Every app a user has clicked "Allow" for gets a standing line into your Microsoft 365 or Google Workspace tenant: mail, files, calendars, sometimes more. Most of those grants were never reviewed by anyone in security. This check lists every one of them, flags what's risky, and tells you what to do about it. Takes about five minutes, nothing is changed.
The check runs through a one-time OAuth consent you grant and revoke yourself, the same mechanism the apps you're checking used to get access in the first place.
Illustrative example — your results will reflect your own tenant's actual connected apps.
AI writing assistants, meeting summarizers, and copilots that employees connected on their own, often with far broader access than they need.
Apps that asked for, and got, full mailbox or full drive access when they only needed to read a calendar.
Apps from developers Microsoft or Google haven't verified, a common pattern in both legitimate shadow IT and outright malicious OAuth phishing.
Access left behind by tools no one uses anymore, or by employees who have since left, still live, still a door.
The Microsoft 365 check is live now — run it free above. Google Workspace is in final testing. Leave your email and I'll send you a link the day it's live, no other emails, no list sold or shared.