Skip to main content
SaaS discovery gives you a complete map of the SaaS used in your company — which SaaS, by which employees, and with which identities. It helps you identify shadow IT and detect unused licences. Primo supports three discovery methods:

​
Activate via Google Workspace

If Google Workspace is connected, SaaS discovery is enabled automatically. Primo maps every SaaS for which your Google Workspace is used as a sign-in provider.
1

Connect Google Workspace

If you haven’t already, see Connect your email provider.
2

Open the Directory

Go to SaaS > Directory to see discovered SaaS.
No additional configuration is required. Discovery runs continuously in the background. What is captured:
  • The list of SaaS accessed using Google sign-in with a work account
  • The associated work identity (user email) for each SaaS
  • No message content, files, passwords, or browsing history

​
Activate via Microsoft Entra ID

If Microsoft Entra ID is connected, SaaS discovery is enabled automatically. Primo reads your tenant’s sign-in logs and maps every SaaS for which Entra ID is used as a sign-in provider.
1

Connect Microsoft Entra ID

If you haven’t already, see Connect your email provider.
2

Open the Directory

Go to SaaS > Directory to see discovered SaaS.
No additional configuration is required. Discovery runs every hour in the background. The first run covers the last 30 days of sign-ins. To stop discovery through Entra ID, open Entra in SaaS > Directory, go to the Settings tab, and turn off Enable Saas discovery under Setup.
Microsoft only exposes sign-in logs through its API to tenants with a Microsoft Entra ID P1 or P2 licence, included for example in Microsoft 365 Business Premium and E3/E5.
What is captured:
  • The list of SaaS accessed using Microsoft sign-in with a work account, from successful sign-ins only
  • The associated work identity (user principal name) for each SaaS
  • Sign-ins to Microsoft’s own services, such as Microsoft Office, Teams, and Edge, are not listed as SaaS
  • No message content, files, passwords, or browsing history

​
Activate via Chrome extension

The Chrome Extension extends SaaS discovery beyond Google sign-in to capture any SaaS accessed with a work email address — regardless of the login method.

​
Requirements

  • Devices managed by Primo (the extension is deployed through the Google Chrome control)
  • An active SaaS Management subscription
The Chrome Extension doesn’t need Google Workspace or Entra ID to be connected: the discovery methods are independent.

​
Deploy the Chrome extension

1

Go to MDM > Controls and open the Google Chrome control

If you don’t have one yet, click Add new control and select Google Chrome. See Google Chrome.
2

Toggle on Primo Extension

3

Select targeting

Choose the devices that should receive the extension: all devices, specific device groups, or a custom target.
4

Save

The extension is pushed silently to targeted devices. Allow a few minutes for deployment.

​
What the extension captures

  • SaaS accessed with the professional email address
  • The associated work identity for each SaaS
The extension does not capture:
  • Personal Chrome profiles or personal email activity
  • Passwords, message content, or browsing unrelated to work
  • Any activity outside the managed Chrome profile

​
Verify discovery is working

1

Open the Directory

Go to SaaS > Directory in the cockpit.
2

Check recent activity

Check that SaaS and identities appear for recent activity.
3

Review targeted rollouts

Use device group filters to review targeted rollouts.

​
Key points to share with employees

  • Primo observes only work-related SaaS usage tied to the company email address.
  • Personal profiles and personal email addresses are not included.
  • Primo does not capture content, passwords, or browsing unrelated to work.

​
Availability and billing

  • The Google Workspace integration is available at no cost.
  • SaaS discovery requires an active SaaS Management subscription.
  • The Chrome extension requires devices managed by Primo, and administrators control it through the Google Chrome control.

​
Troubleshoot SaaS discovery

​
No SaaS appear after activation

  • For Google Workspace discovery, confirm Google Workspace is connected. For all methods, confirm the SaaS Management subscription is active.
  • For Entra ID discovery, confirm Entra ID is connected, your tenant has a Microsoft Entra ID P1 or P2 licence, and Enable Saas discovery is on in the Settings tab of Entra. If Entra ID was connected before SaaS discovery via Entra ID was available, disconnect and reconnect it so a Global Administrator grants Primo access to sign-in logs.
  • For the Chrome Extension, verify that the devices are targeted by the Google Chrome control and that Primo Extension is on.

​
The extension isn’t installing

  • Check that the device is included in the targeted device group.
  • Allow a few minutes for Chrome policy sync to complete.

​
An employee has multiple Chrome profiles

Only the managed Chrome profile you targeted is in scope. Ask the employee to switch to their managed work profile.