The Button Everyone Clicks Without Reading
Signing up for a new tool takes about four seconds if you use the Google button, and that is exactly the point. It removes a password, a confirmation email, and any pause for thought.
The pause is the part worth recovering. Somewhere in those four seconds is a screen listing what the tool will be allowed to do, and almost nobody reads it.
For a small business, that screen is a security decision made by whoever happened to sign up. Over a couple of years, a team of five can accumulate dozens of these decisions with no record of any of them.
The Practical Answer Before Your Next Trial
- ● Identity and access are different things
- ● The consent screen is the decision point
- ● Revoking is easy, recall is impossible
Identity and access are two different requests wearing the same button. Confirming who you are is harmless, and granting access to your mail or files is not.
Basic sign-in shares your name, email address, and profile picture. That is the version most tools need, and it carries roughly the same risk as handing over a business card.
Anything beyond that appears explicitly on the consent screen. If a note-taking app asks to read every file in your Drive, the request is the signal, and stopping to ask why costs nothing.
Identity, Access, And The Gap Between Them
Single sign-on solves a real problem. It removes password reuse, gives you one place to cut off a departing employee, and makes account recovery straightforward.
Those benefits come from the identity half. The tool asks Google to confirm you are who you claim, Google confirms it, and no business data moves.
The access half is a separate transaction that happens to occur on the same screen. Here the tool asks for a token allowing it to read or modify specific categories of your data on your behalf.
The confusion is understandable, since both arrive together in one flow. Separating them mentally is the habit that prevents most accidental oversharing.
What Each Permission Actually Grants
- ● Read scopes are the broad ones
- ● Offline access outlives the login
- ● Drive scope can cover everything
The table below covers permission categories rather than exact technical scope names, which change over time. Check the current consent screen and your account’s third-party access page for the definitive list.
| Permission category | What the tool can do | Typical legitimate reason | Why it deserves a second look |
|---|---|---|---|
| Basic profile | Read your name, email, profile picture | Creating your account | Low risk, expected for any sign-in |
| Calendar read | See event times, titles, attendees | Scheduling and meeting tools | Titles and attendees reveal deals and hiring |
| Calendar write | Create, edit, delete events | Booking tools that place meetings | A faulty integration can alter real events |
| Contacts read | Access your address book | Contact sync and CRM enrichment | Exports your network, including client details |
| Mail read | Read message content and attachments | Inbox assistants, support tools | The broadest request most teams ever approve |
| Mail send | Send messages as you | Sequencing and outreach tools | Messages leave your address, deliverability at stake |
| Drive full access | Read and edit every file | Backup and migration tools | Rarely necessary, often requested anyway |
| Drive file access | Access only files opened with that app | Editors and viewers | The safer alternative, worth preferring |
| Offline access | Keep acting when you are logged out | Background sync and scheduled jobs | Access continues until revoked or left unused |
Two rows drive most incidents. Mail read and Drive full access give a third party a durable copy of business information, and neither is reversible once the data has been read.
The Drive file row is the useful contrast. It shows a narrower option exists, which means a tool requesting the broad version has made a choice worth questioning.
The Question To Ask On The Consent Screen
The productive question is not whether you trust the company. It is whether the request matches the job the tool is being hired to do.
A meeting scheduler needs calendar access, and that fits. A meeting scheduler asking for mail read access does not fit, and the mismatch is the signal.
Vendor security posture matters too, particularly for anything touching customer data. Our explainer on what SOC 2 compliance means for small business software covers what those assurances do and do not tell you.
Trial software deserves extra care. Tools evaluated for two weeks and abandoned often keep their access for years, which is how most stale connections start. Google’s OAuth documentation says a refresh token stops working after 6 months without use, but a tool that keeps syncing in the background never reaches that limit.
What Happens To The Data After You Stop Using The Tool
Revoking access stops future data flow. It does not retrieve or delete anything already copied to the vendor’s systems.
This is the asymmetry that matters. Granting takes one click, and undoing it fully requires a deletion request under the vendor’s own policy and whatever privacy law applies to you.
Plan for it before signing up rather than after. Knowing where the deletion request lives is part of choosing the tool, and the answer belongs in the same note as the pricing.
Storage tools make this concrete, since they hold the files rather than a copy of them. Our comparison of Dropbox and Google Drive for business covers how each handles shared access.
Departing staff create the same issue in a different shape. An employee leaves, their account is suspended, and the tools they personally connected keep whatever they gathered.
Where Connected Apps Actually Cause Trouble
The realistic risks are duller than the ones people imagine, and they repeat across small businesses in three recognisable shapes.
The first is a vendor breach. A tool you connected two years ago is compromised, and whatever it could read becomes part of that incident. Narrow permissions limit the blast radius, which is the entire argument for granting them.
The second is the abandoned product. A company shuts down or gets acquired, and the access token keeps working while nobody is left to answer questions about the data.
The third is shadow connections. An employee signs up for a helpful tool, grants it access to their work mail, and no one else knows it exists until an audit or a departure surfaces it.
None of these require anyone to act badly. They happen through ordinary accumulation, which is why a periodic review beats trying to make perfect decisions at signup.
The pattern also explains why tool sprawl is a security question and not only a budget one. Fewer connected tools means fewer of all three failures. Our look at choosing an all-in-one suite versus a best-of-breed stack covers that trade-off.
Which Approach Fits Your Team
- ● Solo operators need a habit
- ● Growing teams need an admin policy
- ● Departures need an access review
A solo operator or freelancer: build one habit and skip the policy. Read the consent screen, prefer narrow permissions, and review your connected apps twice a year.
A team of three to ten: appoint one person to approve new tools before anyone connects them. An informal rule works at this size, and a shared list of approved tools prevents duplication.
A Workspace administrator: restrict third-party access to an approved list from the admin console. This turns individual judgement into a company decision and takes an afternoon to configure.
Any team handling client or customer data: treat mail and Drive access as a contractual question, not a convenience. Client agreements often restrict who may process their information.
Teams with a growing tool stack: run the access review alongside the subscription review, since the same tools appear in both. Our guide to auditing SaaS subscriptions and cutting wasted seats covers the wider clean-up.
Anyone offboarding an employee: check connected apps as part of the leaving process. Suspending the account is the obvious step, and reviewing what that account authorised is the one people miss.
A Review That Takes Fifteen Minutes
Open your Google Account security settings and find the third-party access section. It lists every app you have ever connected, with the permissions each one holds.
Work down the list and ask one question per entry: do we still use this? Anything unrecognised or unused should go, and removing access is immediate.
Pay attention to anything holding mail, contacts, or full Drive access. These deserve a decision rather than a glance, even for tools you still use.
Put a repeat in the calendar for six months’ time. The list grows quietly, and a short recurring review is the difference between a stack you control and one you inherited from your own past decisions.
The Habit Worth Keeping
Nothing here argues against using single sign-on. It remains the safer option compared with reused passwords across a dozen services.
The argument is for reading one screen. The consent dialogue is the only moment where you see the full request, and it is the cheapest place to say no.
For small teams, the practical rule is simple. Grant the narrowest permission that lets the tool do its job, and review the list before the list becomes a surprise.
That habit costs a few seconds per signup and removes most of the risk. It is a rare case where the careful approach is also the fast one.
If you administer a Google Workspace account, the same rule can be set once for the whole company instead of relying on each person’s judgement. Our walkthrough on blocking third-party apps in Google Workspace covers the API controls setting that allows sign-in while refusing mail and Drive access.
All of those grants hang on one Google password, so the account itself deserves a second lock. Our guide to enforcing 2-Step Verification in Google Workspace walks through the settings and a two-week rollout.
FAQ
Does signing in with Google give an app access to my email?
Not by itself. Basic sign-in only confirms who you are and shares your name, email address, and profile picture. The wider access happens when the tool also requests permission to read your mail, files, or calendar.
How can I see what permissions an app actually has?
The consent screen lists them, but the wording is vague by design. The reliable check is your Google Account third-party access page, which shows each connected app and the exact permissions it holds.
Can you revoke access to a connected app later?
Yes, and it takes under a minute from the same third-party access page. Removing access stops future data flow, but it does not delete anything the tool already copied to its own servers.
Can an administrator block employees from connecting apps?
Only a Workspace administrator can. Admins can restrict third-party access to an approved list, which prevents individual staff from connecting unvetted tools to company data.
Which permission requests should make a small business stop and check?
Read-only access to files and mail is the request worth pausing on, along with any tool asking for offline access it does not obviously need. Both allow data collection that continues long after anyone stops using the product.
Sources
- Google for Developers: Using OAuth 2.0 to Access Google APIs — checked 2026-10-01
Some links may be affiliate links. We may earn a commission at no extra cost to you.
How this article was made: it was drafted with AI assistance from the official sources listed above, and its figures were checked against those pages on the dates shown. It is not based on personal hands-on testing.
Comments
Post a Comment