How to Audit Third-Party App Permissions on Google, Microsoft, and GitHub

In this article

1. Understanding OAuth Scopes and Token Lifespans
2. How to Audit Google Account Permissions
3. How to Audit Microsoft Account Permissions
4. For Personal Microsoft Accounts:
5. For Work or School Microsoft 365 Accounts:
6. How to Audit GitHub OAuth Apps and Personal Access Tokens
7. 1. Authorized OAuth Apps
8. 2. Authorized GitHub Apps
9. 3. Personal Access Tokens (PATs)
10. A Framework for Deciding What to Revoke
11. Frequently Asked Questions
12. Will revoking an OAuth app delete my underlying account on that service?
13. Does changing my main account password automatically invalidate third-party app tokens?
14. What is the difference between an OAuth App and a Personal Access Token?
15. How often should I audit third-party permissions?
16. Establishing a Safer Authentication Routine

When you click “Sign in with Google,” “Continue with Microsoft,” or “Authenticate with GitHub,” you are choosing convenience over creating another isolated password. This mechanism, powered by open authorization standards like OAuth 2.0, allows third-party websites and tools to verify your identity or access specific data without ever seeing your password.

However, convenience creates a long-term security debt. Over months and years, users accumulate dozens of granted permissions for web applications, browser extensions, project management tools, and forgotten utilities. Even if you stop using a service, the authorization token you granted remains active until manually revoked or expired.

If one of those third-party services suffers a data breach, compromise, or malicious acquisition, attackers can use these existing authorization tokens to access your cloud storage, emails, contact lists, or code repositories. Performing a routine OAuth audit is one of the most effective, zero-cost ways to reduce your digital attack surface.

Understanding OAuth Scopes and Token Lifespans

When an application requests access to your account, it asks for specific permission levels known as scopes. Scopes range from basic access (reading your public profile picture and email address) to high-risk access (reading, editing, and deleting files in Google Drive, or managing administrative settings on GitHub repositories).

Unlike traditional password logins, OAuth credentials rely on two key mechanisms:

• Access Tokens: Short-lived keys that the application presents to access your resources on a server.
• Refresh Tokens: Long-lived credentials that allow the third-party application to request new access tokens automatically without asking you to log in again.

A critical detail many users overlook is that changing your primary account password does not always invalidate OAuth refresh tokens. Unless a service explicitly revokes third-party app sessions during a password reset, authorized applications can often continue accessing your data unhindered. This makes manual token revoking necessary.

How to Audit Google Account Permissions

Google accounts often hold critical access to personal correspondence, cloud documents, and calendar schedules. To review authorized apps connected to your personal or Google Workspace account:

1. Navigate to your primary Google Account management page at myaccount.google.com.
2. Select Data & privacy from the left-hand navigation menu.
3. Scroll down to the section labeled Data from apps and services you use.
4. Click on Third-party apps & services.

You will see a list of external applications categorized by their level of access. Click on any individual application to expand its profile. Here you should look specifically for:

• Access level details: Verify whether the application has “Has access to…” listed for sensitive services like Gmail, Drive, or Google Contacts.
• Date connected: Check when you granted access. Older applications you haven’t used in months should be top candidates for removal.
• Revocation: Click Delete all connections you have with [App Name] to immediately invalidate the OAuth token.

How to Audit Microsoft Account Permissions

Microsoft handles third-party permissions across personal accounts (Outlook, OneDrive) and enterprise identities (Microsoft 365 / Entra ID). The audit method depends on the account type.

For Personal Microsoft Accounts:

1. Sign in to account.microsoft.com.
2. Navigate to the Privacy tab in the top navigation bar.
3. Scroll down to Apps and services and select Apps and services that can access your data.
4. Review the list, click Edit next to any application, and select Remove these permissions to revoke access.

For Work or School Microsoft 365 Accounts:

Organizational accounts often enforce managed access control policies, but users can view their active consents via the My Apps portal:

1. Go to myapplications.microsoft.com.
2. Click on your profile icon in the top right corner and select View account.
3. Select Applications or navigate directly to Manage account permissions.
4. Review the apps authorized by you or granted on your behalf, and revoke access to non-essential applications.

How to Audit GitHub OAuth Apps and Personal Access Tokens

For developers, GitHub access permissions are extremely high-risk targets. A leaked or forgotten token can allow unauthorized code modification, secret exfiltration, or automated repository tampering.

GitHub uses three separate mechanisms for third-party access that require independent auditing:

1. Authorized OAuth Apps

1. Click your profile picture in the top-right corner and select Settings.
2. In the left sidebar, navigate to Integrations and click Applications.
3. Select the Authorized OAuth Apps tab.
4. Review the granted scopes. If you see tools you no longer use, click the … menu next to the app and select Revoke.

2. Authorized GitHub Apps

In the same Applications menu, switch to the Authorized GitHub Apps tab. GitHub Apps operate on finer granular permissions than older OAuth apps. Review each app’s repository-level access and revoke anything outdated.

3. Personal Access Tokens (PATs)

1. In Settings, scroll to the bottom of the left sidebar and select Developer Settings.
2. Click Personal access tokens.
3. Check both Fine-grained tokens and Tokens (classic).
4. Delete any token that lacks an expiration date, has expired, or is tied to retired local development environments.

A Framework for Deciding What to Revoke

When auditing your accounts, it can be tempting to keep connections active “just in case” you need them again later. However, re-authenticating a tool takes less than ten seconds, whereas recovering from a compromised identity takes days.

Use this evaluation framework for every app on your list:

• The 90-Day Rule: If you have not actively used the application in the last 90 days, revoke it immediately.
• Scope Audit: Does a simple scheduling app require full read-and-write permissions to your entire cloud storage folder? If the requested scopes are excessive for the tool’s core functionality, revoke access and look for a privacy-respecting alternative.
• Unknown Vendors: If you do not recognize the developer or brand name, revoke access instantly. Developers frequently rename products or sell assets to third parties.
• Deprecated Utilities: Remove permissions for single-use converter tools, old mobile devices, or temporary browser extensions you discarded long ago.

Frequently Asked Questions

Will revoking an OAuth app delete my underlying account on that service?

No. Revoking access simply disconnects the bridge between your primary identity provider (Google, Microsoft, GitHub) and the external application. Your account data on the external service remains intact, but the service will require you to log in again if you return.

Does changing my main account password automatically invalidate third-party app tokens?

Not always. While changing a password invalidates active web browser sessions on that primary platform, many platforms maintain existing OAuth refresh tokens until they expire or are manually revoked. You should explicitly audit third-party apps whenever you reset account credentials after a suspected breach.

What is the difference between an OAuth App and a Personal Access Token?

An OAuth App is managed by a third-party service provider that requests permission to act on your behalf via an interactive workflow. A Personal Access Token (PAT) is created manually by you to act like a password for programmatic access, APIs, or command-line tools. Both grant access to your resources, but PATs require manual maintenance and rotation by you.

How often should I audit third-party permissions?

It is best practice to review authorized third-party apps every three to six months. Additionally, conduct an audit immediately whenever you replace a primary workstation, decommission a server, or leave an organization.

Establishing a Safer Authentication Routine

Account security requires ongoing maintenance rather than a single setup step. By setting a calendar reminder every quarter to audit third-party permissions across Google, Microsoft, and GitHub accounts, you systematically remove old access vectors before they can be exploited.

Whenever possible, select fine-grained permissions over full-account access, prefer applications that use narrow authorization scopes, and treat every third-party connection with the same security caution as a shared password.