Home › Free tools › OAuth app review
Every other free way to audit your connected apps begins by asking you to connect another app, with admin consent, to the very system you are worried about. This one reads the export your admin console already produces, scores every scope in it, and sorts the apps by how far they actually reach. It installs nothing and uploads nothing.
Runs in your browser. Nothing is sent anywhereA CSV listing apps and the scopes they hold. Google Workspace OAuth
log events, a Microsoft Entra permissions export and the output of
Get-MgOauth2PermissionGrant are recognised from their columns. The file is
read in this tab and is not uploaded.
Get-MgOauth2PermissionGrant | Export-Csv.
Nothing on this page connects to your tenant. It cannot read your apps and it cannot revoke one. It reads the file you give it, and tells you where in your own console to act.
Ranked by what the scope permits, not by who the vendor is. Press one to show only those apps.
Widest reach first. Press an app to see every scope it holds and who granted it. Record a decision against each one: Keep means the access is justified, Restrict means it should hold less, Revoke means it should hold none, and Ask means somebody needs to explain what it is for.
Who reviewed the connected apps, when, what they found and what they decided. This is the part a questionnaire asks for and nobody has.
In Google Workspace: Admin console, Security, Access and data control, API controls, Manage Third-Party App Access. Find the app, then Change access or Remove. In Microsoft 365: Entra admin centre, Enterprise applications, pick the app, Permissions, then Review permissions and revoke. Individual users can also revoke their own grants at myaccount.google.com/permissions or myapplications.microsoft.com.
Reviews are saved in this browser, on this device, so the next one can tell you which apps are new. Nothing is transmitted.
Because the thing you are auditing is which third parties hold access to your mail and files, and the usual free option asks you to grant a new third party exactly that kind of access to find out. It may be a perfectly good company. It is still one more vendor with a token, added in order to count the vendors with tokens. This reads a file instead, so the number of parties holding your data does not go up by one when you audit it.
In Google Workspace: Admin console, then Reporting, Audit and investigation, OAuth log events, then Download as CSV. That gives you app name, client ID, the scopes and the user who granted them. In Microsoft 365: Entra admin centre, Enterprise applications, then a permissions export, or run Get-MgOauth2PermissionGrant in PowerShell and pipe it to Export-Csv. Anything else with an app column and a scope column works through the manual mapping.
By what the scope actually permits, not by the vendor's reputation. Full mailbox access, full Drive, directory write and tenant-wide application permissions are critical, because an app holding one of those can read or change things across your whole organisation. Read-only mail and read-only Drive are high. Narrow scopes such as drive.file, which only reaches files the app itself opened, are narrow on purpose: that is the scope a well-built integration asks for, and it is worth knowing which of your apps bothered.
An app that everybody uses is usually a decision somebody made. An app that one person granted full mailbox access to, six months ago, on a Tuesday, is usually not. The tool sorts by reach but flags that pattern separately, because it is the clearest signal of shadow IT in the file and it is invisible if you only sort by user count.
Yes, for each app, with the exact path in the relevant console. It does not revoke anything itself, and could not: it is a page reading a file, with no connection to your tenant and no credentials. That is the point. Revocation is a deliberate act you perform in your own admin console, and it should be.
The export is read in this tab with the browser's File API and is never transmitted. Your decisions and the previous review are kept in this browser's local storage on this device only, so the next review can tell you which apps are new. The button at the bottom deletes all of it.
There is nothing to scan, because there is no upload. A scanner inspects files arriving at a server; nothing here arrives at one. The export is read from your disk as text inside the page, and the analysis is drawn from what was read. If the file carried something nasty it was already on your machine, and nothing in it is executed here. The risk that does apply is an app name or a scope string crafted to become markup when it is shown back to you. Every field is escaped before it reaches the page, and a test in our build feeds script payloads through the app name, the scope and the grantee to confirm it.