An integration register should record, for every connected app, who owns it, what it can access, what kind of credential it uses, what data it touches, when it was last used and how to switch it off. Review it on a schedule and after any vendor incident.
Why a register beats a list of names
A list of app names tells you what is installed. It does not tell you who to call when it misbehaves, how much damage a leak would do, or whether anyone still uses it. Admin consoles show part of this. Microsoft Entra lets an admin review the permissions an enterprise app holds for the whole organization or for a user or group. Google Workspace admins can set an app to trusted, limited, specific Google data or blocked. Neither records the business context. A register adds that.
The ten fields
| Field | What to write |
|---|---|
| App and vendor | Name, vendor, link to its security page |
| Business owner | A named person who wants it to exist |
| Technical owner | A named person who can revoke it, plus a backup |
| Credential type | OAuth grant, API key, webhook secret, service account |
| Permissions | Exact scopes or roles granted |
| Data touched | Categories, such as customer contact data or source code |
| Direction | Reads, writes or both, and where data goes next |
| Where the secret lives | Vault name or platform store, never the value |
| Last used | Date from logs, and who confirmed it |
| Exit steps | How to revoke, delete data and confirm deletion |
How to build the first version
- Pull candidates from your identity provider's enterprise app list and your admin consoles for mail, chat, code hosting and CRM.
- Add apps from finance records, since paid tools often have connections.
- Ask each team lead to confirm the list and name owners.
- Fill the ten fields for the riskiest first: anything with write access, mail or file access, or code access.
- Mark any app with no owner as "to remove" and set a date.
Review cadence
- Quarterly for apps with broad scopes or write access.
- Yearly for narrow, read only apps.
- Immediately after a vendor reports an incident, and after an owner leaves.
At each review, check last use. An app unused for months is a standing credential for no benefit. Revoke it.
Tie it to evidence
Auditors and customers ask how you manage third party access. A dated register with owners, review records and removals is concrete proof. It also feeds vendor reviews, since the register shows which vendors touch which data.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a monitored inventory flags change over time, the same property a good register needs.
Quick check
Should the register include the secret itself?
No. Record where the secret is stored and who can read it, never the value.
Who should own the register?
One accountable person, often in IT or security, with each app owner responsible for their own rows.
Safeguard's asset discovery and compliance evidence automation are built to keep an inventory current and attach review evidence. Try the free scan at gold.safeguard.sh/scan.
Sources
- Review permissions granted to enterprise applications, Microsoft Learn
- Control which apps access Google Workspace data
Last reviewed: 19 October 2026.
