ADMIN-020: Access to unconfigured third-party apps blocked (GWS.COMMONCONTROLS.10.4)
- Platform
- Google Workspace
- Category
- Admin & User Management
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.COMMONCONTROLS.10.4 requires that users SHALL NOT be allowed to access unconfigured third-party apps, because an app that has not been explicitly reviewed can request broad OAuth scopes and become a data-exfiltration or account-takeover path. This check reads the api_controls.unconfigured_third_party_apps Cloud Identity policy and flags any organizational unit whose access level is not BLOCK_ALL_SCOPES (the value that blocks all access to unconfigured apps).
Recommended value
Access level for unconfigured third-party apps set to BLOCK_ALL_SCOPES in all organizational units.
Remediation
In the Google Admin console, under Security > API controls > App access control, set unconfigured third-party apps to 'Blocked', so users cannot grant any access to apps that have not been explicitly configured and reviewed.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.COMMONCONTROLS.10.4v1
- NIST SP 800-53
- AC-3, AC-6