Google already knows. Your spreadsheet does not.
Every Allow click on a Workspace account creates a refresh token that outlives the tab. Google Admin will show you the apps. It will not score them, expire an attestation, or join the row to Okta. SOC 2 auditors who have read about Drift will ask for more than a screenshot of "Apps with access to data."
This is a manual audit you can finish this week, the limits of native tooling, and what to automate once you trust the list. Manual export is honest for week one. It is rot by week six, when marketing has installed another connector and your CSV still says March.
Pair it with the ScopeMantle platform if you want daily Google Workspace sync, risk scoring, and governance. List price is five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom at 500+. 30-day trial.
1. Export connected apps
- Sign in to admin.google.com as super-admin or a delegated admin who can manage app access. Prefer the delegated role for daily work. Super-admin belongs in a CC6.1 sample, not in everyone's muscle memory.
- Go to Security, then Access and data control, then API controls, then Manage third-party app access, then Manage access.
- For each app record: display name, client ID, user count, scope list, and whether it is trusted / limited / blocked.
- Drill into high-user-count apps for user-level authorizers. Budget half a day at 500 employees if you are thorough. That is the tax. Pay it once so you know what automation is worth.
- Note the export date on the filename. Auditors ask when the list was current.
- Compare user count to HRIS headcount. Grants covering more people than you employ are leftovers from departed users or shared logins you should have killed already.
Flag duplicate client IDs under different marketing names. Acquisitions rename products. The ID does not care.
Reports API vs Admin console
Security engineers like to script activities.list and the tokens API. Those scripts break when Google deprecates a field or when domain-wide delegation is wrong. The maintenance lands on one senior person who then leaves. The inventory rots. Reports API also 429s during Monday cron jobs and fails silently halfway through a CSV.
Authorize events in Apps Reports Activity are not cumulative grant state. Auditors want state under CC9.2. Admin console (or a connector that snapshots it) remains the authoritative manual source. ScopeMantle productizes sync with backoff and schema care. Your bash job from 2023 does not.
2. Classify scopes against stated purpose
Write a rubric before you sort. Mail read on a CRM can be plausible. Mail read on a wallpaper app is not. Map at least these:
| Scope | Blast radius | Default bucket |
|---|---|---|
gmail.readonly | Mail content | Tier 1. Review or revoke if publisher unknown |
Drive / drive.file | Files the user touched through the app | Tier 1 for AI and unknown publishers |
drive.metadata.readonly | File names, which often hold customer identity | Not harmless. Document why you keep it |
| calendar.readonly | Titles, attendees | Tier 2 |
| admin.directory.* | Org directory, not one mailbox | Block without a ticket |
Sort into sanctioned, tolerated shadow, and revoke-now. ScopeMantle automates this as Scope Sanity. Below forty queues for review. Document why you kept a row. Auditors prefer a dated exception to a silent allow-all, and they prefer both to a block-everything policy that drives people onto personal Gmail.
Watch AI extensions that want mail plus Drive. That is the Context.ai shape. It scored below forty on our rubric before the April 2026 disclosure. Details in the breakdown.
3. Cross-check owners with HRIS
High-risk apps need the authorizer list matched to termination dates. A departed employee with a live grant is a CC9.2 finding waiting for a sample. Zero terminated users with grants is the target state. See the deprovisioning model.
Grant owner is not always the business owner. Interns authorize trials that outlive the internship. Map department via title so you know who to ping when you revoke.
Service accounts rarely OAuth via user consent. If they appear, treat them as automation misconfiguration, not as workforce grants.
4. Revoke, block, and tell people
Revoke in Admin or block at the OU with app access control. Tell people before you block, unless you are in active IR. A surprise block pushes work onto personal Google accounts and you lose the only visibility you had.
Emergency vendor-breach revoke needs a pre-built client-ID list. That is the Drift and Context.ai lesson. ScopeMantle bulk revoke targets a client ID across the workforce. Doing it by display name is how you miss the rename.
Pilot a block in a sandbox OU first. Measure tickets. Then expand. Offer a 48-hour review SLA for exceptions so shadow IT does not come back as a personality.
Microsoft Entra is Beta / roadmap. If you are multi-IdP, say so in the audit narrative. Do not pretend a Google-only export is the estate.
5. Chrome policy sits upstream
Workspace lists OAuth clients. It does not list Chrome Web Store extension IDs until someone consents. Context.ai-class tools lived in the store first. Pair Admin audit with an extension allow-list. That is a preventive control, not a substitute for the grant list.
6. Automate once the first list is trusted
Quarterly manual audit means blind quarters. Connect Google and, if you have it, Okta read-only APIs. Daily diff: new installs, scope changes, stale grants. Wire the event stream to SIEM if you want; Splunk and Datadog are GA, Elastic is Beta, Chronicle is Roadmap. A weekly digest to a security champion is enough for most mid-market teams.
No fabricated logos on customers. We are in a design-partner phase and we price in public.
Worked examples
Unknown Chrome extension, mail read, 12 users. Revoke. Tell the 12. Offer an approved summarizer if you have one.
HubSpot, mail and contacts, attested by marketing last month. Keep. Ninety-day expiry on the attestation. Put it on the campaign calendar so Q4 reconnects are not silent.
admin.directory on a new AI tool, one platform engineer. Block. That scope is org-wide. Fast-track only with a written why.
What to tell an auditor
"Here is the Admin export dated inside the observation window. Here is the rubric. Here are three revokes and one exception with a sponsor and an expiry. CC6.7 is a separate packet. OAuth is CC9.2." If they ask about CASB, send them the shadow OAuth data path. HIPAA: we are not attested.
Failure modes
- Export once, never again.
- Reports API half-CSV after a quota error, treated as complete.
- Block without communication.
- Super-admin for daily reviewers.
- Ignoring Okta-side grants because "we are a Google shop" while half of engineering still uses Okta for SaaS.
- Measuring success as app count instead of time-to-revoke a new unattested grant.
What to do this week
- Export Admin third-party apps. Revoke three outliers you cannot explain.
- Publish the scope-to-tier wiki, including the gmail.readonly sentence.
- Schedule a Friday 16:00 tabletop: vendor discloses, you revoke a client ID before Monday.
- Read the SOC 2 checklist and Google vs Microsoft vs Okta.
- Trial ScopeMantle if you do not want to own the script.
Admin SDK and quota, in practice
If you script tokens.list or the Reports API, set a user-agent, honor 429s, and write incremental cursors. Monday 09:00 cron against a 5,000-user domain will fail halfway and look fine in cron email if you only check exit codes on the wrapper. Compare row counts to yesterday. If the count dropped 40 percent, you did not get more secure overnight.
Delegated admin with app-access is enough for review. Super-admin can hide evidence and authorize apps. Keep that population tiny. Log those sessions. CC6.1 samples the super-admin list. CC9.2 samples grants. Different folders.
What "trusted app" in Admin actually means
Google's trusted / limited / blocked is not a risk score. Trusted means you allowed it. It does not mean Scope Sanity is fine. People mark things trusted to silence prompts and then forget. Your rubric still applies. A trusted wallpaper app with mail read is still a revoke candidate. Limited is useful for reducing scope at the platform layer when Google lets you. Blocked is the OU policy you should pilot.
App access control rules at the OU beat a company-wide surprise. Sandbox first. Communicate. Offer the 48-hour exception SLA. Measure personal-Gmail bypass (you will see it in the next shadow-IT survey if you do not see it in logs).
KPI after the first audit
Mean time to revoke a new unattested grant beats raw app count. Pair it with the board slide's unattested trend. Owners named per BU: marketing for martech, engineering for devtools. If nobody will sign, that is your first metric, and it is a people problem, not a connector problem.
Field guide: the Monday after the first revoke
Watch for reconnects. Watch for personal Gmail tickets. Watch for a VP asking why a summarizer died. Have the approved alternative ready or you will lose the policy. Put the three revokes and three exceptions in the weekly notes. Schedule the next export before you close the laptop.
If Reports API was going to be your plan, compare row counts tomorrow. Quota failures look like success. $5 / $6, no seat min, Entra Beta, HIPAA not attested. Connector. Trial.
Mistakes I keep seeing after the first workshop
People export once and call it culture. People revoke by display name after a rebrand. People promise Entra completeness. People put OAuth rows in the user-access matrix. People send DSAR mail without a case ID. People treat a CASB invoice as grant inventory. People change a score threshold the night before audit. People staff an MSSP sprint with someone who cannot read a scope string. Each of those has a fix already on this page. The failure is skipping the fix because the demo looked polished.
Write the one thing you will not skip this week. Put it on a calendar. If you want the inventory to stay current, the 30-day trial is the productized version of the export. Five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom terms at 500+ employees. Microsoft Entra stays labelled Beta. HIPAA is not attested. Templates stay operator-reviewed. No fabricated customer counts on the customers page.
If you are evaluating us next to a GRC tool, keep both jobs honest. If you are evaluating us next to a consent-intercept tool, stack prevention and inventory. If you are an MSP, register the deal before the demo and keep the counsel gate in the SOW. If you are writing a board slide, use last quarter as the only benchmark we will stand behind. That is enough program for a quarter. The next quarter is whether the leftover-grant count actually moved.
One last operator note: if your Admin click-path has moved since this was published, search for Apps with access to data and update the internal wiki the same day. The nouns (client ID, scopes, user count) are the control. The left-nav is not. Then export again next month so this does not become another annual screenshot.