How to Revoke Third-Party SaaS App Permissions in Microsoft 365?

Martin Snyder
Jul 15
2 min read

Modern IT teams face a growing, often invisible threat: third-party SaaS apps quietly connected to Microsoft 365 environments. These apps can access emails, calendars, OneDrive, and SharePoint—often with no oversight from IT. One overlooked integration can lead to unauthorized data access, compliance risks, or worse.

In this post, we'll show you why manual revocation methods fall short—and how Waldo Security helps you reclaim control.

The Manual Route: Using Microsoft Entra ID

Microsoft does provide tools to manage third-party app access through Microsoft Entra ID (formerly Azure AD). Here’s the manual process:

Access the Admin Portal: Sign in to Microsoft Entra ID and navigate to Enterprise Applications.
Hunt for the App: Identify the app you want to remove. This can be tricky—many apps have vague or misleading names.
Review Its Permissions: Some apps may request broad access, such as reading emails or modifying files.
Revoke Access: You can remove the app’s permissions—but that doesn’t stop employees from reconnecting it later.

The reality? This process is time-consuming, error-prone, and often reactive rather than preventive. Worse, if the app was authorized by a now-departed employee or unmanaged identity, removing access gets even trickier.

For more on how Microsoft handles third-party app access, see their official documentation.

The Smarter Option: Automated Protection with Waldo Security

Instead of playing whack-a-mole with every new app, Waldo Security gives you full visibility and control over your Microsoft 365 integrations. Here’s how:

Full SaaS Discovery: Waldo continuously scans your Microsoft 365 environment and uncovers all connected apps—including those set up outside of IT’s control. Learn more about SaaS discovery.
Automated Revocation: Remove app access at scale across your organization without manually checking every account.
Unmanaged Identity Coverage: Even if an app was installed by a personal or orphaned account, Waldo can cut off access and flag risk.
Ongoing Monitoring: Waldo keeps watch for new app connections, alerting your team to suspicious or unauthorized usage.

This proactive approach lets your team prevent threats—not just react to them.

Why This Matters More Than Ever

Most organizations underestimate the scale of shadow SaaS access. In fact, over 80% of employees admit to using apps that weren’t approved by IT. It’s not malicious—it’s convenient. But it creates massive risk.

Security teams can no longer rely on manual controls alone. As integrations grow, so does the attack surface. A smarter, more automated approach is critical.