Standing service security-third-party-app-grants-reviewed-each-quarter · revised 12 October 2026
Standing service
Get your connected-app permissions reviewed again every quarter, with what changed
Each quarter you get the list of outside apps with access to your Microsoft 365 or Google account: what was added, removed or widened, unknown ones flagged and a named owner for each.
This starts a conversation by email. Nothing is charged, and nothing is reviewed, until we have agreed scope, access and terms with you in writing.
The responsibility you hand over
Staff connect new outside apps all year, so a list made once is out of date within weeks. Each new grant can read company data, and a stolen app token needs no password. Without a repeat review, unknown and ownerless grants build up again.
Who it’s for: IT lead or owner of a 10 to 250 person Microsoft 365 or Google Workspace tenant.
Usually starts when: You reviewed your connected apps once and staff keep adding new ones.
The result: Every quarter you get the inventory of app grants with a change list: grants added, removed and widened since the last review, unknown or ownerless ones flagged, and a named owner for each. Your administrator gets the console steps for each flagged grant.
What stays true, and what we do about it
No response-time guarantee is published for this new service. A target for delivering each report is agreed in writing before it starts, set to what a service at this stage can actually keep.
Runs once a quarter after the period closes. Not staffed round the clock.
What must remain true
- Every app grant in each quarterly export is on the inventory with an owner, or is listed as ownerless
- Each quarter's report lists grants added, removed and widened since the last report
- No unknown grant or grant held by a departed account that appears in the export goes unreported
What we watch
- A quarterly export of app grants
- Your staff list changes
- The previous inventory
When something happens
Scroll the table sideways to read it all.
| When | What we do |
|---|---|
| A quarter closes and the grant export is available. | We produce the inventory and change list and send them to the person you named. |
| A new grant has broad permissions, such as read access to all mail or files. | We list it first, with the permission text, and ask the owner whether it is expected. |
| A grant is held by an account that has left. | We flag it with the account and date for your administrator to review. |
| The first inventory has not been built. | We offer the one-off job at its listed price. Linked job: Connected-app permissions review |
We do on our own
- Read the export and compare it with the last quarter
- Prepare the inventory, change list and flags
- Explain permissions from the platform text
We ask you first
- Wider access or a shorter cycle
- Any change to what counts as unused
- Starting any other job
We escalate to you when
- A grant looks like part of an active compromise
- The same unknown grant appears two quarters running
- Exports stop arriving
How you know it held. Each quarter you can recompute the grant count from the export, and a sample of 20 matches your console.
How we keep it true
This service is never finished. Each period's summary shows whether the thing it watches stayed true, and it continues until you end it.
Get a list of the outside apps connected to your Microsoft 365 or Google account Job Optional
A list of the third-party apps that hold a consent grant in your export, what each can reach, when it was last used and who owns it. Unknown or unusually broad ones are flagged for you to review.
Bought separately, once
The first full inventory, if you want it before committing to the quarterly service.
What is included, and what is not
- The quarterly inventory and change list
- The flagged grants with evidence rows
- Console steps for your administrator
Included
- One tenant and up to 150 grants, from a quarterly export or a read-only role that you create and can remove
- The change list against the last quarter, and the full inventory
- Flags for grants that are unknown, ownerless, unused for the agreed days or held by someone who has left
- Console steps for your administrator for each flagged grant
- Scripts list and compare the grants; the language model explains permissions in plain English from the platform documentation
Not included
- Revoking, disabling or changing any grant: your administrator does that
- Investigating a suspected active compromise
- Reading mailbox contents or files
- Deciding whether an app should be trusted
- Any promise of a certification, a pass or an audit result: the assessor or auditor decides
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
On a test copy with 25 grants (unknown, unused, departed owner, over-broad scope and others) planted by the separate automated reviewer and not shown to the builder, all 25 are found. This is a smoke test on planted cases, not a rate on your real data.
Evidence: The planted list beside the report. A missed grant fails the test.
Each quarter every grant in your export appears in the inventory, and a sample of 20 matches your console.
Evidence: Row counts and the 20-row console check by your administrator.
Each added, removed or widened grant in the change list can be found in one of the two exports.
Evidence: The change list beside the two exports.
Sign-off. You read each report and tell us whether the unused-days rule and the owners list still suit you. A quarter counts as delivered when you have received the inventory and change list.
If it fails. If we cannot complete a period because an export is missing or has changed, we say so, explain what we need and do not guess. If the service is not working for you, you can end it at the end of any month.
When it fits, and when we stop
It fits when
- You can export app grants each quarter, or keep a read-only role that you create and can remove
- A named administrator can check a sample against the console
- Data is limited to apps, accounts, permissions and dates
We stop and tell you if
- You suspect an active compromise (get incident response first)
- You want us to revoke grants
- The platform will not show grants without giving us write access
What could go wrong
The service only reads and reports, so there is nothing to undo. Ending it leaves your systems exactly as they are; you keep every report we sent.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A grant is missing from the quarterly list | Every grant in the export appears in the inventory, and a sample of 20 is matched to your console each quarter. |
| A permission is explained wrongly | Each explanation sits beside the platform's own permission text so your administrator can read the original. |
| Your files pass through an AI model provider | The written agreement names the provider type, its country and how long it keeps data before you send anything. Entry jobs use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the job ends. |
A separate automated reviewer checks every flag against its export row before it is sent. Your administrator checks a sample and decides what to revoke. No human supervisor is included unless your agreement names one, and at launch the work is largely automated.
Stays with a person
- Your administrator revokes or keeps every grant
- You approve the read-only role and its removal
Access we would need
- A quarterly export of app grants, or a read-only role that you create and can remove
- No admin credentials held between runs
Questions
Why every quarter?
Staff add apps all year. A quarterly change list shows what is new without rebuilding the whole inventory by hand.
Will you revoke risky apps?
No. We flag them and give the console steps. Your administrator revokes.
Do I need the one-off job first?
No. The first quarter builds the inventory. The one-off job is the same inventory, bought separately.
Also part of
Send an enquiry
Send us
- Your platform and roughly how many users
- Whether you have reviewed app grants before
- Whether an administrator could export them each quarter. No logins in the first enquiry
Later, once you agree
- A quarterly export of app grants, or a read-only role that you create and can remove
- A list of who owns each business app
- A named administrator
You keep the tenant and every decision. We read an export or a read-only role that you create, scope and remove, and hold no admin credentials between runs. We never revoke or change anything.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “security-third-party-app-grants-reviewed-each-quarter” as the subject.