1. In the Admin console, open Security > Access and data control > API controls.
2. Choose Manage Third-Party App Access and review configured and accessed applications.
3. Open an application and inspect its client ID, users and requested Google services or scopes.
4. Compare the identity with the vendor's official integration instructions. Review who owns the business process and what information the app needs.
5. Apply the appropriate access policy for the intended users and services, using the available controls.
6. Test the approved workflow and record the decision and review date.

Ask the affected user whether they intentionally connected it, but do not rely on that answer alone if compromise is suspected. Review available logs and revoke or block inappropriate access through the authorised response process. Preserve the client ID and relevant evidence before removing records needed for investigation.

An app that only needs a calendar integration should not receive unrelated mail or file access without justification. Review the actual scope controls and vendor requirements instead of marking every blocked application trusted to remove a sign-in error.

Have a representative user reconnect through the official OAuth flow. Confirm the required function works and that unapproved access remains blocked. Some changes or reports take time to appear.

Review app access when a project ends or an employee leaves. Password changes and account suspension are useful security actions, but connected applications also deserve an explicit review.

• Connecting Google Workspace securely and fixing authentication failures
• Assigning limited Google Workspace administrator roles
• Resetting a Google Workspace password and sign-in sessions
• Transferring a departing employee's Google Workspace data

• Google Workspace third-party app access controls
• Google Workspace verified third-party apps