How to review the third-party apps connected to your Google Workspace

By the QuantumSec team

Every time an employee clicks Allow on a third-party application, that app gains access to part of your Google Workspace through OAuth. Over time, dozens of connected apps pile up, many forgotten and some with dangerous permissions over Gmail and Drive. This guide teaches you to review them and regain control from the admin console.

Understand the risk of OAuth apps

An OAuth app with permissions over Gmail or Drive can read, send or exfiltrate email and files on behalf of the user. Access is maintained through a token that persists even if the user changes the password, and attackers exploit it with consent phishing: tricking the victim into authorizing a malicious app. That's why connected apps are an attack surface that must be inventoried and controlled, not left to each user's discretion.

Access the API access control

In the Google admin console (admin.google.com), go to Security and open the API controls for app access and data. From there you manage third-party application access: which apps are connected, which permissions (scopes) they have been granted and which policy applies by default to new authorizations.

Inventory the connected apps and their permissions

Review the full list of connected applications and, for each one, the granted scopes. Flag as priority those with access to Gmail, Drive or the whole account: they have the highest impact if compromised. Also note how many users have authorized each app and since when, to spot mass or suspicious authorizations.

Classify by risk and revoke what's unnecessary

Revoke apps that are no longer used, those not verified by Google and those requesting disproportionate permissions for their function (for example, a notes app requesting full Gmail access). Each revocation removes a potential entry point. Document the decisions so you can justify them in a compliance audit.

Move to a restricted access model (allowlist)

Change the default policy to restricted access: block third-party apps except those you explicitly approve in an allowlist. Also block apps not verified by Google. This way, a new malicious app can't gain access even if an employee clicks Allow, because the organization blocks it by policy.

Monitor new authorizations

Configure alerts to detect when a user authorizes an app with sensitive scopes, and periodically review the list of connected apps as part of your security routine. Reviewing OAuth apps isn't a one-time task: the inventory changes continuously as employees try new tools.

FAQ

If I revoke an app, do I lock the attacker out of the account?

Revoking the app invalidates its access token, so it cuts that vector. But after an incident you should also review Gmail forwarding rules, app passwords and active sessions, because the attacker may have left other persistence mechanisms.

Should I block all third-party apps?

You don't need to block everything, but you should move to an allowlist model: block by default and approve only the apps the organization needs and trusts. It's the recommended balance between security and productivity.