How to review connected apps on Google account
Connected apps can make Google services more useful, but they can also retain access to your Gmail, Google Drive, Calendar, Contacts, and profile data long after you stop using them.
This guide explains how to review connected apps on Google account, what permissions to inspect, and how to remove apps you no longer trust.
By the end, you’ll know where Google lists third-party access, how to spot risky permissions, and which apps deserve a closer look before you keep using them.
What connected apps are and why they matter
Connected apps are third-party services that sign in with Google or request access to Google account data through OAuth permissions.
Common examples include productivity tools, email clients, CRM platforms, file scanners, photo editors, and mobile apps that use Google for login.
When you approve access, Google creates a token or authorization grant that lets the app act within the limits you accepted.
That may include reading basic profile details, viewing files, sending email on your behalf, or accessing calendar events.
The risk is not always immediate, but unused or overly broad access can create unnecessary exposure if an app is compromised or no longer maintained.
How to review connected apps on Google account
Google keeps a central page for third-party access.
You can review connected apps on Google account from your security settings and check what each app can do.
On desktop
- Sign in to your Google Account.
- Open Security from the left-side navigation.
- Scroll to Your connections to third-party apps & services or Third-party apps with account access.
- Review each app name, sign-in method, and permission summary.
- Select an app to see details such as access scope, last used date, and available removal options.
On Android or iPhone
- Open the Google app or your device browser and sign in to your account.
- Go to Manage your Google Account.
- Tap Security.
- Find the section for third-party access or connected services.
- Open each entry to inspect the permissions and activity.
If your interface looks different, Google may be using a revised label, but the same security area still lists apps and services connected to your account.
What to check for in each connected app
Not every app with access is dangerous.
The key is to compare the app’s purpose with the permissions it has been granted.
1. Permission scope
Review whether the app can only see basic profile data or whether it has access to sensitive services like Gmail, Drive, or Calendar.
A simple website login should not need broad access to files or email.
2. Last used activity
Check when the app was last used.
An app you have not opened in months is a good candidate for removal, especially if it still has access to personal data.
3. Publisher and brand identity
Verify the app name, developer, and website.
A legitimate service usually matches a recognizable company, a verified domain, and a clear privacy policy.
Be careful with lookalike names and generic publishers.
4. Access type
Some apps only have sign-in access, while others can read, modify, or send content.
Read-write access is more sensitive than read-only access and deserves closer scrutiny.
5. Data categories involved
Google may show what the app can access, such as email metadata, Drive files, contacts, calendar events, or profile information.
The more sensitive the data, the more important it is to confirm that the app is still necessary.
Which permissions are most sensitive?
Some Google account permissions carry higher risk because they can reveal personal, business, or financial information.
If a connected app has any of the following, review it carefully:
- Gmail access for reading, composing, or sending email
- Google Drive access for viewing, creating, or editing files
- Google Calendar access for event details and scheduling
- Contacts access for address books and relationship data
- Google Photos access for personal images and metadata
- Offline access that lets the app continue operating without repeated sign-in
Offline access is especially important because it may allow the app to keep working even after you stop actively using it.
If the app does not need background access, it may be safer to remove it.
How to remove or limit access
If a connected app is outdated, unused, or too permissive, revoke its access from the same Google security page.
- Open the app details in your Google Account security settings.
- Choose Remove access, Delete connection, or a similar option.
- Confirm the removal when prompted.
- If the app is still useful, reconnect it later only if you are comfortable with the permissions requested.
For apps tied to a business workflow, consider whether a different account or a narrower permission set is available.
In some cases, you can switch from full account access to a limited sign-in option, depending on how the app authenticates.
Signs a connected app deserves immediate review
You should inspect an app right away if you notice unusual account activity, unexpected permission changes, or login alerts you do not recognize.
Other warning signs include:
- The app requests access that is unrelated to its stated purpose.
- The developer website is missing, broken, or low quality.
- The app was acquired, renamed, or abandoned.
- You do not remember authorizing it.
- The app has not been updated in a long time.
- Multiple security alerts point to suspicious sign-ins or token activity.
Even trusted brands can change ownership or permissions over time, so it is worth rechecking apps periodically rather than assuming older approvals are still safe.
Best practices for keeping Google account connections secure
Security hygiene matters as much as the initial approval.
A few habits can reduce the chance of silent access problems.
- Review connected apps every few months.
- Remove services you no longer use.
- Use strong, unique passwords with a password manager.
- Turn on Google 2-Step Verification.
- Check account recovery methods regularly.
- Prefer apps with clear privacy policies and reputable developers.
- Avoid granting access from links in unsolicited emails or messages.
If you use Google Workspace for work, the same review process is even more important because connected apps may touch shared files, business email, and team calendars.
Admin-controlled environments may also have separate app access policies, so your organization’s settings can affect what you see.
How Google’s security tools help you investigate further
Google account security pages often include related tools such as recent security activity, signed-in devices, and personal security recommendations.
These sections help you confirm whether the connected app issue is isolated or part of a broader account problem.
If you suspect compromise, change your password, review recovery options, and inspect all sign-in devices.
If a malicious app was granted access, removing the connection should be followed by a broader cleanup of your account sessions and recovery methods.
When a connected app is probably safe to keep
An app is more likely to be safe if it comes from a reputable company, has a clear reason for each permission, shows recent activity, and only requests access needed for its core features.
For example, a calendar scheduler may legitimately need calendar access, while a note-taking app may not need Gmail access at all.
The safest approach is to keep only the apps that still serve a real purpose and whose permissions match what they actually do.
That habit makes it easier to spot anomalies the next time you review connected apps on Google account.