# Article Name How to Detect OAuth Risks in Google Workspace and Who’s Behind Them # Article Summary Learn a five-step framework to map, inventory, correlate, score and remediate Google Workspace OAuth threats and their owners. # Original HTML URL on Toriihq.com https://www.toriihq.com/articles/oauth-google-workspace-risk # Details OAuth permissions in Google Workspace seldom make the compliance checklist, yet they quietly drive serious data breaches. Security teams focus on passwords, phishing, and device health, while thousands of refresh tokens survive every reset. When a phished consent screen or rogue app succeeds, attackers inherit mailbox, Drive, and admin API access without triggering a single login alert. Cleaning up this sprawl begins by finally seeing it clearly. You need more than a marketplace blocklist; you need a repeatable process that moves from discovery to revocation without slowing people down. This five-step approach covers mapping the Workspace OAuth surface, compiling a full grant inventory, linking each token to its human or bot owner, scoring real-world risk, and then either revoking or monitoring access in a way users can tolerate. Follow these steps and you'll turn an opaque pile of OAuth tokens into a measurable, continuously watched control point. ## Map the Workspace OAuth Attack Surface Every OAuth token issued inside Workspace quietly expands your perimeter beyond what a firewall can see. These bearer tokens and their refresh partners live outside network controls, yet they still allow Drive copies, Gmail reads, and Calendar edits as if the caller were the employee. Kick off mapping by treating each token as a mini service account with only the scopes granted at consent. Grab the raw audit events Google already keeps for you. Open the Admin console, select Reporting, then Security, and drill into OAuth activity. If the domain is large, switch on the Reports API export and ship logs to BigQuery [https://cloud.google.com/bigquery] so queries finish in seconds rather than minutes. Run one query for tokenissued and another for tokenrefreshed; the gap between them highlights dormant apps that still hold data access even if no one remembers installing them. After the events land, tag each record as Google-native or third-party by matching client IDs against Google’s published list. Anything that misses the match is a blind spot because the default trusted list stops with Google products. Add a column called foreignapp and set it to true whenever the requester’s domain is not google.com. These are the entries attackers love to mimic because users see a familiar logo and ignore the consent screen URL. Most break-ins rely on only three entry points, so tag them early. - Phishing pages that clone Google’s OAuth prompt and trick users into granting scopes. - Compromised service accounts leaking refresh tokens to public repos. - Marketplace apps that swap their code after passing the initial Google review. Before you leave discovery, confirm that the basics are wired up and properly scoped. - BigQuery export turned on for Admin and Token logs. - At least 180 days of audit log retention. - An Administrator role with Security Center and Reports API rights, nothing less. Once the surface is mapped and the tooling is live, analysts can build a full inventory without looping back for missing data. ## Inventory OAuth Grants and Scopes A clean inventory underpins every OAuth defense you build downstream. Incident responders say a tidy token list cuts investigation time in half. Open the Admin console, select Apps, and record each Marketplace entry marked “Installed.” Then pivot to the Security Investigation Tool; filter where Event Source equals 'OAuth Token' and export the results. For deeper history or scheduled pulls, call the oauthToken.list endpoint in the OAuth Token Audit API and send output to BigQuery. Pulling from all three locations plugs the gap that appears when a user deletes an app but its token lingers server-side. Combine the feeds in one sheet or table and normalize a few columns: client ID, app name, publisher domain, granted scopes, first seen, last used. Anything missing a client ID or scopes should be queried again. High-risk scopes deserve quick color coding because they rarely belong in broad production use: - https://www.googleapis.com/auth/drive.readonly - https://mail.google.com/ or https://www.googleapis.com/auth/gmail.modify - https://www.googleapis.com/auth/admin.directory.user.readonly Proofpoint’s 2023 cloud threat survey found that half of enterprises encountered a malicious OAuth app last year, and most stole data with read-only rights, not deletes. The color cue helps analysts spot those quiet exfiltration paths on the first scroll. Group by client ID to catch vendors that publish multiple aliases or recycle old versions. If the client ID belongs to Google (you will recognize the google.com developer project), hide it unless your policy blocks specific first-party features. That way the list only shows external integrations. A smaller set makes false positives less painful when you later automate revocation. Finally, save the normalized sheet as your single source of tokens and schedule a nightly append job. New rows highlight fresh installs, while missing rows flag uninstalls that may still hold dormant refresh tokens. Accurate, current data beats any fancy scoring model that follows in step four. ## Link Grants to Users and Bots An inventory without owners is just a list, not a security insight. After Step 2 you know every client ID touching Workspace, so now link each grant to the person, bot, or delegated admin who clicked Allow. Export OAuth Token Audit events to BigQuery or your SIEM and capture the eventid, clientid, principalemail, and eventtime fields. Join that feed with Directory API results keyed on principalemail so each row inherits org unit, job title, and any Admin roles the user holds, then stash the merged output in a table called oauthusergrants. When tuning the view, keep at least: - Clientid - Appname - Principalemail - Orgunitpath - Rolecount - Firstseen - Lastused Service accounts complicate mapping because they sit behind generic emails that rarely log in. Pull actorserviceaccountkeyname from the same audit feed, then cross-reference it with Cloud IAM data to learn which workload or pipeline owns the key; neglected build agents often surface here with century-long tokens. Silent installs are another blind spot: Marketplace apps added through “Add shortcut to Drive” never trigger a consent screen, so scan for installtype equals DRIVEADDON before they sprawl across project folders. Delegated admins can approve a domain-wide install in three clicks, so flag any grant where principal_email carries the Admin role but the authorized scopes dwarf the app’s advertised needs. Stack these findings in the same table so you can line up rogue installs against odd login IPs later in Step 4. With owners and context stitched together, pivot the data into a User-App-Scope matrix that highlights risky concentrations at a glance. In Looker, add conditional formatting that turns a cell red when one person grants three or more high-sensitivity scopes across different apps; security leads absorb visuals faster than CSVs. The same matrix doubles as an allowlisting aid because you can slice it by org unit to see that design interns, for instance, rely on Slack bots while finance depends on a sanctioned ERP connector, sparing everyone from blanket blocks that fuel Shadow IT. ## Score and Prioritize OAuth Risks Raw OAuth inventories feel overwhelming until you turn them into numbers the whole team can quickly rank. The easiest path is a lightweight rubric that multiplies the risk factors you already collected. One column per factor keeps the math obvious, while a final “total score” puts the riskiest apps at the top. Consider a 1-to-5 scale for each of these inputs: - Scope sensitivity: read-only Gmail still scores high because it enables silent forwarding rules. - Publisher reputation: a verified Marketplace badge earns a one; an unknown GitHub repo lands a five. - User privilege: grants from tenant-wide admins carry more weight than intern tokens. - Install breadth: domain-wide installs expand blast radius even if the scopes look mild. - Anomaly signals: mismatched login geos or first-seen timestamps during off hours drive the score up quickly. A simple spreadsheet with an auto-sum formula surfaces outliers in minutes and lets you adjust weights whenever you like without rewriting queries. Raw scores become more useful when you layer on outside context. Pull the vendor’s SOC 2 status from its trust page, drop VirusTotal’s domain rating into another column, and scrape Google Cloud Marketplace [https://cloud.google.com/marketplace] reviews for sentiment. Every extra datapoint can shave minutes from the next security review because the evidence sits next to the score instead of hiding in a PDF. Clear visuals turn the spreadsheet from data dump into an argument everyone can follow. Pump the sheet into Looker or Splunk, map scores on a red-to-green heat grid, and layer user OU on the y-axis. Executives can spot a red block of finance users authorizing a shady PDF merger tool without reading a single log line. Dashboards also reveal “shadow twins,” knock-off apps that mimic well-known icons but ask for broader scopes, giving you a quick win when you block them early. Because the numbers are fixed, the resulting action plan feels data-driven rather than opinion-based, which speeds approvals and keeps remediation tickets moving. ## Revoke and Monitor OAuth Access Every risky OAuth grant you mapped needs a clean exit plan that keeps business traffic moving. Revoking tokens without a plan can cut off vital workflows, so containment tactics come first. Staging the work in a test organizational unit lets you spot which integrations break before you touch production accounts. Security teams lean on GAM or direct API calls for bulk work. Run a dry-run with gam print tokens and verify the count matches your inventory totals. Even a small mismatch hints at stale data in your sheet. Focus on rapid containment for apps scoring in the red band. - Targeted token revocation for top-tier scopes within high-privilege groups. - Domain-wide blocking rules that stop future grants by client ID or publisher domain. - Conditional access that forces step-up authentication when any new Drive scope shows up. - A “quarantine OU” where uncertain apps can run against dummy data before they get a green light. Once the immediate fires are out, switch to always-on monitoring. Chronicle detections or Splunk [https://www.splunk.com] alerts can watch log events when an unfamiliar client asks for Admin SDK scopes. Pair that with a weekly diff on oauthTokenId in BigQuery. The moment a new high-risk scope appears, your pager should chirp long before a user clicks Save. Many teams also set a 90-day re-consent timer, forcing stale tokens back through the consent screen and surfacing shadow integrations users forgot they had. People across the organization still need to work, so communicate clearly. A short post in the company chat explains why an app vanished and offers the sandbox request form. Highlight the review timeline and most users will wait rather than hunt for a risky workaround. That small step keeps the reauthorization loop from turning into a game of whack-a-mole. ## Conclusion Hidden OAuth gaps inside Google Workspace give attackers open routes until security teams close them. By cataloging every grant, mapping each token to its owner, ranking real risk, and pruning or monitoring access, teams replace guesswork with repeatable checks the entire company can understand. Track, link, score, and fix every OAuth path, and Workspace exposure drops to a measurable level. When the data speaks in clear numbers, executives green-light cleanup projects instead of waiting for the next incident. ## Audit your company's SaaS usage today If you're interested in learning more about SaaS Management, let us know. Torii's SaaS Management Platform can help you: - Find hidden apps: Use AI to scan your entire company for unauthorized apps. Happens in real-time and is constantly running in the background. - Cut costs: Save money by removing unused licenses and duplicate tools. - Implement IT automation: Automate your IT tasks to save time and reduce errors - like offboarding and onboarding automation. - Get contract renewal alerts: Ensure you don't miss important contract renewals. Torii is the industry's first all-in-one SaaS Management Platform, providing a single source of truth across Finance, IT, and Security. Learn more by visiting Torii [https://www.toriihq.com].