Cut off a compromised third-party app by revoking its grants in every system it touches, reviewing its activity logs, rotating any secret that sat in those systems, and then blocking re-consent. Do containment first, investigation second, and write down times as you go.
Before the incident
You can only move fast if you know where the app is connected. Keep a register of connected apps with an owner and the revoke steps for each. If you do not have one, the first hour of an incident becomes a search. See the integration register template.
Runbook
| Step | Action | Notes |
|---|---|---|
| 1 | Name an incident lead and open a timeline | Record every action with a time |
| 2 | Revoke the app's grants in each connected system | Delegated and application permissions are separate in some platforms |
| 3 | Disable or delete the app's API keys and service accounts | Do not wait for the vendor |
| 4 | Block re-consent | Revoking does not stop a user from granting access again |
| 5 | Pull activity logs for the app's connection window | Look for bulk reads, exports, odd hours and new source addresses |
| 6 | Search connected systems for stored secrets | Tickets, notes, files and messages often contain pasted keys |
| 7 | Rotate every secret that could have been read | Start with cloud keys and database credentials |
| 8 | Decide who must be told | Customers, regulators and partners, using your legal advice |
| 9 | Ask the vendor for scope, dates and deletion | Get answers in writing |
| 10 | Review and restore only what is needed | Reconnect with narrower scopes |
Why step 6 matters
In the August 2025 incident reported by Google Threat Intelligence, the actor searched the exported data for secrets such as cloud access keys and passwords. Google's recommended actions included searching connected platforms for such strings and revoking and rotating credentials found. Treat any shared system as a place where secrets may live, because people paste them into it.
Revoking correctly
Microsoft's guidance for Entra notes two cautions. Admin-granted and user-granted permissions are managed differently, and portal revocation covers the admin consent tab, so user consent grants may need an API or script. And revoking does not stop users from consenting again, so you must also change how users are allowed to consent.
Google advises developers to revoke tokens as soon as they are no longer needed. As a customer, revoke from your admin console and from the app's own settings.
After containment
- Record what you learned and what slowed you down.
- Reduce scopes on every app that survived.
- Add detection: alerts for bulk exports and for new connected apps.
- Run the revoke steps again in a drill, so the next time takes minutes.
Quick check
Should I wait for the vendor to confirm the breach?
No. Revoke on the first credible report. You can reconnect later. A delay gives an attacker more time with a working token.
Do I need to rotate secrets if logs show no misuse?
Logs can be incomplete. Rotate secrets that could have been read, starting with the most powerful.
Safeguard's asset discovery, policies and compliance evidence automation help you prepare the register and record the response. Try the free scan at gold.safeguard.sh/scan.
Sources
- Data theft from Salesforce instances via Salesloft Drift, Google Cloud Threat Intelligence
- Review permissions granted to enterprise applications, Microsoft Learn
- OAuth 2.0 best practices, Google for Developers
Last reviewed: 19 October 2026.
