OAuth grants and revocation

When an employee clicks "Sign in with Microsoft" or "Sign in with Google" and accepts the requested permissions, they give a third-party application access to the organization's data. The OAuth permissions page lists these grants, flags sensitive scopes and offers a recommendation for each application. Nothing is revoked automatically: revocation is a manual action and, by default, it is only simulated.

Where to find them

Open Access & identity, then OAuth permissions. Grants are collected at each scan of the active source, Microsoft 365 or Google Workspace. There are three tabs:

• By grant: one row per grant (application, person, permissions, grant date);
• By integration: one row per application, with its highest risk;
• By scope: one row per scope, with the number of applications and accounts that share it.

The type of consent makes a big difference to the real reach:

• User: granted by a person for themselves.
• Admin (delegated): granted by an administrator on behalf of the whole organization.
• Application: the application acts without a signed-in user. Disabling an account does not cut off this access.

Sensitive scopes

Each scope (called a "permission" in the console) is described in English on hover. The risk level of a grant reads as follows:

This level measures how powerful the permissions are, not whether they are relevant. In a grant's details, badges add facts: Application permissions, Organization-wide consent, Admin-only permissions, Many permissions (twenty or more), Verified publisher, Your own registration.

The OAuth risk analyst

The analyst answers a different question: do these permissions make sense for this application? A PDF converter that asks to read all email gets the same High level as a real email client; the analyst, however, flags the disproportion.

• Unit of analysis: an application with a set of permissions. A hundred employees who accepted the same permissions give a single verdict, and a new employee who accepts the same set does not start a new analysis.
• Verdict: a recommendation (Accept, Monitor or Revoke), a justification in French, the Permissions judged disproportionate and a confidence rate.
• What is analyzed: the application's name, the declared and verified publisher, the declared website, the type of consent, the number of people and the list of permissions. No employee name or email. The analysis is done by an AI model from Anthropic.
• When: every night, Sorvek analyzes up to 40 combinations per organization, starting with application permissions, then admin consents, then the applications with the most users. An administrator can also click Analyze to process everything that is waiting; the analysis continues if you leave the page.

Click a row to open the details: analysis, who gave the consent, permissions granted and accounts concerned. Ask sends a question to the person who consented; it only goes out if messaging to employees is armed. Notify me alerts you in the Sorvek inbox the next time someone consents to this application, or this person gives a consent.

Revoke a grant

Revocation is reserved for administrators. It can be granted to another person in Settings > Advanced permissions (see Roles and access).

1. In the By grant tab, click the trash icon on the row, or Revoke in the details.
2. Read the confirmation window: it shows the current mode, Simulation mode or Armed actions.
3. Click Revoke.

For several grants, check them, then click Revoke selection and Confirm revocation.

The double lock

A revocation is sent to the provider only if two locks are armed at the same time:

• the Platform switch, managed by Sorvek and not editable in the console, disarmed by default;
• This tenant's switch, which you arm in Settings > Destructive actions by typing exactly the sentence JE COMPRENDS QUE CES ACTIONS SONT IRREVERSIBLES.

If either one is disarmed, you are in Simulation mode: Sorvek calls neither Microsoft nor Google, the grant stays active, and the attempt is recorded in the Audit log as "Simulated action (no effect)". The Destructive actions page recommends arming only a lab tenant.

In armed mode, Sorvek asks the provider to delete the grant:

• Google Workspace: the deletion is carried out, and it is irreversible. The person will have to consent again to get the access back.
• Microsoft 365: the deletion requires a write permission that Sorvek does not request (see Requested permissions). Microsoft refuses it, the console shows a failure and the grant stays active. Remove it on the Microsoft side, from the enterprise application in Microsoft Entra ID.

For an Admin (delegated) consent, the grant deleted is the one for the whole organization, not only the one for the person shown.