🚨 Why Reviewing Connected Apps Matters

Connected apps can access your personal data, emails, files, and more through OAuth permissions. After major data breaches like the recent Salesforce incident involving Salt Typhoon, regularly cleaning up unused permissions is crucial for protecting your privacy and security.

🔍 Google Account Cleanup

Step 1: Access Google Account Settings

1. Go to myaccount.google.com
2. Sign in with your Google account credentials
3. Click “Security” in the left sidebar
4. Scroll down and click “Third-party apps with account access”

Step 2: Review Connected Apps

You’ll see three important categories:

• Third-party apps with account access – Full apps you’ve granted permissions to
• Signing in with Google – Apps you use Google to sign into
• Recently used devices – Devices that have accessed your account

Step 3: Remove Unused Apps

For Third-party Apps:

1. Click on any app you don’t recognize or no longer use
2. Review what data it can access (emails, contacts, drive files, etc.)
3. Click “Remove Access” if you want to revoke it
4. Confirm by clicking “OK”

For Sign-in Apps:

1. Click “Signing in with Google”
2. Review the list of apps and websites
3. Click “Remove” next to any services you no longer use
4. Confirm the removal

🏢 Microsoft Account Cleanup

Step 1: Access Microsoft Account Settings

1. Go to account.microsoft.com
2. Sign in with your Microsoft account
3. Click “Privacy” in the top navigation
4. Select “App permissions” from the left menu

Step 2: Review App Permissions

You’ll see apps organized by permission type:

• Apps that can access your info
• Apps with device permissions
• Connected services

Step 3: Revoke Unused Permissions

1. Click on each app to see what data it can access
2. Look for apps you haven’t used in months or don’t recognize
3. Click “Remove these permissions” for apps you want to revoke
4. Confirm by clicking “Yes”

🍎 Apple ID Cleanup

Step 1: Access Apple ID Settings

1. Go to appleid.apple.com
2. Sign in with your Apple ID credentials
3. Navigate to “Sign-In and Security”
4. Click “Apps Using Apple ID”

Step 2: Review and Remove Apps

1. See all apps and services using “Sign in with Apple”
2. View what information each app can access
3. Click “Stop using Apple ID” next to apps you want to remove
4. Choose whether to keep or delete your account with that service
5. Confirm your choice

📱 Social Media Platform Cleanup

🚩 What to Look For When Reviewing

🛡️ Best Practices Going Forward

Before Connecting New Apps:

• Read permissions carefully – Don’t just click “Accept”
• Choose minimal permissions – Only grant what the app actually needs
• Research the developer – Look up their privacy and security practices
• Use “Sign in with…” cautiously – Consider creating separate accounts instead

Regular Maintenance Schedule:

• Quarterly reviews – Set a calendar reminder every 3 months
• After data breaches – Immediately review if your connected apps were involved
• Job changes – Remove work-related integrations from personal accounts
• Annual security audit – Deep dive into all account permissions once per year

🔧 Troubleshooting Common Issues

“I removed an app but it still has my data”

Removing access stops future data collection but doesn’t delete existing data. Contact the app developer directly to request data deletion, or check if the service has a data deletion option in their settings.

“An app says it needs broad permissions”

Consider if you really need that app. Look for alternative apps that require fewer permissions, or create a separate account just for that app if necessary.

“I’m not sure what an app does”

Google the app name and developer, check app store reviews and ratings. When in doubt, remove it – you can always reconnect later if needed.

🚨 Emergency Steps After a Breach

If you learn that a connected app has been breached:

1. Immediately revoke access using the steps above
2. Change passwords on any accounts that might be affected
3. Monitor accounts for suspicious activity for several weeks
4. Enable additional security like 2FA if not already active
5. Consider identity monitoring if sensitive data was involved