A Shadow User is an individual who has been granted direct access to a SharePoint site but is not a member of the associated Microsoft 365 Group or Team. In the BindTuning governance framework, these are considered "infiltrators" because they occupy a hidden permission layer that bypasses official group membership.
How is a Shadow User created?
Shadow Users are typically the result of manual permission changes:
The Wrong Way: An owner uses the "Share site only" feature in SharePoint.
The Right Way: An owner uses "Add members to group" or adds the user via the Microsoft Teams interface.
When the "Share site only" method is used, the user gains access to the files and content but does not become part of the governed M365 Group identity.
Why are Shadow Users a governance risk?
Shadow Users break the "Single Source of Truth" for your workspace. This creates several critical issues:
Lack of Visibility: Admins viewing the Team or Group membership list will not see these users, even though they can access, edit, or delete sensitive data.
Broken Governance: Security policies or sensitivity labels applied to the Group may not consistently apply to these individual "site-only" permissions.
Inconsistent Experience: The user can see SharePoint files but won't see the Team in their sidebar, won't have access to the shared Calendar, and cannot participate in Planner tasks.
How does Pulse365 help manage this?
Because Microsoft 365 does not natively provide a single list of these "hidden" users across the entire tenant, Pulse365 provides a dedicated Shadow Users Report. This report allows you to:
Instantly Identify: See a comprehensive list of all shadow users across every workspace in your tenant.
Assess Impact: View exactly what files and folders these users have access to.
Remediate Fast: Easily reconcile these users by either removing their direct access or properly adding them to the governed M365 Group to bring them "out of the shadows."
Pulse365 delivers the visibility, insights, and control you need to strengthen governance and compliance across your Microsoft 365 environment. Start for free today and experience how Pulse365 can help you monitor, optimize, and secure your tenant — empowering your organization to stay compliant, efficient, and ready for the future of collaboration.