Every person in your company authorizes apps with their Google account: Slack, Canva, Notion, a Sheets add-on, their phone. Those apps read Drive, Gmail or Contacts even after the person has left. The Google admin console lets you list them account by account and revoke them; what it does not do is show them all together, rate the risk or warn you when a new one appears.
Updated on October 11, 2026 · 7 min read · Mekovault
When someone signs in to a tool with “Continue with Google” or installs an add-on, that tool asks for permissions: sometimes just to know who they are (email and name), sometimes to read the calendar, sometimes to read and write all of Drive or all of Gmail. The person accepts, and from that moment the app holds a key that keeps working even if the person signs out, switches computers or leaves the company, until someone revokes it.
In a 100-person company it is normal to find between 300 and 600 active authorizations. Most are harmless (signing in to Slack, Notion, the phone). A few read all of Drive or Gmail, and nobody in the company ever decided that was okay.
| Level | What permission it asked for | Examples | What to do |
|---|---|---|---|
| Low | Only “sign in with Google” (name, email) | Slack, Notion, Canva, Figma, Zoom | Allow if it is a company tool; tolerate if it is personal and touches no data |
| Medium | Calendar, Tasks, Forms, the app’s own files | Calendly, Sheets add-ons, note-taking apps | Allow with an owner; review yearly |
| High | All of Drive, Gmail, Contacts, admin | Email assistants, sync tools, scripts, unknown apps | Decide with the manager; revoke if it is not justified |
You can also block an app for the whole company under Security, API controls, but that decision is made by an admin and leaves no trace of why.
Mekovault reviews every account in the company once a week (early Saturday morning), stores the inventory of apps per person with its risk level, and from then on only records changes. When a new app shows up with no policy, the direct manager gets a notice with 5 business days to decide (allow, tolerate or block); if they do not decide, there is a reminder, a final notice and the revocation at the end of the day. If the person links it again, it is removed again and the manager finds out. And when an account is offboarded, all of its apps are revoked in the same step, Slack first. Everything with a record. It is the “shadow IT” part of digital offboarding, solved without HR having to learn what a token is.
The person sees it in their own account, under Security, 'Third-party apps with account access'. The admin sees it in the admin console, on each user's page, under 'Connected applications', and can revoke them. There is no company-wide view in the console; you have to go user by user or use the API.
The tools people use to get work done without the company having approved them or even knowing they exist. The most common form today is an app authorized with the company Google account. It is not malice: it is people solving their work. The problem is that nobody decides whether that app may read Drive.
The person can no longer use that app with their Google account until they authorize it again. That is why it is better to warn first, give a deadline and revoke only once there is a decision. If the app belongs to the company (Slack, for example), it is marked as allowed and left alone.