The Integration Nobody Reviewed: Connected Apps in the SaaS Stack

Somewhere in your email platform's settings is a list of connected applications: the scheduling tool from 2022, the AI note-taker someone tried, the expense app, a dozen others. Each one has standing permission to read something, granted in ten seconds by an employee who just wanted the free trial to work.

Vendor risk programs review the vendors the company buys. Connected apps skip procurement entirely: no contract, no questionnaire, no review, just an OAuth grant that never expires. The data flows are real anyway, and they persist long after the employee forgot the tool exists.

The good news: the list exists, and reading it takes an hour. The review that follows is one of the highest-yield afternoons in third-party risk.

TLDR

• OAuth grants are vendor relationships with none of the review.

• The admin consoles already list every connected app; start there.

• For each app: who connected it, is it still used, what can it read?

• Revoking unused grants is free risk reduction with no project attached.

• Going forward, new connections route through a lightweight approval.

The grants nobody remembers making

Every major platform keeps the list: Google Workspace and Microsoft 365 admin consoles show every third-party app with access, who granted it, and what scopes it holds. Most companies have never opened that page.

The first look is always surprising. Dozens of apps, some with read access to all mail or all files, connected by people testing a tool for a week. The grants do not expire with the trial. They sit there, trusted pipelines into company data, maintained by vendors with no contract and no obligation to you.

This is shadow IT with an API key; the discovery logic from finding what procurement never approved applies, with the admin console as the map.

The one-hour review

Export the list and work it line by line. For each app: who connected it, does the business still use it, and what can it read? The dispositions write themselves: keep the ones the business depends on, with a note of what they access; revoke the rest.

This fictional example shows the triage of a real-looking list. It is an illustration, not a prescription.

App	Connected by	Access	Disposition
Scheduling tool	Sales team	Calendar read/write	Keep - in daily use
AI meeting notes	Former employee	All meeting audio	Investigate - vendor holds recordings
Expense app	Finance	Receipts inbox	Keep - contracted tool
Design plugin	Marketing trial 2023	All files read	Revoke

The revoke column is the satisfying one: risk removed in an afternoon, at zero cost, with nothing to maintain.

The apps that make you think

Between keep and revoke sits the interesting middle: tools people genuinely use with access broader than the use requires. The AI note-taker that records every meeting when the team only wanted transcripts of customer calls. The plugin that can read all files when it needs one folder.

These deserve the same questions as any vendor: what does it hold, where does it process, what happens to our data if it is breached? The difference is you are asking after the data already flows, which is why the next step matters.

The emerging version of this problem, where a vendor's agent acts on your data, makes the scope question sharper: what the app can do matters as much as what it can read.

Close the front door politely

Left alone, the list refills. Both major platforms let you restrict new connections: users request, an admin approves. Turn it on with a light touch - a day or two of delay and a short justification - so teams route through it instead of around it.

Publish the approved list so the common tools are pre-cleared. The goal is not friction; it is that every standing pipeline into company data exists on purpose.

The related discussion of shadow it is worth your time alongside this one. The related discussion of vendor's agent acts on your data is worth your time alongside this one.

Frequently asked questions

How many connected apps is normal?

Far more than expected: dozens at a small company, hundreds at a larger one. Most are dormant trials. The count matters less than the number with broad read access that nobody can explain.

What if we revoke something people use?

They will tell you within a day, and re-granting takes minutes. The asymmetry favors revoking aggressively: dormant grants are silent, broken workflows are loud.

How does this relate to our vendor risk program?

It is the program's missing half. Contracted vendors get reviewed; OAuth grants bypass procurement. The connected-app list belongs in the same register, reviewed on the same cycle.

A Defensible Next Step

Open your email platform's connected-apps page this week and count what has access. The number will make the case for the review better than any framework document. Book a Decision-Clarity Call if you want the first review run with you.