# Which apps can read your company’s Google Drive? Find the forgotten ones. > Review connected apps and OAuth permissions in Google Workspace. Separate app access from Drive sharing, confirm who owns each app and recheck every change. Page: https://cybee.ai/blog/google-workspace-app-access/ (How to check third party access to Google Workspace) - [Blog](https://cybee.ai/blog/) - Google Workspace apps Google Workspace A free trial here, a meeting assistant there. Months later, nobody can name every app that still reaches your company’s files. This guide finds them without breaking the work that depends on them. By [cybee](https://cybee.ai/about/#founders) Published 21.09.2026 Updated 24.09.2026 6 minute read In one minute - An app someone connected to Google Workspace can keep its permission long after the trial or the project has ended. - For each app, check what it can do, who connected it and why it is still needed. - App permissions and file sharing are two different routes to your files. Review them separately. - Ask the owner before you remove anything, then check that the work still runs. - Removing access stops future access. It does not bring back copies an app already made. ## How can I check which third party apps access Google Workspace? Look at the connected apps in your own Google account. For the whole organisation, use the app access controls in the Workspace admin console. For each app, check what it can reach, who allowed it and why you still need it. Review shared files as a separate job. An app’s permission and a sharing link are two different routes to your data. **Q:** What does OAuth mean? ### What OAuth means. OAuth is how you let an app into your Google account without giving it your password. You click Allow, and the app receives a permission with a set scope, for example the files you pick, or everything in Drive. That permission can stay in place after you stop using the app. That is why a review looks at the permission, not only at the apps you still open. **Q:** What is the admin console? ### What the Workspace admin console is. The settings area where a Google Workspace administrator manages the users, apps and security settings of the whole organisation. Which app controls you see there depends on your Workspace edition and on your admin role. ## A free trial can leave a connection behind. A designer tries a PDF tool. A founder connects a meeting assistant. A growth consultant gives an automation access to a spreadsheet. Each choice made sense at the time. Months later the subscriptions and projects have changed, and nobody can say for sure which apps can still reach company information. Start with the accounts used for client work and the services connected to them. Ask each person which tools they still rely on. Do this before you block apps you do not recognise, because an unfamiliar name might run a real part of how you deliver to clients. You want the forgotten access gone and the necessary work still running. ## Read the permission, not only the app name. Google describes what a connected app can do with permission scopes. In plain words: can it read files, change them, send email or reach other information? The exact scope matters. Access to a few files you picked is very different from access to all of Drive, and a familiar supplier name does not tell you which of the two an app has. Write one sentence for each connection: “This app needs this access because it does this job.” If nobody can finish the sentence, look closer. Note the person responsible, the connected account and the date you reviewed it. Do not treat every connection as suspicious. The real problem is access nobody understands, or has a current reason to keep. Provider guidance: [Google: control app access to Workspace data](https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data) Figure: Three fictional connections, one sentence each. The one nobody can explain goes back to its owner first. ## Check file sharing as a separate job. Removing an app’s access does not change the other ways a file is shared. A folder might still include a former contractor. A document might have a sharing link that anyone can open. A client file might belong to one person instead of the organisation. Review these next to the app list, and keep the two apart. Say a freelancer who has left used a reporting app and was also added straight to a campaign folder. Review the app’s permission and the folder membership separately. If a tool already copied information, removing its future access does not pull those copies back. When that matters for the project, check the provider’s deletion process. Figure: Two routes into the same folder. Closing one leaves the other open. > Removing access today does not pull back what was copied yesterday. ## Make the change, then check the result. Ask the owner whether the connection is still needed. If it is, reduce its access where the provider allows it, and test the real workflow. If it is not, remove it through the account or admin controls. Follow Google’s current instructions for your edition. Keep a dated note of what changed and why. After a removal, check that the connection is really gone and that the important work still runs. Look again at a client handover or when a colleague leaves. A small review you repeat is easier to keep up than a big audit that happens once. Provider guidance: [Google: sharing account access with third party apps](https://support.google.com/accounts/answer/14012355?hl=en) [When a freelancer leaves](https://cybee.ai/blog/contractor-offboarding-checklist/) ## Put the account review next to the device review. Connect Google Workspace and cybee shows the account activity there, next to the Macs your team uses. Removing an app’s access still happens in Google. That matters when one person works across a laptop, shared documents and an AI assistant. You review it from the assistant you already use. Keep the evidence clear. A dated record about a Mac does not show that every online account is secure. Workspace findings apply to the connected Workspace, not to personal Gmail, your bank or every other cloud service. Use the two views together to answer the practical question: who and what still needs access to this client’s work? Free, and the Proof plan Google Workspace account activity is free. The sealed account record is part of the Proof plan, together with the sealed Trust Passport for your Macs: CHF 9 per Mac per month, or 90 a year, excluding tax, with a 14 day trial. [How cybee shows Google Workspace](https://cybee.ai/product/workspace/)[See the plans](https://cybee.ai/pricing/) ## What to remember. - Review app permissions and file sharing separately. - Give every connection a purpose, an owner and a review date. - Removing future access does not bring back what was already copied. ## Sources and further reading. Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup. - [Google: control app access to Workspace data](https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data) - [Google: sharing account access with third party apps](https://support.google.com/accounts/answer/14012355?hl=en) ## Review your connected apps this week. Walk through a review of connected apps step by step, with an owner for each one. [Review connected apps](https://cybee.ai/use-cases/workspace-app-access/) On this page - The short answer - A trial can leave a connection - Read the permission - File sharing is separate - Change, then check - Accounts next to devices - What to remember - Sources [Look up a term](https://cybee.ai/glossary/) cybee Shows your connected Google Workspace next to the Macs your team uses. Free. [See how it works](https://cybee.ai/product/) ## Other doors to your client’s work. Three more guides. [your team A freelancer leaves. What access do you remove? A checklist for agencies: accounts, shared files, AI connections, client keys and the handover record. Read the guide](https://cybee.ai/blog/contractor-offboarding-checklist/) [Mac security Can a browser extension read your client’s work? What extension permissions mean, how to review them and when to keep, limit or remove one. Read the guide](https://cybee.ai/blog/browser-extension-permissions/) [AI tools Which AI tools are on your work Mac? Find the assistants, the connections set up in each one and the experiments nobody switched off. Read the guide](https://cybee.ai/blog/ai-tool-inventory/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)