommended to deploy the browser extension in a locked state, preventing end users from [disabling it](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html). For cases requiring flexibility, the browser extension supports temporary pause functionality, governed by role-based policy controls. If disabled or temporarily suspended, the browser extension will not operate as described in this documentation. The browser extension automatically authenticates using the logged-in user’s corporate identity, ensuring continuous correlation to the employee’s IdP account. | | | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Intune | [Chrome for Windows](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/intune_chrome_win.html)         [Edge for Windows](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/intune_edge_win.html)         [Chrome for Mac](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/intune_chrome_mac.html) | | Microsoft SCCM | [Chrome for Windows](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/sccm_chrome_win.html)         [Edge for Windows](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/sccm_edge_win.html) | | Group Policy (GPO) | [Chrome for Windows](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/gpo_chrome_win.html)         [Edge for Windows](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/gpo_edge_win.html) | | Jumpcloud | [Chrome for Windows](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/jumpcloud_chrome.html)         [Chrome for Mac](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/jumpcloud_chrome.html) | | Jamf Pro | [Chrome for Mac](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/jamfpro_chrome_mac.html)                 [Edge for Mac](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/jamfpro_edge_mac.html) | | Chrome Enterprise | [Chrome Enterprise](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/chrome_enterprise.html) | | Workspace ONE UEM | [Chrome for Mac](https://documentation.sailpoint.com/sair/help/browser_extension/deployment/workspace_chrome_mac.html) | | Powershell template | [Chrome](https://docs.savvy.security/chrome.ps1)         [Edge](https://docs.savvy.security/edge.ps1) | | Powershell (Self Signed) | [Chrome](https://docs.savvy.security/chrome_signed.ps1)         [Edge](https://docs.savvy.security/edge_signed.ps1)         [Certificate](https://docs.savvy.security/savvy_cs.cer) | ## Intelligent Sign-In Detection Using a generic sign-in detection algorithm, the browser extension recognizes authentication events across any web application. This includes commercial business applications such as Salesforce and Workday, applications accessed for personal, non-work purposes, applications developed in house, and unsanctioned applications, often referred to as shadow IT applications. For each login event, the browser extension: - Detects the username used during authentication. - Evaluates password complexity. - Checks whether the password has appeared in any known breach databases. ## Correlation and Identity Context Because users are always authenticated against the enterprise IdP, the browser extension inherently correlates all discovered accounts and credentials back to the verified corporate identity. This enables Shadow AI Remediation to map the full relationship between a user’s primary identity and every account they access across the SaaS environment. ## Activity and Metadata Logging The browser extension records detailed activity logs with contextual metadata. Logged events include: - Browsing session initiation. - File uploads and downloads. - Credential submissions and sign-ins. - Clipboard paste and print operations. This telemetry can be aggregated and analyzed at the browsing-session level, providing security and compliance insights without capturing private content. ## Privacy and Control Admins can define allowlists and bypass rules for specific websites to preserve user privacy. Password complexity and keyword checks are performed entirely on the client side, while compromised and reused passwords are validated using a cryptographically hashed version of the password that is designed to ensure that no plaintext credentials are exposed. All privacy-related features can be managed and optionally disabled. Refer to [Configuring Privacy Controls](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html) for additional information. Important The browser extension does not differentiate between personal applications and business applications, or between a user’s personal activities and business activities. It will capture the same details for personal activities conducted using any browser in which the extension is deployed. Customers are responsible for ensuring that the collection and use of personal activity data complies with applicable law and contract terms, which may include obtaining consent and/or notifying users about potential personal data collection and processing. Please contact your legal department with any questions. # Managing Extensions Shadow AI Remediation allows you to control the rollout of browser extension versions by providing stable and the latest browser extension builds. You can [assign specific users or groups](#defining-deployed-extension-builds) the latest build to facilitate testing in a controlled, localized manner. Details of each installed browser extension can be viewed on the **Extensions > Extension management** tab. ## Defining Deployed Extension Builds Shadow AI Remediation provides two browser extension builds available for deploying to endpoints: - **Stable Extension** - The recommended version used across the organization. - **Latest Extension** - The newest build intended for controlled rollout for early-adopter testing. By default, all users receive the stable extension. Organizations may optionally assign specific users or groups to receive the latest extension, enabling targeted exposure of new functionality. Details of the current stable and latest browser extension, including version, build and release date can be viewed on the **Extensions > Versions** tab. Updated browser extension versions are deployed to the endpoint through your MDM solution. **To define users to receive the latest extension version:** 1. Go to **Extensions > Versions** tab. 1. In the Latest Extension section, select **Edit users**. 1. From the **Select users or groups** box, select a user or group: - Select **Users** to add users from your IdP. - Select **Groups** to add groups from your IdP. 1. Select **Done**. Shadow AI Remediation will push the latest extension version to selected users through your MDM solution. ## Managing Extension Versions The extensions table displays all installed instances of the browser extension. This view can be searched by user. Use this information to determine the version of browser extension deployed to a user, the build, and when communication was last transmitted to Shadow AI Remediation. Use quick filters to refine users listed in the table by status, browser and [department](https://documentation.sailpoint.com/sair/help/departments.html). Select the Export data as CSV icon to export the grid view as a CSV file for further analysis and reporting. To temporarily stop the browser extension for all users, select **Pause extensions**. To restart the browser extension for all users select **Unpause extensions > Unpause all**. # Deploying Using Chrome Enterprise 1. [Log into the Shadow AI Remediation admin console](https://documentation.sailpoint.com/sair/help/index.html#accessing-shadow-ai-remediation). 1. Select **Extensions > Deployment** tab. 1. Select the **Managed deployment** tile. 1. On the **Managed deployment** page, copy the following values which will be used later in the deployment: - In the **Extension URL** field, copy the value `https://extension.savvy.security/update.xml`. - In the **Extension ID** field, copy the value `ckdibgmbbhmafmjpjmknleccgcddanan`. 1. Log into the Google admin console at `https://admin.google.com/`. 1. On the left panel go to **Devices > Chrome > Apps & Extensions > Users & Browsers**. 1. Select the relevant Organizational Unit or Group for the deployment, and complete the following: - On the bottom right select the yellow **+** button. - Select **Add Chrome app or extension by ID**. 1. On the **Add Chrome app or extension ID** page, complete the following: - In the **Extension ID** field, enter the value copied from the Shadow AI Remediation admin console. - Select **From a custom URL**, and enter the **Extension URL** value copied from the Shadow AI Remediation admin console. 1. Select **Save**. 1. Select the **Users & Browser** tab, and select the extension. 1. Change **Installation Policy** to the desired value. Important It is recommended to select **Force Install**, forcing the extension to be deployed automatically. If the **Allow Install** value is selected, users will need to install the extension manually. 1. Select **Save** on the top right. # Deploying Using Group Policy (GPO) for Chrome on Windows 1. [Log into the Shadow AI Remediation admin console](https://documentation.sailpoint.com/sair/help/index.html#accessing-shadow-ai-remediation). 1. Select **Extensions > Deployment** tab. 1. Select the **Managed deployment** tile. 1. On the **Managed deployment** page, copy the following values which will be used later in the deployment: - In the **Extension URL** field, copy the value `https://extension.savvy.security/update.xml`. - In the **Extension ID** field, copy the value `ckdibgmbbhmafmjpjmknleccgcddanan`. 1. Log into the Windows domain controller device. 1. Download the [Google Administrative Templates](https://dl.google.com/dl/edgedl/chrome/policy/policy_templates.zip) to your domain controller. 1. Extract the `windows\admx\google.admx` XML-based administrative template admx file into `C:\Windows\PolicyDefinitions`. 1. Extract the `windows\admx\chrome.admx` XML-based administrative template admx file into `C:\Windows\PolicyDefinitions`. 1. Extract the `windows\admx\en-US\google.adml` admx file into `C:\Windows\PolicyDefinitions\en-US`. 1. Extract the `windows\admx\en-US\chrome.adml` admx file into `C:\Windows\PolicyDefinitions\en-US`. 1. Open the **Group Policy Management Editor**. 1. Create a new GPO policy, or select an existing policy. 1. Right-click your **GPO** and select **Edit**. 1. On the left panel, go to **Computer > User configuration > Policies > Administrative templates > Google > Google Chrome > Extensions**. 1. On the right panel, select **Configure the list of force-installed extensions**, right-click and select **Edit**. 1. On the **Configure the list of force-installed extensions** window, complete the following: - Select **Enabled**. - Select **Show**. - In the **Extension/App IDs and update URLs to be silently installed** field enter `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. 1. Select **From a custom URL**, and enter the **Extension URL** value copied from the Shadow AI Remediation admin console. 1. Select **OK**. # Deploying Using Group Policy (GPO) for Edge on Windows 1. Download and install the [Microsoft Edge GPO Policy Templates](https://learn.microsoft.com/en-us/DeployEdge/configure-microsoft-edge). 1. Log into the Windows domain controller device. 1. Open the **Group Policy Management Editor**. 1. Create a new GPO policy, or select an existing policy. 1. Go to **Computer Configuration > Policies > Administrative Templates > Microsoft Edge > Extensions**. 1. Select **Control which extensions are install silently**, and select **Enabled**. 1. Under **Options**, select **Show**. 1. In the **Show Contents** window, complete the following: - In the **Value** field, enter the value `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. - Select **OK**. 1. Select **OK**. 1. Verify that Edge is now managed on endpoints: - Open Microsoft Edge on a managed target endpoint. - Go to `edge://extensions` and verify that the extension is installed and enabled. # Deploying Using Microsoft Intune for Chrome on Mac OS 1. Go to `https://endpoint.microsoft.com/#home`. 1. Go to **Endpoint Manager > Devices > Configuration Profiles**. 1. Select **+ Create Profile**. 1. On the **Create a profile** page, complete the following: - In the **Platform** dropdown, select **macOS**. - In the **Profile Type** dropdown, select **Templates**. - In the **Template name** dropdown, select **Preference file**. 1. Select **Create**. 1. On the **Basics** tab, complete the following: - In the **Name** field, enter a name to identify the profile. - In the **Description** field, enter a description for the profile. 1. Select **Next**. 1. On the **Configuration settings** tab, complete the following: - In the **Preference domain name** field, enter **com.google.chrome**. - In the **Property list file** field, upload the following plist file: ```py ExtensionInstallForcelist ckdibgmbbhmafmjpjmknleccgcddanan; https://extension.savvy.security/update.x ml update_url https://extension.savvy.security/update.xml ``` 1. Select **Next**. 1. On the **Assignments** tab, assign any desired target users and groups and select **Next**. 1. On the **Review + create** tab, select **Create**. 1. Wait for new policy to propagate, or perform a manual synchronization. 1. Once propagated, verify that Chrome is now managed on endpoints: - Re-open Chrome on a managed target endpoint. - Select the three dots icon on the top right. The bottom entry should read “Managed by” followed by your organization name. - Open a new tab and browse to `chrome://policy`. - Verify under **Chrome Policies** you can see the **ExtensionInstallForcelistDesc** policy name with the following value: `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. # Deploying Using Microsoft Intune for Chrome on Windows 1. Go to `https://intune.microsoft.com/`. 1. Go to **Endpoint Manager > Devices > Configuration policies**. 1. Select **Create > New Policy**. 1. On the **Create a profile** page, complete the following: - In the **Platform** dropdown, select **Windows 10 and later**. - In the **Profile Type** dropdown, select **Templates**. - In the **Template name** dropdown, select **Administrative templates**. 1. Select **Create**. 1. On the **Basics** tab, complete the following: - In the **Name** field, enter a name to identify the profile. - In the **Description** field, enter a description for the profile. 1. Select **Next**. 1. On the **Configuration settings** tab, select **Configure the list of force-installed apps and extensions configuration**. Verify the path is `\Google\Google Chrome\Extensions`. 1. In the right hand panel, complete the following: - Under **Supported on: Microsoft Windows 7 or later** select **Enabled**. - In the **Extension/App IDs and update URLs to be silently installed** field enter `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. 1. Select **OK**. 1. Select **Next**. 1. On the **Scopes tags** tab, add any desired scope tags and select **Next**. 1. On the **Assignments** tab, assign any desired target users and groups and select **Next**. 1. On the **Review + create** tab, select **Create**. 1. Wait for new policy to propagate, or perform a manual synchronization. 1. Once propagated, verify that Chrome is now managed on endpoints: - Re-open Chrome on a managed target endpoint. - Select the three dots icon on the top right. The bottom entry should read “Managed by” followed by your organization name. - Open a new tab and browse to `chrome://policy`. - Verify under **Chrome Policies** you can see the **ExtensionInstallForcelistDesc** policy name with the following value: `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. # Deploying Using Microsoft Intune for Edge on Windows 1. Go to `https://intune.microsoft.com/`. 1. Go to **Endpoint Manager > Devices > Configuration Profiles**. 1. Select **+ Create Profile**. 1. On the **Create a profile** page, complete the following: - In the **Platform** dropdown, select **Windows 10 and later**. - In the **Profile Type** dropdown, select **Settings catalog**. 1. Select **Create**. 1. On the **Basics** tab, complete the following: - In the **Name** field, enter a name to identify the profile. - In the **Description** field, enter a description for the profile. 1. Select **Next**. 1. On the **Configuration settings** tab, complete the following: - Select **+ Add Settings**. - In the **Settings picker** pane, complete the following: - In the **Category** field, select **Microsoft Edge\\Extensions**. - In the **Setting name** field, select **Control which extensions are installed silently**. - Select **Close**. - In the **Control which extensions are installed silently** field select **Enabled**. - In the **Extension/App IDs and update URLs to be silently installed (Device)** field enter `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. 1. Select **Next**. 1. On the **Scopes tags** tab, add any desired scope tags and select **Next**. 1. On the **Assignments** tab, assign any desired target users and groups and select **Next**. 1. On the **Review + create** tab, select **Create**. 1. Wait for new policy to propagate, or perform a manual synchronization. 1. Once propagated, verify that Edge is now managed on endpoints: - Re-open Edge on a managed target endpoint. - Browse to `edge://policy`. - Verify under **Policies** you can see the **ExtensionInstallForcelistDesc** policy name with the following value: `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. - Browse to `edge://extensions`. - On the top of the screen, verify that the message “Your browser is managed by your organization” is shown. - In the **Installed extensions**, verify that **Savvy** is listed. # Deploying Using Jamf Pro for Chrome on Mac OS 1. In Jamf Pro, select **Computers**. 1. On the left panel, select **Configuration Profiles**. 1. Select **+ New**. 1. On the new profile, complete the following: - In the **Name** field, enter a name to identify the profile. - In the **Category** dropdown, select a category. - In the **Level** field, select **Computer Level**. 1. On the left panel, select **Custom Settings**. 1. In the **Preference Domain** field, enter **com.google.chrome**. 1. In the **Property list file** field, upload the following plist file: ```py ExtensionInstallForcelist ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml ExtensionSettings ckdibgmbbhmafmjpjmknleccgcddanan installation_mode force_installed force_pinned update_url https://extension.savvy.security/update.xml ``` 1. Select **Save**. # Deploying Using Jamf Pro for Edge on Mac OS 1. In Jamf Pro, select **Computers**. 1. On the left panel, select **Configuration Profiles**. 1. Select **+ New**. 1. On the new profile, complete the following: - In the **Name** field, enter a name to identify the profile. - In the **Category** dropdown, select a category. - In the **Level** field, select **Computer Level**. 1. On the left panel, select **Custom Settings**. 1. In the **Preference Domain** field, enter **com.microsoft.Edge**. Note Ensure 'Edge' is entered with an uppercase 'E'. 1. In the **Property list file** field, upload the following plist file: ```py ExtensionInstallForcelist ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml ExtensionSettings ckdibgmbbhmafmjpjmknleccgcddanan installation_mode force_installed force_pinned update_url https://extension.savvy.security/update.xml ``` 1. Select **Save**. # Deploying Using Jumpcloud for Chrome on Mac OS and Windows 1. Log into the Jumpcloud admin portal at `https://console.jumpcloud.com/login/admin`. 1. On the left panel, select **Policy Management**. 1. Select the **+** button. 1. Select **Chrome Browser Force-Installed** policy, and select **configure**. 1. In the **Additional Chrome Browser Extensions** tile, complete the following: - Select **add extension ID**. - In the empty field, enter `eocjfoecmhaiedpjghfoponibjkehifb`. 1. Select **Save**. # Deploying Using Microsoft SCCM for Chrome on Windows 1. Open the SCCM console on your administrative workstation. 1. Go to **Assets and Compliance > Compliance Settings > Configuration Items**. 1. Select **Create Configuration Item**. 1. In the **Name** field, enter a name to identify the configuration item. 1. Select **Next**. 1. Select the desired platforms for which this configuration will apply. 1. Select **Next**. 1. Select **New** to create a new setting. 1. In the **New Settings** window, complete the following: - In the **Name** field, enter **ExtensionInstallForcelist**. - In the **Description** field, enter **Shadow AI Remediation Browser Extension**. - In the **Key Name** field, enter `Software\Policies\Google\Chrome\ExtensionInstallForcelist`. - In the **Value Name** field, enter **1**. Note This number must be unique. If you have added other extensions, this number should be incremented accordingly. 1. Select **OK**. 1. Select the **Compliance Rules** tab, and select **New**. 1. In the **Create** window, complete the following: - In the **Name** field, enter **Shadow AI Remediation Security Extension Compliance Rule**. - In the **Description** field, enter **Shadow AI Remediation Browser Extension**. - In the **the following values:** field, enter the value `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. - Select **Remediate noncompliant rules when supported**. - Select **Report noncompliance if this setting instance is not found**. 1. Select **OK** to close the window. 1. Select **OK** to create the new compliance rule. 1. Select **Assets and Compliance > Compliance Settings > Configuration Baselines**. 1. Select **Create Configuration Baseline**. 1. In the **Name** field, enter a name to identify the configuration baseline. 1. Select **Add > Configuration Item**. 1. Select the **Shadow AI Remediation Browser Extension Configuration Item**, and select **OK**. 1. Select **OK** to complete the new configuration baseline. 1. Deploy the configuration baseline containing the **Shadow AI Remediation Browser Extension Configuration Item** and complete the following: - Select **Remediate noncompliant rules when supported**. - In the **Schedule** section, set the schedule to the desired value. Note Group policies update, by default, every 90 minutes. If this is replacing a GPO, consider lowering the policies update interval. 1. Select **OK**. 1. Once SCCM has updated its policies, verify that Chrome is now managed on endpoints: - Open a Chrome and browse to `chrome://policy`. - Verify under **Chrome Policies** you can see the **ExtensionInstallForcelistDesc** policy name with the following value: `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. # Deploying Using Microsoft SCCM for Edge on Windows 1. Open the SCCM console on your administrative workstation. 1. Go to **Assets and Compliance > Compliance Settings > Configuration Items**. 1. Select **Create Configuration Item**. 1. In the **Name** field, enter a name to identify the configuration item. 1. Select **Next**. 1. Select the desired platforms for which this configuration will apply. 1. Select **Next**. 1. Select **New** to create a new setting. 1. In the **New Settings** window, complete the following: - In the **Name** field, enter **ExtensionInstallForcelist**. - In the **Description** field, enter **Shadow AI Remediation Browser Extension**. - In the **Key Name** field, enter `SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist`. - In the **Value Name** field, enter **1**. Note This number must be unique. If you have added other extensions, this number should be incremented accordingly. 1. Select **OK**. 1. Select the **Compliance Rules** tab, and select **New**. 1. In the **Create** window, complete the following: - In the **Name** field, enter **Shadow AI Remediation Security Extension Compliance Rule**. - In the **Description** field, enter **Shadow AI Remediation Browser Extension**. - In the **the following values:** field, enter the value `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. - Select **Remediate noncompliant rules when supported**. - Select **Report noncompliance if this setting instance is not found**. 1. Select **OK** to close the window. 1. Select **OK** to create the new compliance rule. 1. Select **Assets and Compliance > Compliance Settings > Configuration Baselines**. 1. Select **Create Configuration Baseline**. 1. In the **Name** field, enter a name to identify the configuration baseline. 1. Select **Add > Configuration Item**. 1. Select the **Shadow AI Remediation Browser Extension Configuration Item**, and select **OK**. 1. Select **OK** to complete the new configuration baseline. 1. Deploy the configuration baseline containing the **Shadow AI Remediation Browser Extension Configuration Item** and complete the following: - Select **Remediate noncompliant rules when supported**. - In the **Schedule** section, set the schedule to the desired value. Note Group policies update, by default, every 90 minutes. If this is replacing a GPO, consider lowering the policies update interval. 1. Select **OK**. 1. Once SCCM has updated its policies, verify that Edge is now managed on endpoints: - Open Microsoft Edge and browse to `edge://policy`. - Verify under **Microsoft Edge Policies** you can see the **ExtensionInstallForcelistDesc** policy name with the following value: `ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml`. - Open a new tab and go to `edge://extensions`. - Verify that the extension is installed and enabled. # Deploying Using Workspace ONE UEM for Chrome on Mac OS 1. Log into the VMware Workspace ONE UEM management console. 1. Go to **Resources > Profiles & Baselines > Profiles > Add > Add Profile**. 1. Select **Apple macOS > macOS**. 1. Configure the profile’s General Settings. 1. Select **Custom Settings > Configure**. 1. Paste the following payload: ```py PayloadIdentifier org.extension.profiles.com.google.Chrome PayloadRemovalDisallowed PayloadScope User PayloadType Configuration PayloadUUID 63a4d234-ff4e-46f0-bb59-68801ed918bb PayloadOrganization Savvy PayloadVersion 1 PayloadDisplayName Chrome Savvy Extension PayloadContent PayloadType com.apple.ManagedClient.preferences PayloadVersion 2 PayloadIdentifier org.extension.profiles.com.google.Chrome.customsettings PayloadUUID eb004daf-4eae-4a69-be51-a77c6a0442ae PayloadEnabled PayloadDisplayName Google Chrome Preferences PayloadContent com.google.Chrome Forced mcx_preference_settings ExtensionInstallForcelist ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml ``` 1. Select **Save and Publish**. # Integrating with Identity Providers Shadow AI Remediation can integrate with external Identity Providers (IdPs) in order to provide visibility into SaaS usage and risk in your organization. Once integrated and also depending on your chosen IdP, Shadow AI Remediation might be able to: - Allow the [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) and Shadow AI Remediation administrators to authenticate against the IdP. - Read the list of SaaS applications that have been installed in your organization, and parse SSO logs to continuously detect SSO’ed accounts. - Support listing user accounts, user groups, application, and related user activity in the admin portal. - Review the IdP configuration, such as MFA settings and last password rotation dates. Available IdP integrations include: - [Microsoft Entra ID](https://documentation.sailpoint.com/sair/help/idp/entra_idp.html) - Use for integration with Microsoft Entra ID IdP. - [Okta](https://documentation.sailpoint.com/sair/help/idp/okta_idp.html) - Use for integration with Okta IdP. - [Other IdP](https://documentation.sailpoint.com/sair/help/idp/other_idp.html) - Use for integration with IdP’s other than Microsoft Entra ID or Okta. # Integrating with Microsoft Entra ID The Shadow AI Remediation platform is deployed in Microsoft Entra ID as a multi-tenant application. Shadow AI Remediation uses Microsoft Entra ID API to authenticate end users and administrators logging into the Shadow AI Remediation platform and to gather information on applications integrated with Microsoft Entra ID and their permissions. Once integrated with Microsoft Entra ID, Shadow AI Remediation can: - Allow the [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) and Shadow AI Remediation administrators to authenticate against the IdP. - Read the list of SaaS applications that have been installed in your organization, and parse SSO logs to continuously detect SSO’ed accounts. - Support listing user accounts, user groups, application, and related user activity in the admin portal. - Review the IdP configuration, such as MFA settings and last password rotation dates. You will first create an application integration in Microsoft Entra ID to configure authentication, and then create a Privileged Role Administrator. To establish trust with Microsoft Entra ID, an [Azure Active Directory Administrator with the Privileged role administrator](#creating-a-privileged-role-administrator-in-azure-active-directory) role is required. **To configure authentication:** 1. [Log into the Shadow AI Remediation admin console](https://documentation.sailpoint.com/sair/help/index.html#accessing-shadow-ai-remediation). 1. Go to **Settings > General Settings**. 1. Select the **Identity Provider** tab. 1. Select **+Add**. 1. Select **Azure AD**. 1. Select **Connect**. 1. If your are an Azure Active Directory Administrator with an admin privileged role, select **Open link**. - Select the checkbox to accept the permissions requested by Shadow AI Remediation. For a full list of requested permissions, refer to [Requested Permissions](#requested-permissions). - A confirmation page is displayed confirming trust has been successfully established. 1. If you are not an Azure Active Directory Administrator with an admin privileged role, select **Copy link**. - Ask your Microsoft Entra ID administrator with an admin privileged role, to click on the copied link and establish trust. - Once trust is established, select **Connect**. 1. A green dot is displayed confirming that connection was established. Shadow AI Remediation admins can now access the Shadow AI Remediation portal. For more information refer to [Accessing Shadow AI Remediation](https://documentation.sailpoint.com/sair/help/index.html#accessing-shadow-ai-remediation). ## Requested Permissions The following table shows the permissions required by Shadow AI Remediation applications from Microsoft Entra ID. | **Microsoft Permission name** | **Description** | | -------------------------------------- | ------------------------------------------------------------------------------------------- | | `Directory.Read.All` | Read directory data | | `User.Read.All` | Read all users' full profiles | | `Application.Read.All` | Read all applications | | `AuditLog.Read.All` | Read all audit logs | | `Policy.Read.All` | Read all organizational policies (e.g., Conditional Access, authentication, token policies) | | `UserAuthenticationMethod.Read.All` | Read all users' registered authentication methods (e.g., phone, FIDO2, Authenticator app) | | `email` `openid` `profile` `User.Read` | Log in (OpenID Connect 2.0) and read user's profile | ## Creating a Privileged Role Administrator in Azure Active Directory 1. Log in to Azure Portal at . 1. Under Azure Services, select **Azure Active Directory**. 1. Select **Users** and select the user that will be used for the Shadow AI Remediation authorization. 1. From the left panel, select **Assigned roles**. 1. Select **Add assignment** and select the checkbox besides **Privileged role administrator**. The role is now assigned to the user. To verify, check that the Resource Name is set to Directory and the Assignment Path is set to Direct. # Integrating with Okta Shadow AI Remediation uses Okta API to authenticate end users and administrators logging into the Shadow AI Remediation platform and to gather information on applications integrated with Okta and their permissions. Once integrated with Microsoft Entra ID, Shadow AI Remediation can: - Allow the [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) and Shadow AI Remediation administrators to authenticate against the IdP. - Read the list of SaaS applications that have been installed in your organization, and parse SSO logs to continuously detect SSO’ed accounts. - Support listing user accounts, user groups, application, and related user activity in the admin portal. - Review the IdP configuration, such as MFA settings and last password rotation dates. You will first create an app integration in Okta to configure authentication, and then configure a service application. **To configure authentication:** 1. Log into Okta at . 1. Go to **Applications > Applications**. 1. Select **Create app integration.** 1. On the **Create app integration** page complete the following: - In the **Sign-in method** section, select **OIDC OpenID Connect**. - In the **Application type** section, select **Web Application**. 1. Select **Next**. 1. On the **New Web Application Integration** page, complete the following: - In the **App integration name** field, enter **Shadow AI Remediation authentication**. - In the **Grant type** field, select **Authorization Code** and **Implicit (hybrid)**. - In the **Sign-in redirect URIs** field, enter ****. - In the **Sign-out redirect URIs** field, remove the default URI. - In the **Assignments** section, select whether to assign the app integration to everyone in your org, only selected group(s), or to skip assignment until after app creation. 1. Select **Save** to save these settings. 1. Select the **Okta API Scopes** tab. 1. Grant the `okta.users.read.self` scope. 1. Select the **General** tab. 1. Copy the following details from the Okta General tab, into the Shadow AI Remediation admin console **Settings > General Settings > Identity Provider**: - **Okta domain** - **Client ID** - **Client Secret** **To configure the service application:** 1. Log into Okta at  . 1. Go to **Security > Administrators**. 1. Select the **Roles** tab. 1. Select **Create** to create a new role. 1. On the **Create new role** page complete the following: - In the **Role name** field, enter **SAIR-Role**. - In the **Description** filed, provide additional details about the role and the access it grants. - In the **Select permissions** section, search for "view roles", and add the **View roles, resources and admin assignments** permission. 1. Select **Save** to save the role settings. 1. Select the **Resources** tab. 1. Select **Create new resource set**. 1. On the **Create new resource set** page complete the following: - In the **Resource name** field, enter **SAIR-Resource**. - In the **Description** filed, provide additional details about the resource. 1. Select **Add Resource**. 1. On the **Add Resource** page, select **Identity and Access Management** and then select **All Identity and Access Management resources**. 1. Select **Save** to save these settings. 1. Go to **Applications > Applications**. 1. Select **Create app integration.** 1. On the **Create app integration** page complete the following: - In the **Sign-in method** section, select **API Services**. 1. Select **Next**. 1. On the **New API Services App Integration** page complete the following: - In the **App integration name** field, enter **Shadow AI Remediation services app**. 1. Select the **Admin roles** tab. - On the **Complete the assignment** page complete the following: - In the **Role** field, select **SAIR-Role**. - In the **Resources set** field, select **SAIR-Resource**. - In the **Role** field, select the **Read-only Administrator** role. 1. Select **Add assignment**. 1. Select the **Okta API Scopes** tab. 1. Grant the following scopes: - `okta.users.read` - Read users for policy matching. - `okta.groups.read` - Read groups for policy matching. - `okta.apps.read` - Read oauth/saml applications to create inventory items. - `okta.logs.read` - Read sign in events. - `okta.policies.read` - Read policies in order to understand MFA status per application. - `okta.domains.read` - Fetching any verified domain. - `okta.roles.read` - Determine role per user, primarily to evaluate if a user is an administrator. - `okta.appGrants.read` - Read all app grants. 1. Select the **General** tab. 1. Select **Edit** to edit the client credentials. 1. In the **Client Credentials** section, for Client authentication select **Public key / Private key**. 1. In the **PUBLIC KEYS** section complete the following: - In the Configuration field, select **Use a URL to fetch keys dynamically**. - In the **URL** field, enter the URL from the Shadow AI Remediation admin console **Settings > General Settings > Identity Provider**. - Deselect the **Proof of possession** radio button. 1. Select Save to save the settings. 1. Select the **General** tab. 1. Copy the following details from the Okta General tab, into the Shadow AI Remediation admin console **Settings > General Settings > Identity Provider**: - **Client ID** - **Okta domain** Shadow AI Remediation admins can now access the Shadow AI Remediation portal. For more information refer to [Accessing Shadow AI Remediation](https://documentation.sailpoint.com/sair/help/index.html#accessing-shadow-ai-remediation). # Integrating with Other IdPs Shadow AI Remediation can be integrated with IdPs other than Microsoft Entra ID and Okta, to authenticate end users and administrators logging into the Shadow AI Remediation platform, and to gather information on applications. Once integrated with your IdP, Shadow AI Remediation can: - Allow the [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) and Shadow AI Remediation administrators to authenticate against the IdP. - Support listing user accounts, applications, and related user activity in the admin portal. Notes - When integrating with an IdP other than Microsoft Entra ID or Okta, the browser extension cannot retrieve the list of onboarded applications, therefore Shadow AI Remediation cannot parse the SSO logs. Most applications and accounts will still be detected by the browser extension, unless they are: - Completely inactive, or; - Used exclusively outside of managed browsers. - Because real-time correlation with IdP SSO events is not available, the browser extension is unable to determine the login method for these IdPs. As a result, it is not possible to automatically detect local access to applications that are SSO-enabled. Advanced administrators can still investigate potential local access by: - Reviewing [activity logs](https://documentation.sailpoint.com/sair/help/data_analytics.html) for suspected applications. - Focusing on “Credentials submitted” [events](https://documentation.sailpoint.com/sair/help/data_analytics.html). - Examining the destination URLs to which credentials are submitted, which may indicate local authentication paths. You will first configure an OIDC application in your IdP to allow browser extension authentication, and then deploy your tenant ID to the browser extension on your endpoints using your MDM solution. ## Configuring an OIDC application in your IdP and Shadow AI Remediation Create an application in your IdP to support OIDC-based authentication for browser extensions, and integrate with Shadow AI Remediation. This allows the extension to sign in transparently without additional user interaction. 1. Log into your IdP. - Create a new dedicated OIDC application for Shadow AI Remediation. Enter the redirect URI as . 1. Copy the information from the Client ID, Client Secret, and Issuer ID fields. You’ll need this information when you configure the IdP in Shadow AI Remediation. 1. In Shadow AI Remediation, go to **Settings > General Settings > Identity Provider**. 1. Select **Add**. 1. Select **OpenID**. 1. On the **Identity Provider** page, complete the following: - **Client ID** - The Client ID from your IdP. - **Client Secret** - The Client Secret from your IdP. - **Issuer URI** - The Issuer URI from your IdP. ## Deploying a PowerShell Script using MDM These generic instructions describe how to deploy a PowerShell script using a Mobile Device Management (MDM) solution. The MDM pushes the PowerShell script to managed Window’s endpoints and executes it remotely with administrative privileges. This is the recommended method. ### Creating a PowerShell script 1. Create a .ps1 file containing the registry configuration. An example script provided below. Replace `` with the actual tenant value provided to you during onboarding. Example Powershell Script ```json $tenantId = "" $paths = @( "HKLM:\Software\Policies\Google\Chrome\3rdparty\extensions\ckdibgmbbhmafmjpjmknleccgcddanan\policy", "HKLM:\Software\Policies\Microsoft\Edge\3rdparty\extensions\ckdibgmbbhmafmjpjmknleccgcddanan\policy" ) foreach ($p in $paths) { if (!(Test-Path $p)) { New-Item -Path $p -Force | Out-Null } New-ItemProperty -Path $p -Name "TenantID" -Value $tenantId -PropertyType String -Force | Out-Null } ``` 1. Save the .ps1 file as **set-tenant.ps1**. ### Uploading Script to your MDM In your MDM admin console: 1. Go to **Device Management** or **Scripts**. 1. Select **Add Script**, **Run Script**, or **PowerShell Script**. 1. Upload the .ps1 file. 1. Select the target device group, for example *All Windows devices*. ### Configure Execution Settings In your MDM admin console, configure the following settings: | Setting Type | Setting | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Run as | SYSTEM/Administrator | | Execution Frequency | - Run once (recommended) - Run at every check-in (if you want enforcement) | | PowerShell mode (If supported by your MDM) | - Run in 64-bit PowerShell - Execution policy bypass - Run silently | | Assigning | - Device group, or - All managed Windows devices **Note:** Most MDMs will execute scripts at next endpoint check-in, or immediately if the device is online. | ### Verifying Deployment on Endpoint After deployment, you can verify that the script was successfully applied on a Windows endpoint. **To verify deployment using registry check:** 1. On the endpoint, open **regedit**. 1. Locate the following registry path for your browser: - **Google Chrome** - `HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\3rdparty\extensions\` - **Microsoft Edge** - `HKEY_LOCAL_MACHINE\Software\Policies\Edge\Chrome\3rdparty\extensions\` 1. Verify the TenantID key value matches your tenant ID. **To verify deployment using PowerShell:** 1. On the endpoint, open **PowerShell**. 1. Run the following command: `Get-ItemProperty "HKLM:\Software\Policies\Google\Chrome\3rdparty\extensions\ckdibgmbbhmafmjpjmknleccgcddanan\policy"` 1. Verify the TenantID key value matches your tenant ID. ### Troubleshooting Script Deployment Issues | Issue | Action | | ----------------------------------- | ---------------------------------------------------------------------------------------- | | Script did not apply | Check: - Device is enrolled in MDM - Device is online - Script assigned to correct group | | Access denied error | Ensure script runs as SYSTEM/Administrator | | Registry key exists but not applied | Restart browser to read new policy | # Viewing the Application Inventory The Shadow AI Remediation Inventory provides a near real-time view of all discovered applications, user accounts, accounts and browser plugins in your environment. ## SaaS Inventory The [SaaS Inventory](https://documentation.sailpoint.com/sair/help/inventory/saas.html) provides a continuously updated view of all applications and user accounts discovered by Shadow AI Remediation across your organization. Information is aggregated from multiple discovery sources, including the Shadow AI Remediation [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html), and the [IdP connector](https://documentation.sailpoint.com/sair/help/idp/index.html), to present a unified, cross-platform inventory of application usage across your organization. This combined visibility helps admins identify sanctioned and unsanctioned (shadow IT) applications, track authentication patterns, and monitor identity risk across all SaaS environments. The SaaS Inventory also covers private or on-premises applications. Such applications are represented by their apex domain. You can configure one or more [Custom Applications](https://documentation.sailpoint.com/sair/help/custom_apps.html) to replace or split the domain-based representation if multiple applications share the same root domain. ## Accounts Inventory The [Accounts Inventory](https://documentation.sailpoint.com/sair/help/inventory/accounts.html) represents all user accounts discovered by the [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) and the [IdP connector](https://documentation.sailpoint.com/sair/help/idp/index.html) providing a granular view of each account, its associated application, login method, MFA status, and identity risk indicators. This view can be searched using [basic](https://documentation.sailpoint.com/sair/help/inventory/accounts.html#building-a-basic-account-search-query) and [advanced search queries](https://documentation.sailpoint.com/sair/help/inventory/accounts.html#building-advanced-account-search-queries). ## Extensions Inventory The [Extensions Inventory](https://documentation.sailpoint.com/sair/help/inventory/extensions.html) provides centralized visibility into all browser extensions related to GenAI that are installed across the organization, and includes details of GenAI productivity tools, prompt assistants, AI integrations, and agentic AI extensions. # Viewing the Accounts Inventory Select **Inventory > Accounts** from the left panel to view of all user accounts discovered across your organization. Use quick filters to refine accounts listed in the table by login method, identity risks, risk levels, and newly discovered. Additional filtering can be applied by selecting **More filters**. By default, accounts discovered for non-corporate assets, such as applications that users log in to with their consumer credentials are hidden from the Accounts Inventory. Some legitimate corporate assets may be accessed using unknown credentials (usernames without a domain suffix) or consumer / social login. To display discovered accounts for all applications, select the Suitcase icon . Select the Grid / Visualization  toggle to switch between view types: - **Grid View** - The default tabular view displaying detailed application and account metrics. - **Visualization Mode** - Keeps the same underlying query but allows you to create [visualization charts](https://documentation.sailpoint.com/sair/help/data_analytics.html#creating-visualizations) and visual summaries based on SaaS attributes, usage, or risk indicators. Select the Export data as CSV icon to export the grid view as a CSV file for further analysis and reporting. Selecting an account opens the detail panel with detailed contextual information: - **Account risk level** - Provides quick visibility into the accounts overall risk posture. - **Graph** - Provides visibility into how authentication is performed and risks associated with that access. ## Account Graphical View When selecting an account record the details page displays a graph highlighting the authentication relationship between a user and an application account, providing visibility into how authentication is performed and what risks are associated with that access. The graph helps security and identity teams: - Understand how access to an application is granted. - Identify SSO bypass scenarios. - Detect high-risk authentication patterns. - Assess password-related identity risks and blast radius. - Navigate between related user and application records for investigation. The graph visualizes: - The authentication methods used by the user to access the account, including: - SSO-based access. - Local (direct) authentication. - Both methods simultaneously. - Identity-related risks associated with the account, including: - Weak passwords. - Compromised passwords. - Reused passwords. Notes - It is common for an application to be onboarded to SSO while still allowing direct local access. This scenario is identified as an SSO Bypass, representing a potential access risk. - When password reuse is detected, the graph expands to show all additional applications and websites where the same password was used by the same user, providing visibility into lateral exposure risk. ## Building a Basic Account Search Query Basic search queries can be created by searching for an account name or part name and selecting the filter dropdowns to refine your search criteria. **To build a basic search query:** 1. Go to **Inventory > Accounts** from the left panel. 1. (Optional) Enter an account name or part name in the search and select **Enter**. 1. Select the filter dropdowns to refine your search. - **Login methods** - select the desired sources. - **Identity risks** - select the desired risk types. - **Risk Levels** - select the desired risk level. - **Newly discovered** - select the desired time frame during which the application was discovered. 1. Select More Filters to further filter based upon users, account status and MFA status. The search results are displayed based upon your selected search query. To save your query, select the Database icon  next to the search box, and select **Save as new query**. ## Building Advanced Account Search Queries Custom search queries can be created using the search box. Search queries for specific use cases can be built using predefined search query syntax's and combined with AND, OR, NOT, AND NOT, and TO operators. **To build an advanced search query:** 1. Go to **Inventory > Accounts** from the left panel. 1. Enter the required [syntax](https://documentation.sailpoint.com/sair/help/data_analytics.html#search-query-syntax) into the search box. Select the Database icon  next to the search box, and select **Save as new query**. # Viewing the Extensions Inventory The Extensions Inventory provides centralized visibility into all browser extensions related to Generative AI that are installed across the organization. The inventory focuses exclusively on AI-related extensions including: - **GenAI productivity tools** - Generative AI assistants and copilots. - **Prompt assistants** - Prompt engineering and productivity tools. - **AI integrations** - Browser-based integrations with AI platforms. - **Agentic AI extensions** - AI agents that operate directly within the browser environment. The inventory aggregates extensions discovered across supported browsers, regardless of how they were installed. This includes extensions deployed through enterprise management channels as well as those introduced by users or third-party software. For each discovered extension, the inventory displays details including: - **Extension** - The extension name. - **Browser** - The browser in which the extension was discovered. - **User** - Number of users within the organization with the extension installed. - **Deployment Type** - The [type of deployment](#deployment-types) based upon how the extension was installed. - **Permissions** - The [permissions](#permissions-and-risk-evaluation) requested by the extension. - **Risk Level** - Calculated [risk level](#permissions-and-risk-evaluation) based on permission sensitivity. When a user uninstalls an extension, the change is reflected in the inventory within 24 hours. If the last remaining user uninstalls a given extension, it will be removed from the inventory. This ensures the inventory reflects both installation and removal activity. **To view the Extensions Inventory:** 1. Go to **Inventory > Extensions**. 1. Select **> View users** to view the users with the extension installed. Use quick filters to refine applications listed in the table by browser, deployment type, and risk level. Additional filtering can be applied by selecting **More filters**. ## Deployment Types Shadow AI Remediation classifies extensions based on how they were installed: - **Admin** - Installed through enterprise device management (MDM). - **Store** - Installed directly by an employee from a browser extension marketplace. These installations may introduce higher risk due to the potential use of unsanctioned tools. - **Third-party** - Installed as a side effect of other software deployed on the device, for example enterprise software packages that bundle extensions. - **Dev Mode** - Manually installed by a user after enabling browser Developer Mode, typically bypassing standard controls. Categorization helps admins manage security by identifying which extensions are enterprise-approved and which may pose a threat. ## Permissions and Risk Evaluation By default, the Extensions Inventory is sorted by overall risk level for each extension. Each extension declares its permissions. Shadow AI Remediation analyzes these permissions and assigns a sensitivity level of Low, Medium, or High. The overall risk level of the extension is calculated from the combination and sensitivity of its requested permissions. Particular attention is given to sensitive permissions, such as access to cookies or browsing data, which may expose organizational or user information. ## Building a Basic Application Search Query Basic search queries can be created by searching for an application name and selecting the filter dropdowns to refine your search criteria. **To build a basic search query:** 1. Go to **Inventory > Extensions** from the left panel. 1. (Optional) Enter an application name in the search and select **Enter**. 1. Select the filter dropdowns to refine your search. - **Browser** - Select the desired browser. - **Deployment type** - Select the desired deployment type. - **Risk level** - Select the desired risk level. 1. Select **More Filters** to further filter based upon permissions. The search results are displayed based upon your selected search query. To save your query, select the Database icon  next to the search box, and select **Save as new query**. ## Building Advanced Application Search Queries Custom search queries can be created using the search box. Search queries for specific use cases can be built using [predefined search query syntax's](https://documentation.sailpoint.com/sair/help/data_analytics.html#search-query-syntax) and combined with AND, OR, NOT, AND NOT, and TO operators. **To build an advanced search query:** 1. Go to **Inventory > Extensions** from the left panel. 1. Enter the required [syntax](https://documentation.sailpoint.com/sair/help/data_analytics.html#search-query-syntax) into the search box. 1. Select the Database icon  next to the search box, and select **Save as new query**. # Viewing the SaaS Inventory Select **Inventory > SaaS** from the left panel to view of all applications and user accounts discovered across your organization. The SaaS inventory displays consolidated inventory data refreshed automatically within approximately 24 hours. This view is optimized for reporting, performing [advanced search queries](#building-advanced-application-search-queries), and visualizations such as charts, filters, and saved queries. If you want to see a real-time view of accounts, select the relevant application record, select **View app accounts**, and within the application page select the toggle to **Live** view. Use quick filters to refine applications listed in the table by source, identity risks, and newly discovered. Additional filtering can be applied by selecting **More filters**. By default, non-corporate assets, such as applications that users log in to with their consumer credentials are hidden from the SaaS Inventory. Some legitimate corporate assets may be accessed using unknown credentials (usernames without a domain suffix) or consumer / social login. To display all applications select the Suitcase icon . The source column displays details of where the account data was discovered: - **Browser Extension** - The active sign-in activity was discovered from user browsers. - **IdP Connector** - SSO activity was observed for at least one account, or that the application was discovered using the IdP's installed applications API. Select the **Grid / Visualization** toggle to switch between view types: - **Grid View** - The default tabular view displaying detailed application and account metrics. - **Visualization Mode** - Keeps the same underlying query but allows you to create [visualization charts](https://documentation.sailpoint.com/sair/help/data_analytics.html#creating-visualizations) and visual summaries based on SaaS attributes, usage, or risk indicators. Select the Export data as CSV icon to export the grid view as a CSV file for further analysis and reporting. Selecting an application opens the detail panel with detailed contextual information: - **App description** - A short overview of the application and its purpose. - **Show more** - Expands additional labels and metadata associated with the application including tags or compliance labels. - **Sensitivity** - Indicates the applications sensitivity level. By default, this is derived from out-of-the-box mappings based on the applications category. Admins can override the sensitivity value manually if needed. This affects the overall risk score. - **Risk level**, **Authorization**, and **App owner** - Provides quick visibility into the applications ownership and overall risk posture. ## Building a Basic Application Search Query Basic search queries can be created by searching for an application name and selecting the filter dropdowns to refine your search criteria. **To build a basic search query:** 1. Go to **Inventory > SaaS** from the left panel. 1. (Optional) Enter an application name in the search and select **Enter**. 1. Select the filter dropdowns to refine your search. - **Sources** - select the desired sources. - **Identity risks** - select the desired risk types. - **Newly discovered** - select the desired time frame during which the application was discovered. 1. Select **More Filters** to further filter based upon authorizations and login methods. The search results are displayed based upon your selected search query. To save your query, select the Database icon  next to the search box, and select **Save as new query**. ## Building Advanced Application Search Queries Custom search queries can be created using the search box. Search queries for specific use cases can be built using [predefined search query syntax's](https://documentation.sailpoint.com/sair/help/data_analytics.html#search-query-syntax) and combined with AND, OR, NOT, AND NOT, and TO operators. **To build an advanced search query:** 1. Go to **Inventory > SaaS** from the left panel. 1. Enter the required [syntax](https://documentation.sailpoint.com/sair/help/data_analytics.html#search-query-syntax) into the search box. 1. Select the Database icon  next to the search box, and select **Save as new query**. ## Sorting and Risk Calculation By default, the SaaS Inventory is sorted by overall identity-breach risk for each application. The risk score is calculated by combining two weighted factors: 1. **Exposure** - Measures how easy it would be for a threat actor to gain access to an account in the application. Factors that increase exposure include a high number of compromised accounts, weak passwords, and lack of MFA enforcement. 1. **Sensitivity** - Reflects the potential **impact** of a breach. The score is determined by the applications sensitivity classification, which defaults to OOTB mappings based on application labels. Admins can override the classification sensitivity manually in the applications side panel. The calculated Risk Level (Low, Medium, High, or Very High) determines the applications position in the inventory and how it appears in risk-based visualizations. # Managing Playbooks Shadow AI Remediation provides customizable GenAI playbooks that enable security teams to automate responses to various GenAI user actions and engage users at critical decision points to improve security outcomes. Playbooks run as just-in-time workflows that appear as a [messenger](https://documentation.sailpoint.com/sair/help/settings/messenger.html) in the users’ session, guiding them toward compliant behavior when interacting with GenAI tools. Remediation playbooks enable: - Prevention of risky GenAI usage. - Guidance for users toward sanctioned tools. - Reinforcement of corporate GenAI policy. - Capturing of user intent when policy violations occur. Shadow AI Remediation includes five out-of-the-box playbook templates: - [**Avoid Banned GenAI Applications**](https://documentation.sailpoint.com/sair/help/playbooks/avoid_banned_genai_apps.html) - Block users from accessing or using prohibited GenAI tools, reinforcing organizational policy and directing them to approved alternatives where available. - [**Corporate GenAI Policy Guidance**](https://documentation.sailpoint.com/sair/help/playbooks/corp_genai_policy_guidance.html) - Guide users to follow the organization’s GenAI policy and ensure that the use of GenAI tools complies with corporate guidelines and security requirements. - [**Avoid Non-Sanctioned GenAI Applications**](https://documentation.sailpoint.com/sair/help/playbooks/avoid_non_sanctioned_genai_apps.html) - Block users from accessing or using non-sanctioned applications, and guides users to follow the organization’s GenAI policy. - [**File Upload to Non-Sanctioned GenAI**](https://documentation.sailpoint.com/sair/help/playbooks/file_upload_to_non_sanctions_genai.html) - Guide users to avoid uploading files to non-sanctioned GenAI tools. - [**Clipboard Paste in GenAI Sites**](https://documentation.sailpoint.com/sair/help/playbooks/clipboard_paste_genai_sites.html) - Block users from submitting sensitive data pasted into GenAI tools. Important Shadow AI Remediation is designed to help guide employees toward AI policy compliance that is in line with your organization’s overall policy efforts on AI. It is not designed to catch all instances of bad behavior, intentional or willful violations, or malicious activity within your organization. This product does not replace the need for your organization to have comprehensive auditing, human oversight, or robust, industry-standard security measures. ## Prerequisites To ensure GenAI applications are permitted and blocked inline with your organizations AI policy, you must determine which playbooks should be enabled and complete any supporting configuration. **To configure Shadow AI Remediation to meet your organization’s AI policy:** 1. [Define the list of sanctioned applications](#defining-sanctioned-applications) - SaaS - Home-grown 1. Prepare relevant URLs for the playbooks: - Note the URL of your sanctioned tool(s). - Note the URL of your organization's AI policy. 1. Review [policy-related considerations](#policy-related-considerations) - Are you blocking commonly-banned GenAI tools such as DeepSeek? - When using other non-sanctioned AI tools, how firm would you like to be in redirecting the users to the sanctioned tool? - If you permit users to override the policy and use a non-sanctioned tool: - How often would you like to pop up and alert when users use the non-sanctioned tools? - Would you like to further alert when a file upload begins? ### Defining Sanctioned Applications If the GenAI tool is a well-known mapped SaaS application, such as Microsoft Copilot, the application must be [added](https://documentation.sailpoint.com/sair/help/lists.html) to the **generative-ai-sanctioned-apps** list. If the GenAI tool is not a well-known mapped SaaS application, create a [Custom Application](https://documentation.sailpoint.com/sair/help/custom_apps.html) to add the application, and then [add it to the following lists](https://documentation.sailpoint.com/sair/help/lists.html#view-and-add-apps-to-list): - **generative-ai-apps** - Ensures the application will be included in the list of sanctioned GenAI tools. - **generative-ai-sanctioned-apps** - Ensures playbooks will not interfere when users are using the application. If you are unable to add a custom application because its URL overlaps with an existing domain of a SaaS application in the global application database, add the FQDN (hostname) of the application to the following list instead: - **generative-ai-sanctioned-hostnames** - Ensures playbooks are not triggered when visiting the home-grown applications. Tip A correct FQDN example includes: - `copilot.microsoft.com` Incorrect FQDN examples include: - `https://copilot.microsoft.com/` - the HTTPS scheme is not part of the FQDN. - `copilot.microsoft.com/prompt` - the prompt is part of the path, not a valid FQDN. ### Policy-related Considerations Use the below considerations to determine the playbooks to use to match your organization’s policy. | | | | ---------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Consideration | Recommended Action | | Are you blocking commonly-banned GenAI tools such as DeepSeek? | Configure and enable the [Avoid Banned GenAI Applications](https://documentation.sailpoint.com/sair/help/playbooks/avoid_banned_genai_apps.html) playbook. | | When using non-sanctioned GenAI tools that are not explicitly banned, should the user be blocked from using the application? | **Block** Configure and enable the [Avoid Non-Sanctioned GenAI Applications](https://documentation.sailpoint.com/sair/help/playbooks/avoid_non_sanctioned_genai_apps.html) playbook. **Permit with justification** Configure and enable the [Corporate GenAI Policy Guidance](https://documentation.sailpoint.com/sair/help/playbooks/corp_genai_policy_guidance.html) playbook. | | For users permitted to override the policy and use a non-sanctioned application: | | | How often should the messenger and alert be displayed to users when using non-sanctioned tools? | [Configure Throttling](#throttling-playbook-triggers) to limit the number of times the playbook should be triggered for users. | | Display an additional alert when a file upload begins? | Configure and enable the [File Upload to Non-Sanctioned GenAI](https://documentation.sailpoint.com/sair/help/playbooks/file_upload_to_non_sanctions_genai.html) playbook. | ## Deployment Best Practice SailPoint recommends a staged rolled out approach to ensure the configured playbook runs as expected, and prevent unintended blocking of sanctioned AI tools. To prevent unintentional blocking of user tasks, SailPoint recommends the following rollout approach: 1. Assign the playbook to a small target group first. 1. Validate the playbook experience and messaging. 1. Confirm sanctioned tool redirection works as expected. 1. Expand deployment to broader user base. Important To prevent unintentional blocking of user tasks, SailPoint strongly recommends a staged rollout approach. ## Playbook Catalog The playbook catalog includes out-of-the-box playbook templates for enforcing corporate policy. Playbook templates must be configured to meet your organization’s policy, culture, and set of sanctioned applications. Playbook templates are added to Company Policies where they can be configured to meet your organization’s needs. Note When adding a playbook to the company policies, you must select a target group to control which users the playbook will apply to. SailPoint strongly recommends initially assigning a test target group containing limited users while the playbook is tested. Ensure you have created a test [target group](https://documentation.sailpoint.com/sair/help/target_groups.html) before adding the playbook to the company policies. **To add a playbook template to the company policies:** 1. Go to **Playbooks > Playbook Catalog**. 1. Select the desired playbook and select **Add**. 1. (Optional) To restrict the existing match criteria to a specific application, within the **Conditions** section, select **And** to add a new And condition. Warning Do not remove the default match conditions. Removal of the default match criteria may result in unintended blocking of applications causing significant productivity disruptions. - Within the **Conditions** section, complete the following: - Select the first field and choose **Application**. - Leave the second field as **In**. - Select the **Value** field and select **Application**. - Select the desired application(s), and select **Add new app**. 1. (Optional) Within the **Trigger match criteria** window, select [Enable throttling](#throttling-playbook-triggers) to configure the number of times within a defined time period the playbook should trigger. 1. Select **Next**. 1. Within the **Edit target group** window, select the **Target group** field. 1. Select the desired target group. Tip Select **Show** next to a target group to view its members. 1. Select **Next**. The playbook is available to edit and enable in the company policies page. ## Reviewing User Requests If permitted, users can request for non-sanctioned GenAI applications to be sanctioned. **To review user requests:** 1. Go to **Logs > GenAI**. 1. Select the Database icon  next to the Log search box and select **Saved queries**. 1. Within the **Saved queries** window, select **User justification for non-sanctioned tools**. All requests will be displayed. Selecting a log entry opens the detail panel with detailed contextual information including the justification provided by the user within the User Response field. ## Throttling Playbook Triggers If you do not want a playbook to trigger every time its match criteria is met, you can configure the number of times within a defined time period the playbook should trigger. **To throttle the number of times a playbook is triggered:** 1. Go to **Playbooks > Playbook Policies**. 1. Select **Actions** **> Edit match criteria**. 1. Within the **Trigger match criteria** window, enable **Throttling**. 1. In the **time(s)** field, enter the number of occurrences the playbook should trigger for a user. 1. (Optional) Select **+ Add time period** to define the number of occurrences the playbook should trigger for a user within a desired time period. 1. Select **Save**. # Avoid Banned GenAI Applications Playbook The Avoid Banned GenAI Applications playbook is triggered when a user navigates to a GenAI application that is included in the risky AI application list. The user is blocked from using the unauthorized GenAI application and is guided to use the sanctioned tool. Access remains blocked even after the user provides a justification. The playbook is fully editable through the playbook editor, including: - Messaging shown to users - Justification prompts - Policy links - Redirect destinations - Enforcement behavior Organizations can tailor the experience to align with their internal GenAI governance policy. ## Match Criteria The playbook triggers when a user accesses an application included in the Risky GenAI Apps [list](https://documentation.sailpoint.com/sair/help/lists.html). Warning Modification of the default match criteria should only be performed with a full understanding of the configuration. Incorrect updates may result in unintended blocking of application causing significant productivity disruptions. Confirm all updates with your organization administrators before proceeding in order align with your organization’s overall policy efforts and minimize disruption. ## Out-of-the-Box Playbook Behavior When triggered: 1. The background session is blurred. 1. A blocking warning is displayed to the user. 1. The user is guided to use the organization’s sanctioned GenAI tool. Users are prevented from working in the unsanctioned application. If the user attempts to proceed: - They are prompted to provide a justification for why they need to use this tool instead of the sanctioned tool. - The justification is captured and forwarded to the security team. - A message confirms the request has been sent and instructs the user to use the sanctioned tool. - The user is presented with two final options: - **Take me to the sanctioned tool** - redirects to the sanctioned GenAI application. - **Take me to our AI policy** - redirects to the organization's AI policy page. Note Access to the unsanctioned application remains blocked even if a justification is provided. ## Required Configuration Before Use Out of the box, this playbook does not include: - A defined sanctioned application URL. - A defined URL that hosts the company's AI policy. - Finalized end-user messaging. Important For the playbook to function, administrators must [update the playbook](#required-updates-before-use) before deployment. ### Required Updates Before Use The playbook requires minimal customization to tailor it to your organization's AI policy before it can be used. **To apply the required updates:** 1. Go to **Playbooks > Company Policies**. 1. Select the **Avoid Banned GenAI Applications** playbook to customize it. Note If the playbook is not displayed, [add the playbook from the Playbook catalog](https://documentation.sailpoint.com/sair/help/playbooks/index.html#add-playbook-to-policies). 1. Within the playbook editor, notations highlight where configuration is required. 1. Replace the default URL in the **Navigate to Sanctioned GenAI Tool** step with your organization's sanctioned GenAI tool URL, for example `genai-tool.com`. Note The **Navigate to Sanctioned GenAI Tool** step appears in two places within the playbook. 1. Replace the default URL in the **Navigate to Organization AI Policy** step with the URL that hosts your organization's AI usage policy, for example `usage-policy.com`. 1. Select **Publish** to publish the updated playbook. The playbook is now live in your organization. ## Recommended Updates By default, the button text reads **Take me to the sanctioned tool**. To improve clarity, update the button caption to name the specific approved tool, for example: **Take me to ChatGPT** or **Open Microsoft Copilot**. **To update the button text:** 1. Go to **Playbooks > Company Policies**. 1. Select the **Avoid Banned GenAI Applications** playbook to customize it. 1. Within the playbook editor, select the **Button** step. 1. Replace the default **Button text** with your desired text. Important Text within the **Button text** field is displayed to users and is configurable. The text within the **Button name** field is used by the playbook for conditional branching and **must not be changed**. Changing the Button name will cause the playbook to fail. 1. Select **Publish** to publish the updated playbook. Note The **Button** step appears in two places within the playbook. # Avoid Non-Sanctioned GenAI Applications Playbook The Avoid Non-Sanctioned GenAI Applications playbook is triggered when a user navigates to a GenAI application that is not on the organization's sanctioned list. Unlike the [Corporate GenAI Policy Guidance](https://documentation.sailpoint.com/sair/help/playbooks/corp_genai_policy_guidance.html) playbook, this playbook **does not allow the user to continue** using the non-sanctioned tool. Access remains blocked even after the user provides a justification. The playbook is fully editable through the playbook editor, including: - Warning and policy messaging - Justification prompt text - Redirect destinations - Button labels and styles - Post-justification messaging Organizations can tailor the experience to align with their internal GenAI governance policy. ## Match Criteria The playbook triggers when either: **Both** of the following conditions are met: - The application **is in** the **generative-ai-apps** list. - The application **is not in** the **generative-ai-sanctioned-apps** list. Or **both** of the following conditions are met: - The domain **is in** the **generative-ai-hostnames** list. - The domain **is not in** the **generative-ai-sanctioned-hostnames** list. Therefore, the playbook targets GenAI tools that the organization has not explicitly approved, while leaving sanctioned tools uninterrupted. Warning Modification of the default match criteria should only be performed with a full understanding of the configuration. Incorrect updates may result in unintended blocking of application causing significant productivity disruptions. Confirm all updates with your organization administrators before proceeding in order align with your organization’s overall policy efforts and minimize disruption. ## Out-of-the-Box Playbook Behavior When triggered: 1. The background session is blurred. 1. A blocking warning is displayed to the user. 1. A policy message informs the user they should instead use a sanctioned GenAI tool. 1. The user is presented with two options: - **Take me to the sanctioned tool** - the user is redirected to the sanctioned GenAI application. - **I accept the risk** - the playbook continues. If a user chooses to accept the risk: - They are prompted to provide a justification for why they need to use this tool instead of the sanctioned tool. - The justification is captured and forwarded to the security team. - A message confirms the request has been sent and instructs the user to use the sanctioned tool. - The user is presented with two final options: - **Take me to the sanctioned tool** - redirects to the sanctioned GenAI application. - **Take me to our AI policy** - redirects to the organization's AI policy page. Note Access to the unsanctioned application remains blocked even if a justification is provided. ## Required Configuration Before Use Out of the box, this playbook does not include: - A defined sanctioned application URL. - A defined URL that hosts the company's AI policy. - A populated **generative-ai-sanctioned-apps** list. - A populated **generative-ai-sanctioned-hostnames** list, if applicable. Note Only required if the **generative-ai-hostnames** list has been manually updated. For example when there is a home-grown AI tool that is mapped by its domain. - Finalized end-user messaging. Important For the playbook to function, administrators must [update the playbook](#required-updates-before-use) before deployment. ### Required Updates Before Use The playbook requires minimal customization to tailor it to your organization's policy stance before it can be used. Important Ensure the **generative-ai-sanctioned-apps** list [has been populated](https://documentation.sailpoint.com/sair/help/playbooks/index.html#defining-sanctioned-applications). Until the **generative-ai-sanctioned-apps** list is populated, the playbook will trigger on **every GenAI application**, including tools the organization intends to allow. **To apply the required updates:** 1. Go to **Playbooks > Company Policies**. 1. Select the **Avoid Non-Sanctioned GenAI Applications** playbook to customize it. Note If the playbook is not displayed, [add the playbook from the Playbook catalog](https://documentation.sailpoint.com/sair/help/playbooks/index.html#add-playbook-to-policies). 1. Within the playbook editor, notations highlight where configuration is required. 1. Replace the default URL in the **Navigate to Sanctioned GenAI Tool** step with your organization's sanctioned GenAI tool URL, for example `genai-tool.com`. Note The **Navigate to Sanctioned GenAI Tool** step appears in two places within the playbook. 1. Replace the default URL in the **Navigate to Organization AI Policy** step with the URL that hosts your organization's AI usage policy, for example `usage-policy.com`. 1. Select **Publish** to publish the updated playbook. The playbook is now live in your organization ## Recommended Updates By default, the button text reads **Take me to the sanctioned tool**. To improve clarity, update the button caption to name the specific approved tool, for example: **Take me to ChatGPT** or **Open Microsoft Copilot**. **To update the button text:** 1. Go to **Playbooks > Company Policies**. 1. Select the **Avoid Non-Sanctioned GenAI Applications** playbook to customize it. 1. Within the playbook editor, select the **Button** step. 1. Replace the default **Button text** with your desired text. Important Text within the **Button text** field is displayed to users and is configurable. The text within the **Button name** field is used by the playbook for conditional branching and **must not be changed**. Changing the Button name will cause the playbook to fail. 1. Select **Publish** to publish the updated playbook. Note The **Button** step appears in two places within the playbook. # Clipboard Paste in GenAI Sites Playbook The Clipboard Paste in GenAI Sites playbook is triggered when a user pastes data into a GenAI application that includes sensitive keywords. The user is blocked from using the unauthorized GenAI application and is guided to delete the sensitive data before submitting. The playbook is fully editable through the playbook editor, including: - Warning and notice messaging - Justification prompts - Policy links - Acknowledgment messaging Organizations can tailor the experience to align with their internal GenAI governance policy. ## Match Criteria The playbook triggers when either: **Both** the following conditions are met: - The application is in the **generative-ai-apps** list. - The pasted data contains keywords in the **clipboard-sensitive-keywords** list. Or **both** the following conditions are met: - The domain is in the **generative-ai-hostnames** list. - The pasted data contains keywords in the **clipboard-sensitive-keywords** list. Therefore, the playbook targets specific keywords pasted into GenAI tools used in the organization, helping to prevent submission of sensitive data. Warning Modification of the default match criteria should only be performed with a full understanding of the configuration. Incorrect updates may result in unintended blocking of application causing significant productivity disruptions. Confirm all updates with your organization administrators before proceeding in order align with your organization’s overall policy efforts and minimize disruption. ## Out-of-the-Box Playbook Behavior When triggered: 1. The background session is blurred. 1. A blocking warning is displayed to the user. 1. A policy message guides the user to review the organization’s AI policy. 1. The user is presented with two options: - **Got it** - the user is instructed to delete the sensitive data before submission to the application. - **This is not sensitive** – the playbook continues. Users are prevented from working in the application. If the user attempts to proceed: - They are prompted to provide a justification for why they believe the data should not be flagged as sensitive. - The justification is captured and forwarded to the security team. Note Clipboard pasting operations are discovered by the playbook immediately after the action, however the pasting operation itself cannot be prevented. ## Required Configuration Before Use Out of the box, this playbook does not include: - A populated **clipboard-sensitive-keywords** list. - A defined URL that hosts the company's AI policy. - Finalized end-user messaging. Important For the playbook to function, administrators must [update the playbook](#required-updates-before-use) before deployment. ### Required Updates Before Use The playbook requires minimal customization to tailor it to your organization's AI policy before it can be used. **To apply the required updates:** 1. Go to **Playbooks > Company Policies**. 1. Select the **Clipboard Paste in GenAI Sites** playbook to customize it. Note If the playbook is not displayed, [add the playbook from the Playbook catalog](https://documentation.sailpoint.com/sair/help/playbooks/index.html#add-playbook-to-policies). 1. Within the playbook editor, notations highlight where configuration is required. 1. Replace the default URL in the **Company Policy** step with the URL that hosts your organization's AI usage policy, for example usage-policy.com. 1. Select **Publish** to publish the updated playbook. The playbook is now live in your organization. # Corporate GenAI Policy Guidance Playbook The Corporate GenAI Policy Guidance playbook is triggered when a user navigates to a GenAI application that is not on the organization's sanctioned list. Unlike the [Banned GenAI Applications](https://documentation.sailpoint.com/sair/help/playbooks/avoid_banned_genai_apps.html) playbook, this playbook **allows the user to continue** using the tool after providing a justification and acknowledging the risk. The playbook is fully editable through the playbook editor, including: - Warning and policy messaging - Justification prompt text - Redirect destinations - Button labels and styles - Acknowledgment messaging Organizations can customize the experience to align with their internal GenAI governance policy. ## Match Criteria The playbook triggers when either: **Both** of the following conditions are met: - The application **is in** the **generative-ai-apps** list. - The application **is not in** the **generative-ai-sanctioned-apps** list. Or **both** of the following conditions are met: - The domain **is in** the **generative-ai-hostnames** list. - The domain **is not in** the **generative-ai-sanctioned-hostnames** list. Therefore, the playbook targets GenAI tools that the organization has not explicitly approved, while leaving sanctioned tools uninterrupted. Warning Modification of the default match criteria should only be performed with a full understanding of the configuration. Incorrect updates may result in unintended blocking of application causing significant productivity disruptions. Confirm all updates with your organization administrators before proceeding in order align with your organization’s overall policy efforts and minimize disruption. ## Out-of-the-Box Playbook Behavior When triggered: 1. The background session is blurred. 1. A blocking warning is displayed to the user. 1. A policy message informs the user they should instead use a sanctioned GenAI tool. 1. The user is presented with two options: - **Take me to the sanctioned tool** - the user is redirected to the sanctioned GenAI application. - **I accept the risk** - the playbook continues. If the user chooses to accept the risk: - They are prompted to provide a justification for why they need to use this tool instead of the sanctioned tool. - The justification is captured and forwarded to the security team [for their review](https://documentation.sailpoint.com/sair/help/playbooks/index.html#reviewing-user-requests). - A message confirms the request will be reviewed and warns the user to ensure no company information is shared with this tool. - The user must select **I approve** to acknowledge the warning. After acknowledgment, the playbook ends, and the user can continue using the non-sanctioned tool. ## Required Configuration Before Use Out of the box, this playbook does not include: - A defined sanctioned application URL. - A populated **generative-ai-sanctioned-apps** list. - A populated **generative-ai-sanctioned-hostnames** list, if applicable. Note Only required if the generative-ai-hostnames list has been manually updated. For example, when there is a home-grown AI tool that is mapped by its domain. - Finalized end-user messaging. Important For the playbook to function, administrators must [update the playbook](#required-updates-before-use) before deployment. ### Required Updates Before Use The playbook requires minimal customization to tailor it to your organization's AI policy before it can be used. Important Ensure the **generative-ai-sanctioned-apps** list [has been populated](https://documentation.sailpoint.com/sair/help/playbooks/index.html#defining-sanctioned-applications). Until the **generative-ai-sanctioned-apps** list is populated, the playbook will trigger on every **GenAI application**, including tools the organization intends to allow. **To apply the required updates:** 1. Go to **Playbooks > Company Policies**. 1. Select the **Corporate GenAI Policy Guidance** playbook to customize it. Note If the playbook is not displayed, [add the playbook from the Playbook catalog](https://documentation.sailpoint.com/sair/help/playbooks/index.html#add-playbook-to-policies). 1. Within the playbook editor, notations highlight where configuration is required. 1. Replace the default URL in the **Navigate to Sanctioned GenAI Tool** step with your organization's sanctioned GenAI tool URL, for example `genai-tool.com`. 1. Select **Publish** to publish the updated playbook. The playbook is now live in your organization. ## Recommended Update By default, the button text reads **Take me to the sanctioned tool**. To improve clarity, update the button caption to name the specific approved tool, for example: **Take me to ChatGPT** or **Open Microsoft Copilot**. **To update the button text:** 1. Go to **Playbooks > Company Policies**. 1. Select the **Corporate GenAI Policy Guidance** playbook to customize it. 1. Within the playbook editor, select the **Button** step. 1. Replace the default **Button text** with your desired text. Important Text within the **Button text** field is displayed to users and is configurable. The text within the **Button name** field is used by the playbook for conditional branching and **must not be changed**. Changing the Button name will cause the playbook to fail. 1. Select **Publish** to publish the updated playbook. # File Upload to Non-Sanctioned GenAI Playbook The File Upload to Non-Sanctioned GenAI playbook is triggered when a user attempts to upload a file to a GenAI application that is not on the organization's sanctioned list. Unlike the browsing-based playbooks, this playbook specifically targets user file upload events. The playbook is fully editable through the playbook editor, including: - Warning and notice messaging - Justification prompt text - Redirect destination - Button labels and styles - Acknowledgment messaging - Enforcement behavior Organizations can tailor the experience to align with their internal GenAI governance policy. ## Match Criteria The playbook triggers when either: **All** of the following conditions are met: - A file upload occurs. - The application **is in** the **generative-ai-apps** list. - The application **is not in** the **generative-ai-sanctioned-apps** list. Or **all** of the following conditions are met: - A file upload occurs. - The domain **is in** the **generative-ai-hostnames** list. - The domain **is not in** the **generative-ai-sanctioned-hostnames** list. Therefore, the playbook targets uploading to GenAI tools that the organization has not explicitly approved, while leaving sanctioned tools uninterrupted. Warning Modification of the default match criteria should only be performed with a full understanding of the configuration. Incorrect updates may result in unintended blocking of application causing significant productivity disruptions. Confirm all updates with your organization administrators before proceeding in order align with your organization’s overall policy efforts and minimize disruption. ## Out-of-the-Box Playbook Behavior When triggered: 1. The background session is blurred. 1. A blocking warning is displayed to the user. 1. The user is presented with two options: - **Take me to the sanctioned tool** - the user is redirected to the sanctioned GenAI application. - **I accept the risk** - the playbook continues. If a user chooses to accept the risk: - They are prompted to provide a justification for why they need to upload files to this tool instead of the sanctioned tool. - The justification is captured and forwarded to the security team. - A message confirms the request will be reviewed and warns users to ensure no company information is shared with this tool. - The user must select **I approve** to acknowledge the warning. After acknowledgment, the playbook ends, and the user can perform a file upload to the non-sanctioned tool. ## Required Configuration Before Use Out of the box, this playbook does not include: - A defined sanctioned application URL. - A populated **generative-ai-sanctioned-apps** list. - A populated **generative-ai-sanctioned-hostnames** list, if applicable. Note Only required if the **generative-ai-hostnames** list has been manually updated. For example, when there is a home-grown AI tool that is mapped by its domain. - Finalized end-user messaging. Important For the playbook to function, administrators must [update the playbook](#required-updates-before-use) before deployment. ### Required Updates Before Use The playbook requires minimal customization to tailor it to your organizations' AI policy before it can be used. Important Ensure the **generative-ai-sanctioned-apps** list [has been populated](https://documentation.sailpoint.com/sair/help/playbooks/index.html#defining-sanctioned-applications). Until the **generative-ai-sanctioned-apps** list is populated, the playbook will trigger on **every GenAI application**, including tools the organization intends to allow. **To apply the required updates:** 1. Go to **Playbooks > Company Policies**. 1. Select the **File Upload to Non-Sanctioned GenAI** playbook to customize it. Note If the playbook is not displayed, [add the playbook from the Playbook catalog](https://documentation.sailpoint.com/sair/help/playbooks/index.html#add-playbook-to-policies). 1. Within the playbook editor, notations highlight where configuration is required. 1. Replace the default URL in the **Navigate to Sanctioned GenAI Tool** step with your organization's sanctioned GenAI tool URL, for example `genai-tool.com`. 1. Select **Publish** to publish the updated playbook. The playbook is now live in your organization. ## Recommended Updates By default, the button text reads **Take me to the sanctioned tool**. To improve clarity, update the button caption to name the specific approved tool, for example: **Take me to ChatGPT** or **Open Microsoft Copilot**. **To update the button text:** 1. Go to **Playbooks > Company Policies**. 1. Select the **File Upload to Non-Sanctioned GenAI** playbook to customize it. 1. Within the playbook editor, select the **Button** step. 1. Replace the default **Button text** with your desired text. Important Text within the **Button text** field is displayed to users and is configurable. The text within the **Button name** field is used by the playbook for conditional branching and **must not be changed**. Changing the Button name will cause the playbook to fail. 1. Select **Publish** to publish the updated playbook. Note The **Button** step appears in two places within the playbook. # Configuring System Settings Shadow AI Remediation includes global settings and reference information that impact your Shadow AI Remediation security and privacy. ## Configuring Security Settings - Define the [scope of visibility into user activity](https://documentation.sailpoint.com/sair/help/settings/security_settings.html#configuring-user-activity-types-to-discover). - Define [which users and areas of your organization are tracked](https://documentation.sailpoint.com/sair/help/settings/security_settings.html#configuring-organizational-areas-to-track). ## Configuring Privacy Controls - Allow [password hashes to be sent to Shadow AI Remediation](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#sending-password-hashes-to-the-cloud) cloud to detect reused passwords and compromised accounts. - Allow [hashed passwords to be stored](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#storing-hashed-passwords) to detect reused password. - Allow [login activities from personal browser profiles to be logged](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#logging-personal-profile-user-activity). - Allow [sign-in activity and account activity from personal accounts to be logged](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#logging-personal-accounts). - Allow [ambigious userames to be logged](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#logging-personal-accounts) when logging of personal accounts is disabled. - Define items in the [global allow list](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#managing-global-allowlist) that Shadow AI Remediation will not monitor. - Define who can [pause monitoring by the browser extension](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#pausing-the-browser-extension). # Customizing the Messenger The Shadow AI Remediation messenger is a SailPoint agent that is displayed according to the playbooks policy providing users real-time guidance and instruction. **To customize the messenger:** 1. Go to **Settings > General Settings > Messenger customization**. 1. Within the **Name** section, enter a short name that will be displayed at the top of the messenger. Note SailPoint recommends entering your organizations name followed by “Security”. 1. Within the **Logo** section, select **Change** to upload your organization’s corporate logo. Notes - Supported file types are .jpg and .png. - Use a high-quality image with a minimum of 80 x 80px resolution. 1. Within the **Your current messenger** section, review the preview and make changes as desired. 1. Select **Publish**. # Configuring Privacy Controls Admins can set when the [browser extension](https://documentation.sailpoint.com/sair/help/browser_extension/index.html) monitors and logs browser activity through privacy controls. - [**Send password hashes to the cloud**](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#sending-password-hashes-to-the-cloud) - When enabled, password hashes are sent to the Shadow AI Remediation cloud so Shadow AI Remediation can detect reused passwords and compromised accounts. - [**Store hashed passwords**](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#storing-hashed-passwords) - When enabled, hashed passwords are stored so Shadow AI Remediation can detect reused passwords. - [**Activate when using personal profile**](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#logging-personal-profile-user-activity) - When enabled, and a non-corporate browser profile is used, Shadow AI Remediation will monitor and log the activity. - [**Logging personal accounts**](#logging-personal-accounts) - When enabled, all accounts including corporate and personal are logged. - [**Global allowlist**](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#managing-global-allowlist) - When an application, domain, or IP address is added, Shadow AI Remediation will not monitor activity for sessions involving matching items. - [**Set who can pause the browser extension**](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#pausing-the-browser-extension) - Set whether all or only specific users are allowed to pause the extension. ## Sending Password Hashes to the Cloud The Send Hashed Passwords to the Cloud toggle allows the Shadow AI Remediation browser extension to transmit a cryptographically hashed version of the user’s username and password to the Shadow AI Remediation cloud. This transmission supports security checks, including: - **Breached/Compromised Credentials** - Determines whether the account appears in known breach or dark-web datasets. - **Password Reuse Detection** - Detects whether the same password is used across multiple applications. Important - Enabling Send Password Hashes to the Cloud only submits the hash for external verification. The hashed username and password is not stored. This is sufficient for the detection of compromised credentials. - To support password reuse detection, Send Password Hashes to the Cloud and [Store Hashed Passwords](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#storing-hashed-passwords) must be enabled. **To send password hashes to the cloud:** 1. Go to **General settings > General** tab. 1. Within the **Privacy** section, select the toggle next to **Send password hashes to the cloud**. ## Storing Hashed Passwords The Store Hashed Passwords toggle allows the Shadow AI Remediation browser extension to store a cryptographically hashed version of the user’s password on their endpoint to support detection of reused passwords. **To store hashed passwords:** 1. Go to **General settings > General** tab. 1. Within the **Privacy** section, select the toggle next to **Store hashed passwords so Savvy can detect reused passwords**. Important To fully support password reuse detection, [Send Password Hashes to the Cloud](https://documentation.sailpoint.com/sair/help/settings/privacy_settings.html#sending-password-hashes-to-the-cloud) and Store Hashed Passwords must be enabled. ## Logging Personal Profile User Activity The Activate when using personal profile toggle controls if Shadow AI Remediation monitors and logs user activity when a non-corporate browser profile is used. **To activate browser extension when using a non-corporate browser profile:** 1. Go to **General settings > General** tab. 1. Within the **Privacy** section, select the toggle next to **Activate when using personal profile**. Note This setting only applies if your organization requires the use of separate browser profiles for corporate and personal web browsing. ## Logging Personal Accounts The Log all accounts toggle controls if Application Visibility logs activity and discovered accounts for personal accounts. When disabled, you can configure whether discovered apps for ambiguous usernames, such as usernames without a domain suffix, are logged even when they cannot be identified as a corporate account. Activity of unresolved identities is always logged. If during the session the identity is resolved and it shouldn't be logged, logging is stopped for the remainder of the session. **To log sign-in activity and accounts for personal accounts:** 1. Go to **General settings > General** tab. 1. Within the **Privacy** section, select the toggle next to **Log all accounts**. **To log ambiguous usernames:** 1. Go to **General settings > General** tab. 1. Within the **Privacy** section, disable the toggle next to **Log all accounts**. 1. Enable the toggle next to **Log ambiguous usernames**. Tip Admins can configure the **include-in-corporate-hostnames** and **include-in-corporate-apps** [lists](https://documentation.sailpoint.com/sair/help/lists.html) to define which apps should always be considered as corporate. When **Log all accounts** is disabled, activity for hostnames or apps that match will be logged. ## Managing Global Allowlist The Global Allow List is a policy-level feature that allows admins to explicitly exclude specific websites or applications from being monitored. When a website or application is included in the global allow list, the browser extension does not trigger for that destination resulting no activity being collected or logged. **To add an application to the allowlist:** 1. Go to **General settings > Global allowlist** tab. 1. Select **Add items**. 1. Select **Applications**. 1. Select **Next**. 1. On the allow items window, select the **Value** field and complete the following: - Select **Lists** to choose [lists](https://documentation.sailpoint.com/sair/help/lists.html) of applications. - Select **Applications** to choose individual applications. 1. Select **Add**. Shadow AI Remediation will not monitor activity for sessions involving matching websites or applications. **To add a domain to the allowlist:** 1. Go to **General settings > Global allowlist** tab. 1. Select **Add items**. 1. Select **Domains**. 1. Select **Next**. 1. On the allow items window, select the **Value** field. 1. Select the desired [list](https://documentation.sailpoint.com/sair/help/lists.html) of domains. 1. Select **Add**. Shadow AI Remediation will not monitor activity for sessions involving matching domains. **To add an IP address to the allowlist:** 1. Go to **General settings > Global allowlist** tab. 1. Select **Add items**. 1. Select **Domains**. 1. Select **Next**. 1. On the allow items window, select the **Value** field. 1. Select the desired [list](https://documentation.sailpoint.com/sair/help/lists.html) of IP addresses. 1. Select **Add**. Shadow AI Remediation will not monitor activity for sessions involving matching IP addresses. ## Pausing the Browser Extension Admins can configure whether all users or only specific users can pause the browser extension on their endpoint. **To configure who can pause the browser extension:** 1. Go to **Extensions > Settings** tab. 1. In the **Set who can pause the extension** section, complete the following: - **All users** - Select to allow all users to pause the browser extension. - **Only the following users** - Select to choose specific users or groups that can pause the browser extension. 1. Select **Save**. # Configuring Security Settings Admin users manage Shadow AI Remediation through the admin console, where they can view and retrieve data. Users with the Org Admin user level can also configure system settings, define privacy controls, and create API tokens to allow API clients to integrate with the Shadow AI Remediation platform. For more information about admin user levels, refer to [User Levels and Permissions](https://documentation.sailpoint.com/sair/help/index.html#user-levels-and-permissions). ## Configuring Discovery Settings You can configure the scope of activity that is discovered and tracked by Shadow AI Remediation, and for which areas of organization. To temporarily stop discovery for all users, select **Pause discovery**. To restart discovery for the configured select **Start discovery**. ### Configuring User Activity Types to Discover Activity types control Shadow AI Remediation’s scope of visibility into user activity and potential security risks. **To configure which user activity types you want to discover:** 1. Go to **Playbooks > Discovery settings > Activity**. 1. Enable the toggle next to each desired type. | Activity Type | Description | | ------------------------ | -------------------------------------------------------------------------------- | | **General** | | | General website browsing | Tracks general browsing activity to identify accessed applications and services. | | **Data** | | | File downloads | Tracks download activity to help identify potential data ingress and risky file acquisition patterns. | | File uploads | Tracks upload activity to help identify potential data exfiltration paths. | | Print attempt | Tracks web page printing events. | | **Identity** | | | Corporate credentials used in unmapped web apps | Tracks events where users have submitted corporate credentials to unmapped web applications that were not visited by other employees before. | | Submission of credentials | Track events where employees submitted credentials to websites. This includes any type of credentials against any website. | | Sign-ins, sign-ups, and password changes to SaaS applications | Track sign-in events to web applications. Discover IdP password changes when using the web interface of Entra or Okta. | | OAuth | Track OAuth authorization events against OAuth providers (Microsoft, Google, LinkedIn, Apple, Facebook). | ### Configuring Organizational Areas to Track You can control which users and areas of your organization are tracked by Shadow AI Remediation. **To configure which users activity is discovered and tracked:** 1. Go to **Playbooks > Discovery settings > Target**. 1. Select the Target group field, and choose the desired [target groups](https://documentation.sailpoint.com/sair/help/target_groups.html).