Free · Read-Only · Nothing Stored
Shadow AI & OAuth App Exposure Check
Connect with a read-only, revocable permission and see every third-party app and AI tool with OAuth access to your tenant, flagged by risk. Everything runs in your browser — nothing is sent to or stored on our servers.
Before you connect: this check needs a one-time admin consent in your tenant
(your own IT/security admin approves the read-only scopes below — this app never asks for
write access). If you're not a tenant admin, forward this page to whoever is.
Microsoft 365
Lists every app with delegated OAuth access across your tenant, via Microsoft Graph.
Application.Read.All
DelegatedPermissionGrant.Read.All
Google Workspace
Lists every third-party app token granted by users in your domain, via the Admin SDK.
admin.directory.user.readonly
admin.directory.user.security
RB Cybersecurity Consulting
Shadow AI & OAuth App Exposure Report
—
—
This is an automated, heuristic scan of OAuth permission scopes — it is not a certified
security assessment. Risk levels are based on scope breadth and publisher verification
status only. For a full assessment aligned to NIST CSF 2.0, contact RB Cybersecurity
Consulting at rbcyberconsulting.com.