A connected app permissions review should answer which outside applications can reach the work account, what each app can read or change, who approved it, and whether the business still needs it. Inventory the connections from the identity provider, confirm the app and developer, reduce or revoke unnecessary access, and test the remaining workflow. Revoking account access does not necessarily delete data the app already copied, so closure may require a separate request to the developer.
Inventory every connection
Open the linked-app or application-permissions page for each work account. Record the application name, developer, account, date first approved if available, last known use, permission categories, business owner, and the workflow that depends on it. Include sign-in connections, calendar tools, email add-ons, document editors, storage integrations, scheduling services, mobile clients, and automations.
Do not treat a familiar logo as proof of identity. Compare the developer name, support site, privacy policy, and the integration used by the team. Flag duplicate names, unknown publishers, abandoned trials, and apps tied to a former employee.
Read permissions as actions
Google's linked-app access guidance explains that third-party apps may request basic profile details, permission to view and copy account data, or permission to manage data by creating, editing, uploading, or deleting it. Translate every label into the business action it permits.
Microsoft's My Apps permissions guidance shows user-consented and administrator-consented permissions separately. A user can revoke permissions personally granted, while administrator-granted access may require an administrator to change it.
Ask whether each permission is necessary for the current function. A scheduling tool may need calendar access, but that does not automatically justify contacts, files, or email access. If the platform offers narrower scopes, use the smallest set that keeps the approved task working.
Decide what to keep, reduce, or remove
Classify each app:
- keep because the owner, purpose, and permissions are current
- reduce because the app needs less access than it has
- revoke because the workflow ended or the app is no longer trusted
- investigate because ownership or impact is unclear
- escalate because access was approved by an administrator
Before revoking a business-critical app, identify dependent automations, stored files, shared calendars, and login methods. Capture the current state and make the change during a test window. Do not leave unexplained access in place merely because someone is worried that it might be important.
Handle copied data separately
Google notes that removing linked access stops future access to Google Account data, but the app may already hold copied data and may need to be contacted about deletion. Review the vendor's retention and account-closure instructions. Record whether the app stored a copy, where the business export lives, and who confirmed deletion when that is required.
If the connection is also used for Sign in with Google or Microsoft, establish another sign-in method before unlinking it. Verify that the organization can still reach its account, billing history, and required records.
Test and document the result
After each change, reopen the identity-provider permissions page and confirm the effective state. Sign out and test the approved workflow with an owner-controlled account. Check that revoked connections fail as intended and that retained integrations can perform only the expected task.
Record the reviewer, application owner, decision, permission changes, test result, and next review date. Repeat the review after staff departures, identity-provider changes, vendor incidents, or a major integration migration. The useful result is not an empty permissions list; it is a small, explainable set of connections whose access matches current work.
Sources
- Share some access to your Google Account data with apps from other developers — Google Account Help
- Edit or revoke application permissions in the My Apps portal — Microsoft Support