How to Configure Google Workspace App Access Control (OAuth Whitelisting)

The Shadow IT Problem

In a Google Workspace environment, users frequently encounter third-party applications (like a new calendar scheduling tool, an AI meeting note-taker, or a CRM integration) that request access to their corporate data. When the user clicks “Sign in with Google,” they are often presented with an OAuth consent screen asking for permission to “Read, write, and delete all emails in your Gmail inbox.”

If the user blindly clicks “Allow,” they have just granted a completely unvetted, third-party startup full API access to your company’s most sensitive data. This is a massive data exfiltration risk, often referred to as “Shadow IT.”

To secure your corporate data boundary, system administrators must enforce App Access Control. This feature blocks all third-party applications from accessing core Google Workspace APIs (like Gmail and Google Drive) by default. Employees can only grant access to applications that the IT department has explicitly vetted and whitelisted.

Step 1: Blocking All Unvetted Applications

The first step is to establish a secure baseline by globally blocking access to high-risk APIs.

1. Log into the Google Workspace Admin Console using Super Administrator credentials.
2. Navigate to Security > Access and data control > API controls.
3. Under the App access control section, click Manage Google Services.

You will see a list of core Google services (Gmail, Google Drive, Google Calendar, etc.).

1. Select the checkboxes next to the most sensitive services, primarily Gmail and Google Drive.
2. Click Change access at the top.
3. Select Restricted and click Change.

Immediate Effect: Any third-party application that tries to read an employee’s email or access their Drive files will instantly receive an “Access Blocked by Administrator” error. Applications that only request basic profile information (like Name and Email Address for simple SSO login) will still function normally.

Step 2: Whitelisting a Trusted Application

Suppose the Sales team submits a ticket requesting access to HubSpot CRM, which needs to read their Gmail inboxes to log client communications. The IT department reviews HubSpot’s security whitepapers and approves the request.

You must now whitelist HubSpot, allowing it to bypass the global restriction.

1. Go back to Security > Access and data control > API controls.
2. Under the App access control section, click Manage Third-Party App Access.
3. Click the Add app dropdown and select OAuth App Name or Client ID.
4. Search for “HubSpot” (or enter HubSpot’s specific OAuth Client ID).
5. Select the correct application from the search results.

Step 3: Defining the Scope of Access

You have granular control over exactly who is allowed to use this whitelisted application.

1. Google will ask you to select the Organizational Units (OUs) that need access. If only the Sales team needs HubSpot, select the Sales OU. If you select the root domain, everyone gets access.
2. Next, Google will ask for the trust level. Select Trusted: Can access all Google services.
3. Click Finish.

The HubSpot app is now whitelisted. When a Sales representative clicks “Sign in with Google” on HubSpot’s website, the OAuth consent screen will appear normally, and Google will successfully grant the API tokens. If an engineer (who is not in the Sales OU) attempts to use it, or if a user attempts to use a completely different CRM that hasn’t been whitelisted, the access will be aggressively blocked.