On this page
How can I check which third party apps access Google Workspace?
Look at the connected apps in your own Google account. For the whole organisation, use the app access controls in the Workspace admin console. For each app, check what it can reach, who allowed it and why you still need it.
Review shared files as a separate job. An app’s permission and a sharing link are two different routes to your data.
What does OAuth mean?
What OAuth means.
OAuth is how you let an app into your Google account without giving it your password. You click Allow, and the app receives a permission with a set scope, for example the files you pick, or everything in Drive.
That permission can stay in place after you stop using the app. That is why a review looks at the permission, not only at the apps you still open.
What is the admin console?
What the Workspace admin console is.
The settings area where a Google Workspace administrator manages the users, apps and security settings of the whole organisation.
Which app controls you see there depends on your Workspace edition and on your admin role.
A free trial can leave a connection behind.
A designer tries a PDF tool. A founder connects a meeting assistant. A growth consultant gives an automation access to a spreadsheet. Each choice made sense at the time. Months later the subscriptions and projects have changed, and nobody can say for sure which apps can still reach company information.
Start with the accounts used for client work and the services connected to them. Ask each person which tools they still rely on. Do this before you block apps you do not recognise, because an unfamiliar name might run a real part of how you deliver to clients. You want the forgotten access gone and the necessary work still running.
Read the permission, not only the app name.
Google describes what a connected app can do with permission scopes. In plain words: can it read files, change them, send email or reach other information? The exact scope matters. Access to a few files you picked is very different from access to all of Drive, and a familiar supplier name does not tell you which of the two an app has.
Write one sentence for each connection: “This app needs this access because it does this job.” If nobody can finish the sentence, look closer. Note the person responsible, the connected account and the date you reviewed it. Do not treat every connection as suspicious. The real problem is access nobody understands, or has a current reason to keep.
Provider guidance: Google: control app access to Workspace data
one sentence per app26.09.2026
| App | What it can reach | Why it stays |
|---|---|---|
| PDF toolconnected by Ana during a free trial | Every file in Drive, to read and to change | Nobody can finish the sentence. Ask Ana, then remove it. |
| Meeting assistantconnected by Luca | Calendar events and meeting notes | It writes up client calls. Keep it. |
| Reporting automationconnected by Mira | One spreadsheet | It sends the weekly campaign report. Keep it. |
Check file sharing as a separate job.
Removing an app’s access does not change the other ways a file is shared. A folder might still include a former contractor. A document might have a sharing link that anyone can open. A client file might belong to one person instead of the organisation. Review these next to the app list, and keep the two apart.
Say a freelancer who has left used a reporting app and was also added straight to a campaign folder. Review the app’s permission and the folder membership separately. If a tool already copied information, removing its future access does not pull those copies back. When that matters for the project, check the provider’s deletion process.
one folder, two ways in26.09.2026
app access
Which tools have account permission?
- The freelancer’s reporting appreads the whole folder
- Meeting assistantreads the calendar only
file sharing
Which people and links reach the files?
- The former freelancercan edit the folder
- Anyone with the linkcan view one document
Removing the reporting app leaves the freelancer and the link in place. Keep only what current work needs, on both sides.
Removing access today does not pull back what was copied yesterday.
Make the change, then check the result.
Ask the owner whether the connection is still needed. If it is, reduce its access where the provider allows it, and test the real workflow. If it is not, remove it through the account or admin controls. Follow Google’s current instructions for your edition.
Keep a dated note of what changed and why. After a removal, check that the connection is really gone and that the important work still runs. Look again at a client handover or when a colleague leaves. A small review you repeat is easier to keep up than a big audit that happens once.
Provider guidance: Google: sharing account access with third party apps
Put the account review next to the device review.
Connect Google Workspace and cybee shows the account activity there, next to the Macs your team uses. Removing an app’s access still happens in Google. That matters when one person works across a laptop, shared documents and an AI assistant. You review it from the assistant you already use.
Keep the evidence clear. A dated record about a Mac does not show that every online account is secure. Workspace findings apply to the connected Workspace, not to personal Gmail, your bank or every other cloud service. Use the two views together to answer the practical question: who and what still needs access to this client’s work?
What to remember.
- Review app permissions and file sharing separately.
- Give every connection a purpose, an owner and a review date.
- Removing future access does not bring back what was already copied.
Sources and further reading.
Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup.
Review your connected apps this week.
Walk through a review of connected apps step by step, with an owner for each one.
