📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Google Workspace OAuth Applications

See every app your users have connected to Google Workspace, what it can access and how risky it is.

Where to find it
Opened from Google Workspace › Google Workspace (the dashboard's apps figures)
Who can use it
Anyone who can see the page
Plan
Google Workspace monitoring
For
Everyone

What the page is for

Users can sign in to third-party apps with their Google account and grant those apps access to Gmail, Drive and other data. Administrators can go further and give an app domain-wide delegation, which lets it act as any user in your organization. This page lists every connected app with a risk score from 0 to 100, the permissions (scopes) it holds, and how many users use it.

Apps flagged as suspicious or scoring 70 or more are highlighted. Recognized backup and disaster-recovery apps are labelled Backup instead of showing a raw score: they need broad access to do their job, but you should still confirm the vendor is authorized.

What you see

The Google Workspace OAuth Applications page, with the summary figures, oauth applications header, filters and apps table numbered 1 to 4.
The Google Workspace OAuth Applications page. Numbers match the list below.
  1. Summary figures: Total, Suspicious, High Risk, Vendor Access, Backup, New (30d) and Admin.
  2. OAuth Applications header: the number of apps and Export.
  3. Filters: Search (app name or scope), Filter and a reset button.
  4. Apps table: Application, Risk Score, Flags, Users, Added, Last Used and Scopes.

How to find risky apps

  1. In Filter, choose Suspicious or High Risk (70+).
  2. Check the Risk Score badge: red is 70 or more, amber is 40 to 69, green is below 40. Hover over it for details.
  3. Check Flags for Suspicious, Domain-wide, Service acct, Admin-granted, New, verified and 3rd Party.
  4. Review the Scopes column to see exactly what the app can access.

How to review vendor and admin access

  1. In Filter, choose Vendor Access (delegation/service acct), Domain-Wide Delegation or Service Accounts.
  2. For each app, confirm you know the vendor and still need it.
  3. Choose Backup / DR vendors to confirm your backup apps are the ones you expect.
  4. Choose Admin Scopes or Sensitive Scopes to see apps that can change settings or read sensitive data.

How to export the list

  1. Click Export.
  2. A CSV file downloads with each app's name, client ID, risk score, flags, delegation type, the kinds of data it can reach (Gmail, Drive, admin), user count, first seen, last used and scopes.

Tips

  • Sort by Risk Score (the default) to see the riskiest apps first, or by Added to see what is new.
  • Domain-wide means the app can act as any user in your organization. Treat it with care.
  • Hover over Admin-granted to see which administrator granted access.
  • Use New (30d) after an incident to check what was connected recently.

Troubleshooting

  • "No apps found." Clear the search and set Filter to All.
  • An app you removed still appears. The list updates on the next Google Workspace sync.
  • No apps at all. Check that Google Workspace is connected on the Google Workspace dashboard.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.