An employee signs into a tool with Google or Microsoft, clicks through a consent screen, and hands a third party standing access to mail or files. No ticket, no review, no expiry.
Device management doesn't see it. Nor does your firewall. The grant lives in your identity provider, and unless someone goes looking in the admin console, nobody ever does.
You inherit every incident at every vendor your staff has ever authorised. The first step is simply knowing the list.
Each app is scored on the scopes it actually holds—read your mail, manage your files, see the directory—and how many people granted it. A well-known name with full mailbox access is a bigger problem than an obscure one that can only read your profile.
Apps are tracked across rescans as new, current or removed, so a newly authorised high-risk app is an alert the day it appears rather than a discovery next quarter.
Banning tools doesn't work—people need them to do their jobs, and a blocked employee finds a worse workaround. Give them a way to ask.
People request the tool they need, with a reason. You see what's being asked for, by whom, and how often—which is usually the first honest picture of what your company actually runs on.
Entitle an app to a cohort—the design team, finance, contractors—rather than the whole domain. Cohorts sync from your directory groups, so membership stays current on its own.
Turn enforcement on in simulation first: see exactly which grants would be withdrawn, from whom, before anything is touched. Then make it real when the list looks right.
Every revocation—real or simulated—is recorded with the person, the app, the reason and the outcome. It survives the app being reclassified or deleted, because that record is what you hand an auditor.
Someone blocked from the same app five times isn't necessarily an attacker—they may just need the tool. Either way it's worth knowing, so we surface the pattern rather than silently refusing.
A newly authorised high-risk app reaches Slack or your webhook the day it shows up, filtered by the severity you care about.