How to Block Third-Party App Access in Google Workspace using API Controls

The Threat of Third-Party OAuth Apps

When an employee in your organization signs up for a random web application (like a third-party project management tool or a dubious PDF converter), they are often presented with a “Sign in with Google” button. If they click this button and accept the permission prompt, they are granting that third-party application an OAuth token. This token might give the application full read-and-write access to their Gmail inbox, Google Drive, and Google Calendar.

If that third-party application is malicious or suffers a data breach, your corporate data is entirely compromised, completely bypassing your passwords and two-factor authentication.

To protect your company, Google Workspace Super Administrators must configure the API Controls to proactively block unapproved third-party applications from accessing core Google services.

Step 1: Access the API Controls

1. Log into the Google Workspace Admin Console (admin.google.com) with your administrator credentials.
2. In the left-hand navigation pane, click on Security > Access and data control > API controls.

Step 2: Review the Currently Connected Apps

Before you lock down the system, you should audit the apps your users are currently using to ensure you don’t accidentally break a critical business workflow.

1. Under the App access control section, click on Manage Third-Party App Access.
2. You will see a list of every third-party application that has been granted an OAuth token by anyone in your organization.
3. If you see a legitimate corporate app (like Salesforce or Slack), check the box next to its name, click Change access, and set it to Trusted. This ensures the app will continue to work even after we enable the block policy.

Step 3: Block Unapproved Apps

Once you have trusted your essential corporate applications, you can lock the gates.

1. Return to the main API controls page.
2. Under the App access control section, locate the sub-section titled Unconfigured third-party apps.
3. Click on the Edit link (or the gear icon) next to it.
4. Select the radio button for Block all third-party API access.
5. Click Save.

The Result

From this moment forward, if an employee clicks “Sign in with Google” on a random website that requests access to their Google Drive or Gmail, they will be met with a red “Error 400: admin_policy_enforced” screen. The connection will be hard-blocked by Google.

If they legitimately need a new application for their job, they must submit an IT ticket. You can then return to the API Controls menu, click Add app > OAuth App Name or Client ID, search for the requested application, and manually add it to the Trusted list.