{"id":1092,"date":"2022-01-11T16:09:26","date_gmt":"2022-01-11T16:09:26","guid":{"rendered":"https:\/\/gatlabs.com\/knowledge\/?post_type=docs&p=1092"},"modified":"2025-09-19T07:57:12","modified_gmt":"2025-09-19T06:57:12","password":"","slug":"audit-and-manage-third-party-applications-in-google-workspace","status":"publish","type":"docs","link":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/audit-and-manage-third-party-applications-in-google-workspace\/","title":{"rendered":"Audit and manage third-party Applications in Google workspace"},"content":{"rendered":"

The Applications section in GAT+ presents all the third-party applications the users have or had installed using their Google Workspace accounts.<\/p>\n

Those are all 3rd party applications that have been authorized to access different permissions from their Google account. This will allow an Admin to view All applications a user has installed using their Google Workspace account and what permissions the applications require from the end-users accounts.<\/p>\n

\"\"<\/p>\n

GAT+ will show all the applications and present all the permissions that are required from the Application itself to your Google Workspace data.<\/p>\n

The permissions that the Applications require from your Google Workspace APIs are graded under “Scope risk score”.<\/p>\n

GAT+ will automatically rank these applications and show a “Scope risk score.” This is based on the permissions third-party applications require from your Google Workspace API.<\/p>\n

Super Admin can examine if those applications are malicious or not and apply a policy on them.<\/p>\n

Manage Applications<\/h2>\n

Ban Third-party apps in real-time<\/span><\/h3>\n

For 3rd party Applications, we have introduced\u00a0real-time<\/strong> policies that can be applied.\u00a0 An Admin can choose to\u00a0ban\u00a0<\/strong>or allow an Application to the end-user account.<\/p>\n

How the GAT+ Ban Applications work<\/h3>\n

GAT+ can block an app from accessing your domain’s data<\/b> by revoking its permissions. This doesn’t completely remove the app from a user’s account, but it makes it unusable.<\/p>\n

    \n
  • When a user tries to use the app, they’ll see a screen asking them to re-grant permissions<\/b>.<\/li>\n
  • If the user agrees and grants access, GAT+ is notified automatically<\/b>.<\/li>\n
  • GAT+ then proactively and immediately revokes those permissions again<\/b>, preventing the app from functioning.<\/li>\n<\/ul>\n

    This means that while the app stays on the user’s account, GAT+ creates a cycle where it repeatedly blocks the app’s access<\/b> every time a user tries to use it. This ensures the app cannot access any sensitive data on your domain, effectively banning it without having to completely delete it from the user’s account.<\/p>\n

    How to create real-time banning of third-party apps<\/span><\/h4>\n

    Find the Applications<\/span><\/h4>\n

    Navigate to\u00a0GAT+ \u2192 Applications \u2192 Apply custom filter \u2192 Search for the Applications\u00a0<\/strong><\/p>\n

    \"GAT+<\/p>\n

    Set up policy<\/span><\/h4>\n

    When the result is found, click on the\u00a0+ sign<\/strong>\u00a0button on the right side under\u00a0Actions\u00a0<\/strong><\/p>\n

    A pop-up window will be displayed, fill in the policy<\/p>\n

      \n
    • Add application policy for \u201cname of the application”<\/li>\n
    • Policy name \u2013 Enter the policy name<\/li>\n
    • Policy type \u2013 Trust or\u00a0Ban\u00a0<\/strong><\/li>\n
    • Select users whom the Ban will occur.\n
        \n
      • User<\/li>\n
      • Group<\/li>\n
      • Org. Unit<\/li>\n<\/ul>\n<\/li>\n
      • Click on the \u201cAdd<\/strong>\u201d button<\/li>\n
      • Click on the \u201cSave<\/strong>\u201d button to enable the policy<\/li>\n<\/ul>\n

        \"GAT+<\/p>\n

        Note:<\/strong>\u00a0GAT+ will check and if \u201cTrust\u201d policy applied it will take precedence over the\u00a0Ban polciy<\/strong>
        \nFor example:<\/em>\u00a0If you ban an app for \/Sales team, but\u00a0trust\u00a0<\/strong>the app for just one user who is part of the \/Sales team, the\u00a0ban rule\u00a0<\/strong>will skip this account.<\/p><\/blockquote>\n

        Existing policies<\/span><\/h4>\n

        From the top many select \u201cPolicies\u201d to view all applied policies currently for the Applications of your domain.<\/p>\n

        Under the\u00a0Actions<\/strong>, you can choose to Edit the ban (pen icon) or you can delete (bin icon) the ban policy.<\/p>\n

        \"GAT+<\/p>\n

        Events<\/h4>\n
        \n
        The ‘Events’<\/strong> tab allows admins to check the events from the perspective of the Applications.<\/div>\n

        Admin can check and search by User and view the data, and what application had access granted to API, and access was authorized or revoked.<\/p>\n<\/div>\n

        \"\"<\/p>\n

        Result<\/span><\/h2>\n

        As a result of the setup Ban policies, the\u00a03rd party<\/strong>\u00a0Applications will be Banned\u00a0<\/strong>from being used by the selected users.<\/p>\n

        GAT+ will remove the \u201cscope\u201d access from the Application to your Domain. However, as this is not a permanent ban or removal of the applications<\/strong>, the end-user can still \u201cgrant\u201d or install the application again.<\/p>\n

        GAT+ will then “see<\/strong>” and\u00a0ban<\/strong> the application again. It will be proactive action based on the end-user behavior.<\/strong><\/p>\n

        This happens in\u00a0real-time\u00a0<\/strong>when a user tries to install the banned application, they will be\u00a0rejected<\/strong>\u00a0as soon as Google notifies GAT+ that a new App is being installed or access is being granted.<\/p>\n

        Note:<\/strong>\u00a0In some cases, the user can log in, because the revoke action\u00a0comes after the fact<\/strong>,\u00a0b<\/strong>ut\u00a0<\/strong>the app can\u00a0not use<\/strong>\u00a0any\u00a0API<\/strong>\u00a0after. It will depends on the App behavior.<\/p><\/blockquote>\n

        Video: How to ban third-party apps in Google Workspace<\/span><\/h4>\n