To remove an outside app from your email, open your provider’s account-security or connected-apps controls, identify the app and the data scope it was granted, then revoke that authorization or delete the app password it uses. Revocation stops that authorization from being used again, but it does not necessarily erase information the app already copied. If the connection is unfamiliar, review devices, sign-in activity, forwarding rules and mailbox filters as possible signs of compromise.
The exact control depends on the provider and account type. Google exposes linked-app authorizations for a Google Account, Yahoo documents an External connections and App passwords path, and Microsoft’s published workflow is for Microsoft 365 work or school tenants. Do not assume that an enterprise administrator screen applies to a personal Outlook.com, Hotmail or Live account.
As an Amazon Associate I earn from qualifying purchases.
What “third-party access” means
A third-party connection is an authorization that lets an outside application act on data in your email account or in related services. It is different from an app merely being installed on your phone or computer. The provider records the account-level permission, and you can usually remove it without uninstalling the app.
Free tools Windows power users keep installed
One-click scans. No signup required.
Google explains that linked apps can request access to Gmail and other Google products, including Drive, Calendar, Photos and Contacts. Before authorization, Google shows the data and services requested. The scope determines what the app can do: a permission may allow reading or copying data, or management actions such as editing, creating or deleting account data. A familiar-looking name is not enough; inspect the actual scope.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For example, an app that only needs to display a calendar should not automatically need permission to read all Gmail messages or delete files in Drive. A broad scope may be legitimate for a backup, migration or productivity service, but it deserves a more deliberate decision than a narrow sign-in permission. Also check the developer identity, not just the brand name displayed by the app.
Do not give an outside app your Google Account password. Google warns that sharing the password can grant full account access and put the account at risk. The linked-app authorization flow is safer because it limits access to the services and data you approve. See Google’s explanation of access shared with third-party apps.
Provider differences at a glance
| Provider and account type | Where to find connections | How removal works | What you can inspect | Important boundary |
|---|---|---|---|---|
| Google Account, including Gmail | Google’s linked-app or third-party-connections control, reached from the Google Account help and security pages. | Remove the linked app’s authorization. | Requested Google services and the data scope granted to each app. | Google says the app can no longer use that authorization after removal, but data already copied may remain with the developer. |
| Yahoo consumer account | Account Security, under External connections. | Yahoo’s documented route is to open App passwords, select the relevant app password and delete it. | The connected app or credential listed there; the cited Yahoo instructions do not establish a universal OAuth-scope display for every app type. | Treat this as Yahoo’s documented app-password route, not a guarantee that every external connection uses the same mechanism. |
| Microsoft 365 organizational account | myapps.microsoft.com for a user’s assigned applications. | Inspect the application’s privileges and revoke them. An administrator can remove an illicit assignment in the Microsoft Entra admin center. | Application access scope; administrators can also investigate assignments and audit records. | These instructions apply to Microsoft 365 organizations. They do not establish the current user-facing path for personal Outlook.com, Hotmail or Live accounts. |
The comparison matters because “remove the app” can mean different things. Google’s action revokes an authorization grant. Yahoo’s documented action deletes an app password, which is a credential rather than a universal OAuth consent record. Microsoft 365 separates what an end user can do in My Apps from what a tenant administrator can remove or investigate. Use the control that corresponds to your account, and do not substitute a different provider’s menu path.
Before you revoke: make a short record
If the app is merely obsolete, you can usually revoke it immediately. If it is unknown or associated with suspicious mail, first record the details while they are visible. Note the app name, publisher, requested services, permission wording, dates, unfamiliar devices, forwarding addresses and unusual rules. A screenshot or written note can help an administrator, the provider or the developer investigate later.
Do not click a “review access” button in an unexpected security email. Type the provider’s address yourself or use a bookmark. The joint advisory issued by the FBI, U.S. Cyber Command’s Cyber National Mission Force, the U.S. Treasury and the UK National Cyber Security Centre on September 27, 2024, recommends direct sign-in for reviewing alerts because a message link can be spoofed.
Review and revoke access in a Google Account
1. Open the account controls directly
- Sign in to the Google Account that owns the Gmail mailbox. If you use several accounts, verify the profile or account address before changing anything.
- Open Google’s official linked-app access instructions and follow the link to the account’s third-party or linked-app list. Google changes navigation labels periodically, so use the account page reached from the official help rather than relying on an old screenshot or an email link.
- Review every listed app, not only the one that prompted your concern. Record the app name, developer identity if shown, last-use information if shown, and the services it can reach.
2. Read the permission scope before deciding
Open an app’s details and distinguish a narrow permission from a management permission. A Gmail-reading or copying scope can expose message content and attachments. A management scope can permit changes to account data, including creating, editing or deleting items where the authorization allows it. Access to Drive, Calendar, Photos or Contacts can matter even when the app’s purpose appears unrelated to email.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Ask three questions for each entry:
- Do I recognize the app and the developer?
- Do I still use the feature that required this access?
- Is the requested scope proportionate to that feature?
An app you no longer use, an entry with an unfamiliar developer, or a scope broader than the feature needs is a reasonable candidate for removal. Do not approve a replacement request merely because it looks like a routine sign-in; read the new scope first. A vendor may have changed its requested permissions since you first connected it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall3. Remove an authorization you no longer trust
- Select the app’s details in the linked-app list.
- Choose the control to remove or revoke access and confirm the warning.
- Return to the list and verify that the entry no longer has an active authorization. If the app immediately asks for access again, do not approve it until you have confirmed why it needs the permission.
Google’s documented effect is specific: after removal, the app can no longer access the account data through that authorization. Revocation is not a remote “delete my data” command. The app may have retained information it copied while access was active, so contact the developer separately if you want previously accessed data deleted; Google says that request may be necessary. Ask what categories of data were stored, the account or tenant associated with them, and how deletion will be confirmed.
4. Check related Google access when the app was unexpected
If you found an unknown connection, do not stop at the app list. Review signed-in devices, recent account activity, mail forwarding and filters, and other linked accounts. Those checks can reveal a broader intrusion or a rule that continues to hide or export messages even after an app authorization is revoked.
Pay particular attention to filters that automatically archive, delete, mark as read or forward messages, and to forwarding addresses you did not add. An app grant and a mailbox rule are separate mechanisms: removing one does not remove the other.
Review Yahoo Mail connections
Use Yahoo’s External connections and App passwords path
- Sign in to the Yahoo account directly and open Account Security.
- Find External connections and identify the app or service that should no longer connect.
- Open App passwords, select the relevant app password and delete it, following Yahoo’s documented removal instructions.
- Sign out of the account controls and check the list again to confirm that the credential is gone.
Yahoo’s help describes this app-password procedure as its route for removing an external connection. It should not be treated as a universal OAuth control for every kind of application; the exact entry and available details depend on how the service authenticated. If an entry does not have an app-password record, do not invent a different deletion path based on Google or Microsoft instructions. Use Yahoo’s current Account Security help or support channel.
If Yahoo shows suspicious security activity or an unfamiliar connected app, its guidance says to change the account password immediately. Use a new password that is not reused elsewhere, then revisit Account Security to confirm that the unexpected credential or connection has been removed. Yahoo’s documented instructions are summarized in Find and remove unusual activity on your Yahoo account.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Password replacement and app-password deletion address different credentials. Changing the main password may not automatically remove a separately issued app password, so complete both checks when Yahoo identifies an unfamiliar connection.
Microsoft 365 organizational accounts
Microsoft’s published procedure is for work or school Microsoft 365 tenants, not a general consumer Outlook.com tutorial. A personal Outlook.com, Hotmail or Live account may expose different controls; the organizational administrator steps below should not be applied to it.
What an organization user can do
- Go directly to myapps.microsoft.com and sign in with the organizational account.
- Open the application that concerns you and inspect its permissions or scope. Look for access to mail, files, contacts, calendars or other services that the app does not need.
- Use the available control to revoke the app’s privileges or remove your consent, then confirm that the application no longer appears as an active connection.
- Tell your organization’s security or IT team if the grant was unexpected, affected sensitive mail, or cannot be removed from the user view.
What an administrator can investigate
Microsoft says an administrator can open the user’s Applications page in the Microsoft Entra admin center, review the user’s application assignments and remove an illicit assignment. The same guidance describes organization-wide PowerShell inventory and audit-log investigation; those operations require administrator privileges and are not steps for an ordinary mailbox user.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFor a suspected illicit consent grant, an administrator can investigate the Microsoft Purview audit log for affected users, the relevant time window and the app permissions involved. Microsoft notes that the required mailbox and activity auditing must have been enabled beforehand, so an absence of records does not prove that no event occurred. Administrators should preserve the app identifier, affected accounts, time window and permission scope before remediation where practical.
Removing an assignment may stop the organization’s authorization, but it does not by itself prove that messages or files already read by the app were deleted. The security team should assess whether the app accessed sensitive information and follow the tenant’s incident-response and data-retention procedures. The full organizational procedure is in Microsoft’s guidance on detecting and remediating illicit consent grants.
What to check when a connection looks like compromise
An unknown app is a warning sign, not a complete diagnosis. The September 27, 2024 joint advisory from the FBI, U.S. Cyber Command’s Cyber National Mission Force, the U.S. Treasury and the UK National Cyber Security Centre lists “Connection of unknown devices, applications, or accounts to a victim account;” among indications of successful compromise. It also identifies mail-handling rules that forward messages or hide security notifications, message exfiltration or deletion, and attempts to reach other victim accounts. Read the joint cybersecurity advisory for the original warning.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A practical inspection order
- Use a direct sign-in. Type the provider’s address yourself or use a bookmark. The advisory recommends signing in directly to review alerts instead of following a link in an unexpected security message, which could be spoofed.
- Capture the evidence. Note the app name, developer, permission scope, dates, unfamiliar devices, forwarding addresses and suspicious rules before deleting entries. This gives your administrator or the provider something concrete to investigate.
- Revoke the outside connection. Use the Google, Yahoo or Microsoft 365 procedure appropriate to the account type. Do not authorize the app again merely to test whether it is legitimate.
- Inspect device sessions and account activity. Look for devices, locations or sign-ins you do not recognize. Remove or sign out of sessions using the provider’s own controls.
- Inspect forwarding and mail rules. Delete unauthorized forwarding addresses and rules that archive, delete or redirect security notices. A rule can continue exposing mail after an app authorization has been removed.
- Review other linked accounts. Check connected services and accounts that could be reached through the mailbox, especially if the suspicious app had a broad scope.
- Change credentials through the provider’s recovery controls. For Yahoo, its guidance specifically calls for an immediate password change when activity or connected apps look suspicious. Other account types may require the organization or provider’s incident process.
- Escalate organizational incidents. In Microsoft 365, notify the tenant security team so administrators can review assignments and Purview records. A normal user cannot substitute for that investigation.
Why revocation is only one part of the response
Third-party authorization is one access path. A stolen password, an active device session or a hidden forwarding rule can remain after the app is removed. Conversely, deleting an app password does not establish that no copied messages remain with the service. Treat the permission review, session review and mailbox-rule review as separate checks with separate results.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Google Workspace authentication change
Google Workspace guidance states that, beginning May 1, 2025, Workspace accounts no longer support third-party apps or devices that sign in using only a username and password; OAuth is required. This changes the authentication method for Workspace users. It does not make every OAuth-connected app trustworthy: you still need to inspect the app identity and the scope it requests before granting access or leaving it connected. The official reference is Google Workspace’s third-party email-client guidance.
This date is a Workspace authentication requirement, not a promise that every consumer account has identical controls. If a work or school administrator has restricted app consent, contact that administrator rather than trying to bypass the organization’s policy.
Optional follow-up: strengthen sign-in protection
After the access review, consider a FIDO2-compatible hardware security key if your provider, organization and devices support it. The 2024 joint advisory recommends considering hardware security keys as an account-protection measure. A key can strengthen sign-in against password theft, but it does not list, inspect or revoke third-party app permissions.
Compatibility is specific to the account and device: verify the provider’s supported sign-in methods, the operating systems and browsers you use, and whether your organization permits security keys before buying one. No particular model is required for the review-and-revoke process. Keep an approved backup sign-in method if your provider or organization requires one, and enroll the key through the provider’s official security settings rather than through an unsolicited message.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Decision checklist
- Recognized and still needed: Keep the connection only after confirming that the developer and scope match the feature you use; review it periodically.
- Recognized but no longer needed: Revoke it. Removing unused access reduces the number of active paths into the mailbox.
- Unknown or over-privileged: Revoke it without reauthorizing, then inspect devices, activity, forwarding and rules.
- Suspicious activity or message manipulation: Sign in directly, preserve details, follow the provider’s recovery controls and involve your organization or the provider’s security process.
- Copied-data concern: Ask the developer to delete data it previously accessed; revocation alone does not make that request for you.
- Unable to remove an organizational grant: Give the app name, scope, account, dates and screenshots to the Microsoft 365 security or IT team so an administrator can inspect assignments and audit data.
Frequently Asked Questions
How do I remove third-party access to my email?
Sign in directly to your provider, open its connected-app or account-security controls, inspect the app’s identity and permissions, and revoke the authorization. For Yahoo, the documented route is Account Security > External connections > App passwords, then delete the relevant app password. Microsoft 365 work or school users can review applications at myapps.microsoft.com; administrators may need to remove an assignment in Microsoft Entra.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Does revoking access delete emails the app already copied?
No. Revocation stops the app from using that authorization in the future. Google warns that an app may retain data it copied while access was active, so contact the developer and request deletion separately.
What should I do if I do not recognize an app?
Record its name, developer, scope and dates, then revoke it without signing in again through the app. Review devices, recent activity, forwarding addresses, mail filters and other linked accounts. Change credentials or follow your organization’s incident process if activity is suspicious.
Can I use Microsoft 365 admin instructions for Outlook.com?
Not based on the published guidance covered here. The Microsoft procedure is for organizational Microsoft 365 tenants. Personal Outlook.com, Hotmail and Live accounts may have different controls.
Is a hardware security key required to revoke app access?
No. A FIDO2-compatible key is an optional sign-in-protection measure. It can help protect against password theft but does not inspect or remove third-party permissions, and compatibility should be checked before purchase.
The Bottom Line
Review connected apps at the provider level, read the exact scope, and remove authorizations you no longer need or trust. Then check devices, account activity and mail-forwarding rules—especially when an unknown connection appears. Revocation blocks future use of the authorization, but only the developer can address data already copied.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
