Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTo inventory service accounts, API keys, and OAuth apps across a cloud environment, build three connected inventories from each platform’s native identity controls, usage telemetry, audit logs, and connected-app discovery. Record each object’s provider and parent scope, owner, privileges, age, and available last-use evidence; then investigate risky or unexplained entries before disabling or deleting them. No single inventory view in the sources covered here spans every credential type and provider.
What belongs in the inventory?
Keep three related categories distinct. They have different permission models and different evidence for deciding whether an entry is still needed.
As an Amazon Associate I earn from qualifying purchases.
- Workload identities and their credentials: service accounts, workload identities, role or federation relationships, and any user-managed keys attached to those identities.
- API keys: keys used to identify or authorize API requests. Do not mix these with encryption keys or physical authentication keys; those are different assets and are not substitutes for an API-key inventory.
- OAuth apps and related identities: app registrations, service principals, connected apps, and the grants or permissions through which an app accesses services or data.
Keep the parent context with every record. A service account key without its project, or an OAuth app without its identity platform and tenant or workspace, is difficult to assign, investigate, or safely revoke.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How do you build a repeatable inventory?
1. Define the environments you must cover
List the cloud organizations, accounts, folders, projects, subscriptions, and connected identity platforms in scope. Track collection status for each one, including gaps caused by missing permissions, disconnected environments, or unavailable telemetry. An inventory is only useful if reviewers can tell what it does not cover.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Collect objects from native control planes
For each environment, gather the identity objects and credentials that belong to the three categories above. Include federation and role relationships as well as static credentials: a cloud may have workload access that does not depend on a user-managed key, and the relationship itself matters when assessing access.
Use native controls for the object list, then enrich it with audit logs and usage telemetry. A creation record shows that an object exists; it does not establish whether a workload still relies on it. Similarly, an app listing may show permissions without proving that the app is actively using every permission.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Normalize the records without losing platform detail
Use a stable identifier from the source platform wherever available, and retain the original object type and scope. A practical record should include:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Platform, parent organization/account/project/tenant, object type, and stable object ID.
- Display name, accountable owner or team, and associated workload, integration, or business purpose.
- Roles, permissions, grants, privilege level, and any resource or data scope the source exposes.
- Creation date, expiry date if one exists, and the source’s last-use signal or its absence.
- Evidence source, collection time, review status, exception rationale, and remediation history.
For OAuth apps, also capture publisher, origin, permissions, data accessed, and available risk or privilege indicators. If the platform cannot provide a field, mark it as unavailable rather than treating it as zero risk.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Reconcile and review on a schedule
Compare each collection with the previous one to identify new objects, privilege changes, credentials approaching expiry, and records that disappear. Route unknown owners and high-impact changes for review. Schedule collection and owner attestations, preserve audit evidence, and track exceptions through closure rather than allowing them to become permanent blind spots.
Which platform signals can help find stale or risky entries?
| Platform and scope | Useful inventory or activity signal | What it does not establish |
|---|---|---|
| Google Cloud service-account keys; Cloud Asset Inventory search at organization scope | Google documents searching service-account key assets by creation time, using the asset type iam.googleapis.com/ServiceAccountKey and ordering results by createTime. See Google Cloud’s key-rotation guidance. |
Key age alone does not show whether a workload still depends on the key. |
| Google Cloud service accounts; insights and metrics are project-specific | Google documents insights for service accounts unused in the past 90 days and a Key Authentication Events metric for whether and how often a service-account key was used. See Google’s service-account key guidance. | These signals are Google-specific, must be reviewed per project, and do not make the 90-day insight a universal deletion rule. |
| Microsoft Defender for Cloud Apps; supported connected OAuth platforms | The Applications page can show Microsoft Entra ID service principals, Salesforce Connected Apps and External Client Apps, and Google Workspace OAuth apps, with metadata, publisher, origin, permissions, data accessed, and risk or privilege signals. See Microsoft’s Applications inventory documentation. | It is not a complete multi-cloud inventory of service-account keys or API keys. Microsoft says CSV export displays up to 1,000 SaaS or OAuth apps, so verify completeness for larger environments. |
Microsoft also documents a “New apps” insight for Microsoft 365 apps seen in the last 30 days. These Microsoft Learn pages do not show a publication year for the cited operational figures; treat them as documented product behavior and check the live interface for current availability.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should you prioritize what to investigate?
Start with the entries whose exposure or impact could be greatest, while treating a missing signal as a reason to investigate—not as proof of safety.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Unknown owner or purpose: identify the workload or integration before acting.
- Broad privileges or sensitive data access: compare granted access with the documented job the identity or app performs.
- Stale, old, or apparently unused credentials: check the platform’s activity evidence and confirm with the workload owner. An old creation date and an absence of recorded use are useful leads, not conclusive proof that a credential can be removed.
- Keys in source repositories or client-side code: prioritize exposure review and replacement. Google advises against putting API keys in client code or source repositories.
- Risky, unsanctioned, or unexplained OAuth apps: review the publisher, origin, requested permissions, and data accessed before restricting or disabling them.
- No documented workload need: seek owner confirmation and remove the credential or app if its need has ended.
How do you remediate without breaking workloads?
Prefer removing or replacing static credentials
Remove credentials that are no longer needed. Where supported, replace long-lived secrets with attached workload identities, roles, federation, or temporary credentials. For AWS workloads, AWS Well-Architected recommends a “remove, replace, and rotate” approach and using IAM roles or temporary credentials instead of long-lived IAM access keys where possible. That is AWS guidance, not a universal configuration recipe for other providers. See AWS Well-Architected SEC02-BP03.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For API keys, Google recommends restricting keys, deleting unneeded keys, monitoring use, and periodically creating replacements and deleting old keys. Avoid placing keys in client code or source repositories. Google warns that query-string keys can be exposed by URL scans and recommends the documented request header or a client library instead. Its guidance says most authorization keys should not be used in production, with a stated Gemini API exception. See Google Cloud’s API-key best practices.
Rotate Google Cloud managed service-account keys carefully
Google Cloud recommends routinely rotating managed service-account keys at least every 90 days, and immediately if compromise is suspected. This is Google’s recommendation for managed service-account keys, not a universal schedule for all providers or credential types; the cited documentation page does not display a publication year. Google also recommends using a more secure alternative to user-managed service-account keys whenever possible. See Google Cloud’s key-rotation guidance.
- Identify the affected key and the applications or workloads that use it.
- Create a replacement key and update the dependent applications.
- Disable the old key, then monitor for failures or unexpected use.
- Delete the old key after the replacement has been verified.
For a key that appears unused but whose dependencies are uncertain, correlate activity evidence and contact the workload owner before revocation. Google advises disabling keys as soon as they are no longer needed and deleting them when the need has ended; its key-management guidance describes insights for accounts unused in the past 90 days and key authentication metrics, with review performed separately for each project. See Google’s best practices for managing service-account keys and its secure service-account practices.
What makes the inventory trustworthy over time?
Use a recurring process rather than a one-time export. The collection should record its coverage and gaps, preserve evidence, and make it possible to trace an object from discovery through owner review and remediation. For connected-app exports, account for product limits: the documented Microsoft CSV cap of 1,000 apps means a single export may not represent a larger inventory. For Google Cloud usage evidence, collect and review each project rather than assuming one project’s metrics cover the organization.
Quick Recap
- Alert on newly discovered identities, high-privilege permissions, and unexpected app connections.
- Review stale credentials and ownerless records with the relevant team before removal.
- Keep an exception register with an owner, rationale, review date, and compensating controls.
- Track disablement and deletion as separate states where the platform supports staged removal.
- Retain audit logs and remediation evidence so later reviewers can distinguish an intentional exception from an overlooked credential.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
