Google Workspace admins control third party app access through API controls in the Admin console. An app can be Trusted, limited to specific Google data, Limited to unrestricted services, or Blocked. Restricting a Google service means only trusted and specific data apps can reach it, and previously installed untrusted apps lose their tokens.
Where to find it
The controls sit under Security, Access and data control, API controls. You need the Service Settings privilege. Apps fall into Google owned, internal and third party groups.
The four access levels
- Trusted: access to all Google services, including restricted ones.
- Specific Google data: access only to scopes you list. Include the Google Sign-in scopes the app needs, or users cannot sign in with their Google Account.
- Limited: access only to unrestricted services.
- Blocked: no access to Google data. Blocking overrides an allowlist entry.
Restricting services
Under Manage Google Services, you set each service to Restricted or Unrestricted. When a service is Restricted, only Trusted and Specific Google data apps can use it. When Unrestricted, Limited apps can also use scopes you configured.
Switching a service to Restricted stops previously installed untrusted apps and revokes their tokens. That is a strong action, so check what depends on the service first.
There is an optional checkbox, for some services such as Gmail and Drive, that lets users grant untrusted apps non high risk scopes while the service is restricted. You can separately restrict predefined high risk scope lists for Gmail, Drive and Docs, and Chat.
Unconfigured apps
Apps with no setting are the real gap. By default, any third party app may sign in. You can instead allow only apps requesting basic sign in information, or block all third party sign ins. You can also let users request access, with requests reviewed under Apps pending review, and trust all internal apps through one checkbox.
Timing and surprises
Changes can take up to 24 hours, and the accessed apps list updates 48 hours after tokens are granted or revoked. A policy set on an organizational unit stays in effect for that unit even if a different policy is applied to the whole organization later.
A sensible order
- Review the accessed apps list and note which apps hold which scopes.
- Mark the apps you rely on as Trusted or Specific Google data.
- Restrict Gmail and Drive.
- Change the unconfigured app default away from allow everything, and enable a request flow.
- Revisit the list on a schedule.
Safeguard's asset discovery and compliance evidence automation can help you keep the app inventory and review records in one place.
Quick check
Does blocking an app beat an allowlist entry?
Yes. Blocking overrides an allowlist entry.
What happens to installed untrusted apps when I restrict a service?
They stop working against that service and their tokens are revoked.
Sources
Last reviewed: 19 October 2026.
