Read the application inventory

The Applications page (Inventory menu) lists the SaaS applications found in your organization and the evidence that links each one to your employees. This is where you give each application an approval status. The risk level shown comes from Sorvek's catalogue: it is not calculated from your data.

Where the applications come from

Sorvek cross-checks several sources; the Source filter isolates each one.

The Proof and access column counts each person only once, based on their strongest evidence: proven use (SSO sign-in, OAuth grant or sign-in seen by the extension), access right in Entra ID, other signal, email from the vendor, then access assumed from the Microsoft 365 subscription. Old traces stay out of the total.

The tabs

• Confirmed (default view): applications from the catalogue, or proven by an SSO sign-in, an OAuth consent, a licence or a definite email signal.
• To confirm: a single weak email signal (invoice, trial), with no sign-in or consent.
• All: any application that has at least one current account.
• History: relationships observed in the past, now inactive.
• Detections: domains seen only in email, with no account at all. They are excluded from the other views and from the indicators.

The risk level

The Risk column shows Low, Standard, High, Critical or Unknown. This level is attached to the vendor in Sorvek's catalogue, and it is the same for every organization:

• an application from the general catalogue is Standard by default;
• the AI tools in Sorvek's catalogue are rated Standard, High or Critical, tool by tool;
• common Microsoft 365 services (Word, Excel, Outlook, OneDrive) are Low, Teams and SharePoint Standard, Copilot High;
• an application that is not in the catalogue is Unknown, which does not mean it is safe.

The level does not take into account the number of users, the permissions granted or your approval status. It cannot be changed from the console. The risk of permissions is assessed separately, in OAuth grants.

To judge a vendor, open the Security tab on its detail page: security profile, certifications found on its public pages, head office and, if they exist, the What stands out and What reassures blocks. They do not change the level shown.

Other badges complete the picture:

• MS compromised: Microsoft Identity Protection flags the application's service principal as at risk.
• No sign-in surface: no SSO sign-in, no OAuth and no sign-in seen by the extension, and the vendor's page offers no sign-in. It is probably a vendor that writes to you, not an account.
• Vitality: Live (access observed again in the last 30 days), Dormant, Dead or Unknown. Access observed again does not prove actual use.

Approve an application

The statuses are No status, Approved, In review and Not permitted. Only an administrator can change them; other roles see the badge but cannot change it. See Roles and access.

1. Open Inventory, then Applications.
2. In the Status column, click the application's badge.
3. Choose the new status.

The change is recorded in the History tab of the detail page. For several applications, check their rows (on the page shown): the action bar offers Approve, In review, Not permitted, + Label and Skip.

To quickly sort applications that have no status, open Shadow Apps, then Triage mode. Right arrow: Approve. Left arrow: Deny (Not permitted). Up arrow: In review. Space: Later. Ctrl+Z or ⌘+Z undoes the last decision.

Mark and sort

• Labels: under the application's name, 16 at most per application.
• State: Active or Dismissed. A dismissed application leaves the default view; the Visibility filter brings it back.
• On the detail page: Owner and Business criticality, reserved for administrators.

Click a column header to sort. The filters (Type, Category, Risk, Approval, Source, Vitality, dates) can be combined; Clear filters removes them. By default, the Type filter shows Third-party SaaS: choose All types to also see Microsoft services and internal applications. Export CSV downloads the page shown.