No. Revoking an OAuth app removes its permission to call your account from that point on. It does not reach into the vendor's systems and delete data the app already pulled. Deletion is a separate request you make to the vendor, under your contract or privacy law.
What revocation actually changes
When you connect an app, you grant it a token tied to a set of permissions. Revoking removes that grant. Microsoft's Entra guidance describes revocation as removing the permissions an app holds, and adds a caveat worth remembering: revoking does not stop users from consenting again unless you also change how users are allowed to consent.
So revocation is a door lock, not a cleanup crew. Anything the app stored while the door was open stays where it is.
| Question | After revocation |
|---|---|
| Can the app read new data? | No, once the token stops working |
| Is data it already copied removed? | No, not by revocation |
| Can someone re-grant access? | Yes, unless consent is restricted |
| Do other apps keep working? | Yes, each grant is separate |
Steps to take after revoking
- Record what the app could see. List the scopes it held and the date range it was connected. This sets the size of the problem.
- Check the audit log for activity from the app between connection and revocation. Look for bulk reads, exports and unusual hours.
- Rotate any secret the app could have read. If the app had mail or file access, assume pasted passwords and keys in those places are exposed.
- Block re-consent. Restrict who can approve new apps so the same grant does not return quietly.
- Send the vendor a written deletion request. Name the account, the connection dates and the data categories, and ask for confirmation in writing.
- Diary a follow-up. If no confirmation arrives in the time your contract allows, escalate.
What to ask the vendor
- Which data from our account did you store, and where?
- Does it sit in backups, logs or analytics copies, and how long do those last?
- Did any subprocessor receive it?
- Can you confirm deletion in writing, with a date?
Vendors often keep data for a retention period or for legal reasons, so the honest answer may be "deleted within 30 days, backups within 90". Get the answer in writing either way.
Make the next revocation smaller
Scope matters most. An app granted read access to one folder leaves far less behind than one granted the whole drive. Google's own guidance for app developers is to ask only for the access a feature needs, and to revoke tokens once they are no longer needed. As the customer, you can apply the same rule when you approve apps.
Quick check
If I uninstall the app, is that the same as revoking?
Not always. Uninstalling may leave the grant in place on the provider side. Check the connected apps list in your identity provider and revoke from there as well.
Does a password change revoke an app's access?
It depends on the provider and the scopes. Google documents one case, a password change when the refresh token holds Gmail scopes. Do not assume it works for every app, and revoke explicitly.
Safeguard's asset discovery and policy features can help you keep a list of connected systems to review. You can also run a free scan at gold.safeguard.sh/scan.
Sources
- Review permissions granted to enterprise applications, Microsoft Learn
- OAuth 2.0 best practices for apps, Google for Developers
- OAuth 2.0 overview, Google for Developers
Last reviewed: 19 October 2026.
