Microsoft's Work Trend Index found that 80 percent of the knowledge workers it surveyed said they lack the time or energy to do their work. That is 31,000 people across 31 countries, asked in early 2025.

The year before, the same research found that more than 70 percent of the people using AI at work were bringing their own AI tools with them. Not tools the business chose. Tools they found, signed up for and started pasting work into.

Put those two together and you have the whole story. Nobody is being reckless. They are behind, a free tool does in four minutes what used to take forty, and the approval process either does not exist or takes three weeks. Of course they use it.

The part that should worry you is not the tool. It is what goes into it.

A marketing coordinator uploads the brand guidelines and an unreleased campaign. A bookkeeper drops a debtors report into a free analysis tool to get a chart out of it. Someone in operations pastes a client contract in and asks for a plain English summary. None of that feels like a security incident while it is happening. It feels like getting the job done.

Meanwhile more than half the C-suite and IT people in a separate 2023 survey said they were worried about exactly this and had no visibility into it. Worried, and blind. That combination is what the tooling is meant to fix.

The Microsoft material doing the rounds at the moment says Cloud App Discovery is included in Microsoft 365 E3, and frames E3 as the way to get a handle on shadow IT. That statement is true. It is also incomplete in a way that matters if you run a business with 5 to 50 staff.

Cloud App Discovery is not really an E3 feature. It is an Entra ID P1 feature.

Microsoft's documentation puts it plainly: Cloud App Discovery comes at no additional cost as part of Microsoft Entra ID P1, Enterprise Mobility + Security E3, and Microsoft 365 E3. E3 is one of three ways in, not the only one.

And on a separate page, the Entra licensing documentation says Entra ID P1 is included in Microsoft 365 Business Premium.

Follow those two sentences and you land somewhere useful. If your business is on Business Premium, which most Perth businesses in this size range are, you already have Cloud App Discovery. Same tool. Same catalogue of more than 31,000 cloud apps. Same risk scoring. You do not need to move to E3 to get it, and for an SMB that move is rarely the right one for other reasons anyway.

We are not accusing anyone of lying. Enterprise marketing material is written for enterprises, and in an enterprise E3 genuinely is the shape of the answer. But that flyer gets forwarded to small business owners, and it reads as a reason to upgrade. Before it becomes a quote, open your licence list.

If you want the fuller picture of what Business Premium already includes, we have written that up separately in our Business Premium deep dive and the Microsoft Entra ID guide.

Here is the other half of the honesty, and it cuts the other way. Cloud App Discovery is the free-with-your-licence subset of a paid product called Microsoft Defender for Cloud Apps. The discovery part is identical. Almost everything you would do after discovering something is not included.

You get the seeing. You do not get the doing.

What is in both: the catalogue of more than 31,000 apps, the risk assessment of each one, usage analytics by app, user and IP address, ongoing reporting, custom policy creation, and log anonymisation so you can run this without turning it into staff surveillance.

What only comes with the paid product: anomaly detection on the apps you discover, data loss prevention across SaaS, the ability to see and revoke OAuth app permissions, policy enforcement, integration with Microsoft Purview, behavioural analytics, alert remediation and a SIEM connector.

So discovery answers the question "what is being used". It does not answer "and now stop it".

For a lot of small businesses that is genuinely fine, because the honest first step is not blocking anything. It is finding out. Nine times out of ten the fix is a conversation and two approved tools, not a technical control.

If you decide you do want the control layer, the sensible path for a Business Premium tenant is the Microsoft Defender Suite for Business Premium add-on, which includes full Defender for Cloud Apps along with Entra ID P2, Defender for Identity and the Plan 2 versions of Defender for Endpoint and Defender for Office 365. That add-on replaced the old Microsoft 365 E5 Security add-on in September 2025. It is a real cost per user, so weigh it against what discovery actually turns up rather than buying it first. Purview is the other piece of that puzzle, and we cover it in the Microsoft Purview deep dive.

Nobody mentions this bit in the marketing, and it is the bit that decides whether your afternoon goes well.

Cloud App Discovery does not magically know what your staff are using. It reads your network traffic logs. You feed it firewall or proxy logs, either by uploading them yourself or by setting up a log collector to send them automatically, and it matches what it finds against the app catalogue.

There is a much tidier way to do this, where Defender for Endpoint reports app usage straight from the devices and no network gear is involved at all. That one requires a Defender for Cloud Apps licence. It is listed as a Defender for Cloud Apps capability, not a Cloud App Discovery one.

Which leaves a practical question worth answering before you start: can your firewall export its logs, and does your team's traffic actually go through it?

For a business with an office and a decent firewall, usually yes, and this is an hour of work. For a business where half the team works from home on their own internet and the other half is on site with a router the landlord installed, the log-based approach will show you a fraction of the picture. Pretending otherwise wastes everyone's time.

And no approach here covers personal devices on mobile data. Someone with a client list open on their own phone is outside all of this. That is not a reason to skip discovery. It is a reason not to treat the report as the finish line.

Shadow AI is real, it is in your business, and the people doing it are your good staff trying to keep up. Treat it as a discipline problem and you will lose both the visibility and the goodwill.

The tool Microsoft is pointing at is worth using. Just check whether you are already paying for it before anyone quotes you an upgrade to get it, because on Business Premium you almost certainly are.

And know what you are buying if you go further. Discovery shows you the problem. Control costs extra, and it is worth deciding that after you have seen the report rather than before.

If you would rather someone just ran this and told you what turned up, that is what our AI usage analysis is. No upgrade required to find out.