domainwidedelegation.comStart free

Use cases → Admin and governance

Remove third-party OAuth apps from all users

Revoke access for unwanted OAuth apps across every user in your Workspace domain using a delegated service account and the Admin SDK.

Who it is forWorkspace administrators needing to enforce security policy after a risky app is discovered or policy changes.
APIsAdmin SDK
Typical scopesadmin.directory.user.security

The problem

Unwanted third-party apps can persistently access mail, files, and other sensitive data even after policy changes. Manual removal is error-prone and slow, while native controls only block new grants, not existing tokens. Compliance and incident response require certainty that access has been revoked everywhere.

How it works

  1. List all users in the domain using the Admin SDK.
  2. Enumerate each user's authorised third-party apps (OAuth tokens).
  3. Identify app IDs matching the unwanted app(s).
  4. Revoke each matching token for every user via the API.

What changes

The targeted app loses access across the entire tenant, reducing risk and bringing the environment back into compliance quickly.

The trap in this one. The Admin SDK's token revocation is eventually consistent: tokens may still appear in listings for several minutes after revocation, and re-running the script too quickly can mislead you into thinking some users were missed. Always allow time for propagation and verify after a delay, or you'll chase false positives and waste hours reprocessing the same accounts.

Watch it explained

“Tip 7: Third-party app access | 10 Security Tips for Google Workspace” — AppsEDU 🤓 Google Workspace tech experts on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Does this stop future logins by the same app?

No. It only revokes current tokens. Users can re-authorise the app unless you also block it in the OAuth app access control settings.

Can I target multiple apps at once?

Yes, by matching on multiple client IDs during the enumeration and revocation steps.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.