GWS-K12-003: Students Cannot Authorize Third-Party Apps
- Platform
- Google Workspace
- Category
- K12 Baseline
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 8
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- original
- Scope
- OU-scoped: requires the -StudentOU input (or the Student OUs field in Show-Guerrilla). Without it, this check reports Not Assessed.
Guerrilla K12 Baseline (candidate)
This check assesses control K12-IDENT-001 of the K12 Secure Configuration Baseline, version 0.1.0, a candidate community baseline authored by Guerrilla. It is openly published and open for comment; it is not a consensus standard, and this block is deliberately separate from the external framework mappings below.
What it checks
A student clicking 'Sign in with Google' on an arbitrary website can grant that site access to their school account data unless the district restricts third-party API access for student OUs. Students should have no unconfigured third-party app access, or a district-curated allowlist only. This is one of the highest-leverage single settings in a school tenant.
Recommended value
Unconfigured third-party apps blocked (BLOCK_ALL_SCOPES) for student OUs; district-reviewed apps allowlisted individually
Remediation
Admin Console > Security > Access and data control > API controls > App access control > Manage Third-Party App Access. Select the student organizational unit, set unconfigured third-party apps to 'Block all third-party API access', and allowlist the specific apps the district has reviewed.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-policy | WARN |
| no-scope | Not Assessed |
| not-assessed | Not Assessed |
| ou-absent | Not Assessed |
| signin-only | WARN |
| uber-block | PASS |
Framework mappings
- NIST SP 800-53
- AC-3, CM-7
- MITRE ATT&CK
- T1528