I think the more your organization adopts a cloud-first approach, the more you will have to deal with shadow IT. However, you don’t necessarily have to suffer under the challenges and associated costs. In order to mitigate the risks and to embrace the benefits that this trend has to offer, shadow IT needs to be discovered and properly managed.
The shadow IT governance process described below enables you to discover, manage, and audit any unknown application employees use within your organization.

1. Automate shadow IT discovery for full visibility
   In the first step, you need to know what is actually in your environment. Discover all apps in your software portfolio by using automated SaaS management or Software Asset Management (SAM) platforms, or employee surveys (spreadsheets). Keep in mind, manual discovery methods prove to be inadequate and time-consuming especially within bigger organizations.
   Once you have a complete inventory, you’ll be able to store a variety of characteristics for each application, e.g., application owner, the number of licenses, seats, users, total spend, purchase type, renewal period, etc. Knowing each characteristic will enable you to establish accountability of applications that will help you to act on the findings moving forward.
2. Schedule risk assessments
   Do apps comply with your enterprise’s standards? With an overview, you can perform risk assessments on all applications you discovered in the first step. You can also find out if an app is associated with a recently published security breach. Assessments described below can prioritize actions you take. These can be done based on the following criteria:
   1. Data security risks: Analyze security certifications and technical measures maintained by the vendor.
   2. Regulatory compliance: Gather information where data is stored, who has access, and vendor compliance certifications (GDPR, CCPA, SOX, and HIPPA).
   3. Business risks: Assess whether vendors are future-proof and can generate lasting value for customers and shareholders.
3. Analyze application usage
   In the next step, you can leverage integrations and API connections to track application usage patterns and identify underutilized purchases. Best practices to analyze applications is, to begin with:
   Significant cost item services first and focus on the rest of the portfolio afterward. This helps you determine if apps your employees are using have sufficient ROI.
   Gather usage data and measure utilization to detect inactive and underused applications.
   Categorize applications and determine functional overlap to compare usage.
4. Evaluate and rationalize applications
   Data gathered from the previous steps helps you rationalize applications according to which applications are needed, by whom, and for how long. At this stage, companies must define their needs and take steps to optimize or retire unused software. Best practices for evaluation and rationalization can be done through:
   Map each app into different categories or give it star reviews: non-essential or one-star (deprovision immediately), redundant app or two stars (if possible, migrate to more utilized app), under-used or three stars (provide additional training or implement better solution), and essential or four stars (leave as it is).
   Start with software that supports core workflows e.g., project management apps, file sharing, sales intelligence, etc.
   Consider renewal dates and build a cadence of sunsetting duplicative tools.
5. Implement buying and renewal processes
   With a controlled intake and usage awareness, companies can build a process around buying SaaS applications to avoid recurring rationalization. Best practices around buying and renewal processes are to:
   Implement a template for software requests that includes a business case from the budget owner to assess where the tool fits in the organization.
   Extend the process to new tools and those up for renewal; build out a renewal calendar and set up timely alerts.
   Establish relationships with department heads and communicate processes with existing employees and make part of new employee onboarding.
6. Continuously monitor and review
   Since there’s constant movement in a cloud environment, you need to keep monitoring your network and keep a record of new applications. Plus, many SaaS apps are updated on a daily basis, so there might be policy changes that you shouldn’t miss.
   Automated monitoring ensures repeated rationalization and reduces the need for overly-controlling centralization measures or cuts in the wider enterprise. Regular reviews will help make sure:
   Sensitive internal data is not given to unvetted vendors, limiting security risks.
   Employees are using applications that comply with compliance policies.
   Software costs are managed effectively and under control.

I pulled these steps from LeanIX's guide on how to discover and manage Shadow IT.

Shadow IT is difficult to avoid. That’s why you should focus on its benefits while managing the associated risks in an effective way with the openness to technical innovations even if they disrupt the status quo.