Job security-third-party-app-permissions-review-microsoft-365-or-google · revised 12 October 2026
Get a list of the outside apps connected to your Microsoft 365 or Google account
A list of the third-party apps that hold a consent grant in your export, what each can reach, when it was last used and who owns it. Unknown or unusually broad ones are flagged for you to review.
You might be seeing
- Staff have connected apps over the years and nobody has a list
- A customer asks which outside services can read your mail or files and you cannot say
No passwords, keys, card details or admin invites needed to start.
What usually happened
Staff click "allow" on outside apps, and each grant stays in place after the person or the need has gone. A stolen token of a connected service can read data without any password, as the August 2025 theft of integration tokens showed. Few small companies can list their grants, what each can reach or who owns it.
Who it’s for: IT lead or owner of a 10 to 250 person Microsoft 365 or Google Workspace tenant.
Usually starts when: News of a breach through a connected app, or a customer asking which outside apps can read your company data.
The result: You get a list of every third-party app grant in your export or read-only view: the app, the permissions in plain English, the account that granted it, the last use if the platform shows it and a named owner. Unknown, unused and over-broad ones are flagged, and your administrator gets the steps to review each one.
Check whether this job fits
Answer these without sending files or logins. Nothing is submitted unless you choose to contact us.
Checks you can run yourself
Count your own grants
In the admin console, open the list of enterprise apps or connected apps and count them.
Look for: How many you can name and explain. The rest are the ones the review will flag.
What you get
- The grant inventory with an owner column
- The flagged list with the evidence row for each flag
- Console steps for your administrator
- The test results
Included
- One tenant, up to 150 app grants, from an export or a read-only role that you create and can remove
- Each grant with its permissions explained in plain English, the granting account, the date and the last use if shown
- A flag on grants that are unknown, unused for the agreed days, held by someone who has left, or with unusually broad permissions, such as read access to all mail or files
- The exact console steps for your administrator to review or revoke each flagged grant
- Scripts do the listing and joins; the language model explains permissions in plain English from the platform's own documentation
Not included
- Revoking, disabling or changing any grant: your administrator does that
- Investigating a suspected active compromise (that needs incident response)
- Any promise of a certification, a pass or an audit result: the assessor or auditor decides
- Reading mailbox contents, files or messages
- Deciding whether an app should be trusted
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
On a test copy with 25 grants (unknown app, unused app, departed owner, over-broad scope and others) planted by the separate automated reviewer and not shown to the builder, all 25 are found and none is missed. This is a smoke test on planted cases, not a rate on your real data.
Evidence: The planted list beside the report. A missed grant fails the test.
Every grant in your export appears in the inventory, and a sample of 20 matches your live console, checked by your administrator.
Evidence: Export row count against inventory row count, and the 20-row console check.
Each flagged grant shows the permission text from the platform and the export row it came from. No flag lacks either.
Evidence: The flagged list checked row by row.
Ten display names or app descriptions in the test export carry a hidden instruction. Each runs five times, and no instruction is followed in any run. This is a baseline on this sample, not a claim of immunity.
Evidence: The planted markers and the output of all 50 runs searched for them.
Sign-off. Your administrator inspects the test results and the delivered output, and signs off in writing. Payment follows sign-off.
If it fails. If the agreed tests do not pass, you do not pay for this fixed scope. We hand over what we found and agree whether to stop or re-quote; no surprise work.
When it fits, and when we stop
It fits when
- You can give us an export, or create a read-only role such as Global Reader (the built-in role that can read app consent grants), and remove it afterwards
- A named administrator can check a sample against the live console
- Data is limited to apps, accounts, permissions and dates, not mailbox or file contents
We stop and tell you if
- You suspect an active compromise right now. Contact an incident-response provider first
- You want us to revoke grants for you
- The platform will not show grants without giving us write access
What could go wrong
The job reads files you send and writes a report or draft; it changes nothing in your systems, so there is nothing to undo. Our copies of your files are deleted when the job ends.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A grant is missing from the list and looks safe | The test counts every grant in the export against the report, and your administrator checks a sample against the console. |
| A plain-English permission explanation is wrong | Each explanation quotes the platform's own permission text next to it, so your administrator can read the original. |
| Sign-in and grant data is personal data | The review stays at account and app level. Mailbox and file contents are out of scope, and display names are treated as data, not instructions. |
| Your files pass through an AI model provider | The written agreement names the provider type, its country and how long it keeps data before you send anything. Entry jobs use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the job ends. |
A separate automated reviewer checks every flag against its export row before it reaches you. Your administrator checks a sample against the live console and decides what to revoke. No human supervisor is included unless your agreement names one, and at launch the work is largely automated.
How we deliver
We arrange the work and independent review, then show you the result against the agreed checks. You keep authority over your systems.
- Agree the tenant, the grant list source, the stale-days rule and who owns apps
- You export the grants or create a read-only role; we hold no admin login
- List every grant and explain its permissions from the platform documentation
- A separate checker plants known grants in a test copy; check each is found
- A separate automated reviewer matches every flag to an export row
- Your administrator checks a sample against the console; we hand over and remove access
This is a one-off job, not emergency cover or a subscription. We confirm eligibility, the total price, a start window and a delivery date before you accept. Work starts only after agreed inputs, secure access and any needed permissions are in place. Hosting, supplier and platform charges are excluded unless the written quote includes them. An enquiry creates no charge or booking.
Need to keep it working?
Want the grants reviewed again every quarter? A standing service repeats the review and lists what changed.
Ongoing work is separately scoped and quoted: no monitoring, response-time guarantee or automatic subscription is included in this job.
Mention the responsibility you need in your enquiry.
What you can check
This is a new service. We have not delivered this job for a client yet.
Other ways to get this done
- Review the list yourself in the admin console under enterprise applications or connected apps. It takes time but needs no outside access. learn.microsoft.com
- A SaaS-management tool lists connected apps continuously, as a subscription.
Questions
Will you revoke the risky apps?
No. We list them and explain the steps. Your administrator revokes, because an app may be in use even if it looks unused.
Do you read our mail or files?
No. The review looks at which apps have access and with what permissions, not at the content.
What do you need from us?
An export of the app grants, or a read-only role that you create and remove. We never ask for an admin password.
Send an enquiry
Send us
- Which platform you use, Microsoft 365 or Google Workspace, and roughly how many users
- Roughly how many connected apps you think there are
- Whether you could create a read-only role. No logins or exports in the first enquiry
Later, once you agree
- An export of enterprise-app and consent grants, or a read-only role that you create and later remove
- A list of who owns each business app you know about
- A named administrator to check a sample against the console
You keep the tenant and every decision. We read an export, or a read-only role that you create, scope and remove after each run, and we hold no admin credentials between runs. We never revoke, disable or change anything.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “security-third-party-app-permissions-review-microsoft-365-or-google” as the subject.