TL;DR:

  • Every app connected to your Google Workspace or Microsoft 365 account via OAuth has ongoing read or write access to your email, files, calendar, or contacts — even after you stop using the app
  • You can see and revoke all third-party app connections: Google Workspace admins use the Security section of the Admin Console; Microsoft 365 admins use Entra ID (formerly Azure AD)
  • Many small businesses have dozens of forgotten app connections, including apps from defunct companies that have since been acquired or shut down

Here’s something that surprises most business owners: every tool your team has ever connected to Google Workspace or Microsoft 365 still has access to your business data. That CRM trial you signed up for two years ago and abandoned? Still connected. The social media scheduler your marketing person tried once? Still reading your calendar. The project management app that three employees used briefly before switching back to spreadsheets? Still there.

This is how OAuth works. When an application asks you to “Connect with Google” or “Sign in with Microsoft”, you grant it specific permissions — read your emails, access your files, view your contacts — and those permissions persist until someone explicitly revokes them. The apps don’t lose access when you stop paying or stop logging in.

For small businesses, this is a meaningful security risk. Each connected app is a potential breach vector: if that app is compromised, attackers can use its access token to access your business data. More concretely, when an employee leaves and you disable their account, the apps they connected using their credentials may lose their access — but apps connected at the organisation level (admin-granted permissions) do not.

What OAuth Permissions Actually Mean

When an app requests OAuth permissions, it asks for specific scopes. These vary from benign to significant:

  • Read your profile: sees your name and email address. Low risk.
  • Read your email: can see every email in your inbox. High risk.
  • Send email on your behalf: can send email from your address without you doing anything. High risk.
  • Read and write your files: can read every file in your Google Drive or OneDrive, and modify them. Very high risk.
  • Access your calendar: can see all your appointments, which reveals business relationships, client meetings, and travel. Medium-high risk.
  • Admin access: granted to apps by Google Workspace or Microsoft 365 admins, applies across the whole organisation. Potentially critical risk.

Many apps request far more permissions than they actually need. An invoice processing tool that asks for full read/write access to Google Drive doesn’t need more than access to a specific folder — but if you click through the approval, it gets what it asked for.

How to Audit Google Workspace

For individual users (personal audit):

  1. Go to myaccount.google.com/permissions
  2. You’ll see every app that has access to your Google account
  3. Click any app to see exactly what permissions it has
  4. Click “Remove Access” to revoke

This only shows apps connected via your personal Google account. If your business uses Google Workspace, some apps are connected at the organisation level and won’t appear here.

For Google Workspace admins (organisation audit):

  1. Log in to the Google Workspace Admin Console at admin.google.com
  2. Go to Security > Access and data control > API controls
  3. Select “Manage third-party app access”
  4. You’ll see every app connected to your Workspace, with the number of users who’ve connected it and the permissions each app holds

From here you can:

  • Block specific apps from accessing your Workspace data
  • Restrict third-party app access to Google Workspace so that only apps you explicitly approve can connect
  • See which apps have admin-level access (these are the highest risk)

Restricting new connections: In Google Workspace, you can set API access control to “Restricted” mode, which blocks all third-party app connections by default and requires admin approval. This prevents the problem from growing, though it requires you to actively approve tools your team wants to use.

How to Audit Microsoft 365

For individual users:

  1. Go to myapps.microsoft.com
  2. Click your profile icon and select “View account”
  3. Go to “Privacy” and then “Manage your privacy settings and data”
  4. Under “Apps and services”, you’ll see connected apps and their permissions
  5. Select an app and click “Remove” to revoke access

For Microsoft 365 admins:

  1. Log in to the Microsoft Entra admin center at entra.microsoft.com
  2. Go to Identity > Applications > Enterprise applications
  3. Filter by “All applications” to see every app with access to your tenant
  4. Click any application to see its permissions, the users who’ve consented, and when it was last used

From the Entra admin center you can:

  • Review application permissions (Application permissions vs Delegated permissions — application-level permissions are higher risk)
  • Revoke consent for specific apps or all users
  • Disable apps that shouldn’t be active
  • Set user consent policies to prevent users from connecting apps without admin approval

Admin consent workflow: Microsoft 365 allows you to enable an admin consent workflow so that when users try to connect an app, they submit a request that you review and approve rather than being able to grant access themselves. Enable this under Identity > Enterprise applications > Consent and permissions > Admin consent settings.

What to Do With What You Find

A typical small business audit finds 20–50 connected apps per user across their Workspace or Microsoft 365. Most of these are harmless tools you’re still using. But look specifically for:

Apps you no longer use: Revoke them. No reason to leave access open for tools you abandoned.

Apps from companies you don’t recognise: Could be a tool a former employee connected, a legitimate service under a parent company name, or — occasionally — a suspicious app. Google the company name to identify it.

Apps with more access than makes sense: A weather app that has access to your calendar? Revoke. A design tool that has read access to your entire Drive? Review whether you still need it and whether it actually needs that scope.

Apps with “send email” or “manage Drive” permissions: These are the highest-risk permissions. Verify each one is genuinely a tool you trust and actively use.

Admin-consented apps: These have organisation-wide access. Even more important to verify these are legitimate and actively needed.

Setting Up Ongoing Controls

Rather than treating this as a one-time audit, set up ongoing controls:

Require admin approval for new app connections: Both Google Workspace and Microsoft 365 let you require admin approval before any user can connect a third-party app. This adds friction but eliminates the “silent accumulation” of connections.

Quarterly review schedule: Set a calendar reminder to review connected apps quarterly. New apps accumulate fast, especially if you’ve been trialling tools.

Offboarding checklist: When an employee leaves, include a step to review and revoke any apps they connected using delegated access (on behalf of their account). Their account being disabled doesn’t automatically revoke apps they consented to on behalf of the organisation.

Limit permissions in approval: When you do approve new apps, check what permissions they’re requesting. If an app asks for more than it needs, contact the vendor and ask if they have a lower-permission integration option — many do.

A Note on Browser Extensions

Browser extensions are a separate but related risk. Chrome and Edge extensions often request access to “read and change all data on websites you visit” — which is much broader than it sounds for a browser used to access your Google Workspace or Microsoft 365 web interface. Audit browser extensions installed across your team’s machines as part of the same exercise. The Chrome Web Store and Microsoft Edge Add-ons both show what permissions an extension uses before you install it; for already-installed extensions, check chrome://extensions or edge://extensions.

The Bottom Line

Third-party app permissions are the kind of security hygiene that gets skipped because it’s not urgent — until a connected app is compromised and used to exfiltrate your email archive or customer data. Running the audit takes 30 minutes for a small team and gives you a clear picture of every door into your business accounts. Do it once now, then set a process to keep it current.