Google Workspace OAuth app access management
Google Workspace accounts can be connected to third-party applications through OAuth: a tool asks for access to mail, calendar or files, someone approves it, and the tool keeps that access afterwards.
Those authorizations matter because they are a form of standing access to organizational data that exists independently of who can currently sign in. They accumulate through ordinary use and are removed only when somebody explicitly revokes them.
Solvantra connects to Google Workspace to discover the OAuth app grants attached to accounts in the tenant and to revoke them through the Google API when an administrator authorises it. It is one integration among several — the integrations page lists the full set and each one’s status.
OAuth app access is not the same as Workspace administration
This distinction shapes everything else on the page, so it is worth drawing clearly.
Google Workspace administration is the management of the tenant itself: creating and suspending users, assigning licences, configuring organizational units, setting security policy, managing groups and shared drives. That is done in the Google Admin console, by your administrators.
OAuth app access is the separate layer of authorizations that third-party applications hold against accounts in that tenant. A grant is created by consent, not by provisioning, and it survives independently of most administrative changes to the user.
Solvantra works on the second layer only. It is not a Google Workspace replacement, not an administration console, and not an SSO provider. Your Google Workspace tenant continues to be administered exactly as it is today.
What Solvantra discovers
OAuth app grants
The third-party application authorizations connected to Google Workspace accounts in the tenant — which applications hold access, and to which accounts.
SaaS spend from receipts (limited)
Receipt-email discovery through the Gmail API is implemented, but it currently covers only the mailbox of the administrator who connected Google Workspace. Scanning other employees’ mailboxes would require additional Google Workspace configuration that is not yet supported, and receipt discovery has not been verified in production. OAuth app grant discovery does not depend on it.
Discovered grants feed the same review workflow described on the OAuth access management page: flagged with the reason attached, then revoked by an administrator or, in Live mode, by the HRIS termination workflow.
What Solvantra can revoke
Solvantra can revoke OAuth app grants in Google Workspace through the provider API.
Revoking a grant removes the third-party application’s authorization against the account: the application loses the access it was given. It is precise about its target, and equally precise about what it leaves alone — the Google user account itself is untouched. Suspending or deleting a Google Workspace user remains an action for your administrators in the Admin console.
Revocation runs through a defined workflow that an administrator controls: the administrator decides whether the HRIS workflow is enabled and which mode it runs in. In Live mode, an administrator’s decision to enable the workflow authorizes automatic revocation of already-flagged grants when a termination event arrives. Dry-run shows what would be revoked first. Solvantra does not hold unrestricted autonomous access to the tenant.
Limitations that apply today
- Discovery connects through a standard Google OAuth consent flow. Revocation currently requires an administrator to supply a separate refresh-token credential.
- Discovery covers OAuth-connected applications. Password-only accounts, with no OAuth relationship to the tenant, are not discovered through this integration.
- Revocation removes the OAuth grant, not the underlying Google user account.
- Google Workspace discovery has been verified against a real production connection. Revocation has been tested against simulated provider responses only, and no customer deployment is live yet.
- Solvantra does not manage Google Workspace users, licences, groups, organizational units or security policy.
A typical workflow
1. Connect
An administrator connects the tenant through a standard Google OAuth consent flow, which lets Solvantra read its app grants. Revocation additionally requires the administrator to supply a separate refresh-token credential.
2. Discover
Solvantra enumerates the OAuth app grants attached to accounts in the tenant, and looks for receipt emails in the connecting administrator’s own mailbox.
3. Review
Grants that may no longer be needed — for instance, one tied to a departed employee — are flagged for an administrator to look at.
4. Revoke
Grants are revoked through the Google API when an administrator revokes them or, in Live mode, automatically when a signed termination event arrives for an already-flagged grant. The workflow records what was acted on.
Common questions
Does Solvantra replace Google Workspace administration?
No. Solvantra works on the layer of OAuth application authorizations held against accounts in the tenant. Creating, suspending and licensing users, and configuring policy, remain administrative tasks in the Google Admin console.
What does Solvantra revoke in Google Workspace?
OAuth app grants, through the provider API. Revoking a grant removes the third-party application’s authorization against the account; the Google user account itself is not deleted or suspended by that action.
How does Solvantra connect to Google Workspace?
Discovery connects through a standard Google OAuth consent flow. Revocation currently requires an administrator to supply a separate refresh-token credential. Discovery has been verified against a real production connection; revocation has been tested against simulated provider responses only, and no customer deployment is live yet.
Related reading
See which applications hold access to your Google Workspace tenant.
Start with a free assessment, or talk to us about connecting a tenant.