Controlling third-party app access in Google Workspace

When a user authorizes an app with their Google account, the app receives an OAuth token for the scopes it requested: read Gmail, manage Drive files, see Calendar. The app's servers then reach your data directly through Google's APIs. Changing the user's password or enforcing 2SV doesn't automatically stop that access, and the data leaves your environment under the app vendor's control.

Most connected apps are legitimate: scheduling tools, e-signature, CRMs, note takers. The risk comes from apps nobody vetted, apps that ask for far more than they need, abandoned apps still holding tokens, and malicious apps built to harvest mail. The same consent-phishing technique used against Microsoft 365 works against Google accounts.

1. 01

   Open API controls

   Admin console > Security > Access and data control > API controls (requires appropriate admin privileges). Open the App access control page.

2. 02

   Look at Accessed apps

   The Accessed apps list shows apps that have accessed Google data, with verified status, the number of users, and the Google services (OAuth scopes) each app requested. Download the list to CSV for review.

3. 03

   Sort by exposure

   Prioritize apps with Gmail or full Drive scopes, apps used by admins or finance, unverified apps, and apps with one or two users nobody can explain.

4. 04

   Ask owners

   For each app worth keeping, record a business owner and purpose. For each you can't explain, plan to block it.

Pair these with service restrictions. In API controls you can mark individual Google services (Gmail, Drive and Docs, Calendar and others) as Restricted or Unrestricted. A restricted service can be reached only by apps you've marked Trusted or Specific Google data; Limited apps lose access. Google warns that restricting a service stops installed apps you haven't trusted and revokes their tokens, so trust the apps you rely on before you restrict.

Google also lets you restrict access to high-risk OAuth scopes (for example, broad Gmail scopes) separately. Restricting Gmail and Drive and trusting a short list of approved apps is a strong, manageable baseline for most organizations.

Apps you haven't configured as Trusted, Limited, Specific Google data or Blocked are 'unconfigured'. Under API controls > Settings you choose what happens when users try to sign in to them:

• Blocking an app in API controls stops it reaching Google data for the users in scope.
• For an individual user, the Connected applications section of the user's security page in the Admin console lists third-party apps with access to their data and lets you remove access. App passwords (legacy) are listed separately and can be revoked there too.
• During an incident, also review OAuth and Token log events in Reporting > Audit and investigation to see when the app was authorized and what it accessed, before you remove it.
• Changes can take up to 24 hours to take effect, though they're usually faster.

Sources: Google Workspace Admin Help: 'Control which apps access Google Workspace data' and 'Manage a user's security settings'; 'Data retention and lag times'. Menu labels change; confirm in the Admin console.

• Monthly: review newly accessed apps and any new high-risk scopes.
• Quarterly: re-confirm owners for trusted apps; block apps no longer used.
• Build app requests into your IT intake: what data, which users, verified publisher, vendor's security and privacy terms, Canadian data residency if it matters to you or your clients.
• Offboarding: review apps the departing user authorized, especially ones syncing mail or files to personal accounts.