SaaS admin settings: five myths versus what vendor docs say

Several comfortable beliefs about SaaS admin settings are wrong or incomplete. Each below is checked against vendor documentation we read this week. The common thread is that defaults, badges and per setting switches rarely mean what people assume, so verify the live value.

Myth 1: A verified app is a safe app

Fact: Microsoft says the verified badge confirms the publisher organization is authentic. It says the badge does not indicate certifications, standards compliance or good practices. Treat it as one input to a decision, alongside the permissions requested.

Myth 2: Turning on a stricter consent setting cleans up old approvals

Fact: Microsoft states that updating user consent settings only affects future consent operations. Existing grants stay, and users keep access based on what they already granted. Review and revoke past grants separately. Revoking also does not stop a user consenting again unless you restrict consent.

Myth 3: Blocking a domain in Teams keeps its people out of my meetings

Fact: Microsoft notes that people from blocked domains can still join meetings anonymously if anonymous access is allowed. External access, guest access and anonymous meeting access are separate settings.

Myth 4: Restricting an app in Slack removes it

Fact: Slack's admin page says restricting an app does not remove existing installations. A workspace owner or app manager must remove them. Also, org level app management is described as an Enterprise feature.

Myth 5: Moving Drive files to a new owner locks out the old one

Fact: Google states that ownership transfers do not change who has access, and that the previous owner can still edit transferred files unless their account is deleted or permissions change. Offboarding needs an access review too.

A bonus: "audit logging is a Premium thing"

Fact: Microsoft states Audit (Standard) is enabled by default and keeps records for 180 days. What Premium adds is longer retention and extra insights. The risk is not that logs are missing but that they expire before you look.

What to do with this

When you read a setting name, ask four questions:

1. What exactly does it control, and what does it leave alone?
2. Does it affect existing items or only future ones?
3. Which other setting can override it, in either direction?
4. How would I see the live value in a quarter?

Keep the answers beside the baseline table. If you cannot answer one, test it in a sandbox before you rely on it.

Quick check

Sources

• Publisher verification overview
• Configure how users consent to applications
• Manage external meetings and chat (Teams)
• Manage apps on your Slack workspace
• Transfer Drive files to a new owner as an admin
• Learn about auditing solutions in Microsoft Purview

Last reviewed: 19 October 2026.