Shadow IT events (in the Events screen) are now linking to the original email that triggered the event. This link allows the admins to easily find emails from unauthorized services.