Confirm your third-party app settings by October 23, 2023

This feature is only available with Google Workspace for Education editions.

With app access control settings, you control which third-party apps your users can sign in to with their Google Workspace for Education Account, and the data those apps can request. Learn how apps can request data

Because third-party app settings are important to protecting users’ data, we’re asking Google Workspace for Education admins to review and confirm their current settings are up to date by October 23, 2023. Starting October 23, 2023, users designated as under 18 won't be able to access third-party apps you haven't confirmed access settings for.

Google Workspace for Education Admin Console: How to review existing configured apps

Overview

To help you complete this process, we’ve gathered settings you need to confirm into a single guided experience. We’ll take you through steps to review and confirm the following:

Setting for unconfigured third-party apps for users designated as under 18.
You can choose whether users designated as under 18 are blocked entirely from all unconfigured apps, or whether they can sign in to unconfigured apps that request just the basic info required for signing in with Google.
Access settings for configured third-party apps.
Starting October 23, 2023, users designated as under 18 won't be able to sign in to third-party apps you haven't confirmed.

Get started early and plan ahead. You don’t need to finish this in one sitting. You can navigate around, and changes you make along the way are saved. Keep in mind the following factors:

Number of apps
Depending on your setup, your institution may have a large number of apps to confirm settings for.
Involvement of other stakeholders
As part of the process, you also may need to consult with:
- Other Google Workspace admins and IT staff at your institution, who help manage app access settings and update workflows and processes.
- Teachers, project managers, or tech education specialists, who can advise which apps students need access to, what type of consent may be needed from parents/legal guardians and whether that consent has been gathered, what needs to be communicated to your teachers and students, and more.

Since this could take time, consider planning ahead to avoid disruptions for students. Starting October 23, 2023, users designated as under 18 will not be able to access any third-party apps that remain unconfirmed.

As a reminder: For users under the age of 18, your organization is responsible for obtaining parental consent, if required by applicable law, before allowing these users to access third-party apps.

Get started in the guided experience

Note: The following pages will be available for super admins and admins with the Security privilege.

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
To get started, go to the intro page of the guided experience.
Click Continue to view the first step, Confirm settings for unconfigured third-party apps.

Confirm setting for unconfigured third-party apps

In this step, you’ll see the Unconfigured third-party apps setting for users under 18. This controls what happens when users under 18 try to sign in to an unconfigured third-party app with their Google Account.

Note: You can also view this setting in SecurityAccess and data controlAPI Controls. Any change you make in the guided experience will be reflected in API Controls automatically, and you can also change the setting there anytime.

Choose an option:
- Don’t allow users to access any third-party apps (Default setting)
  Users under 18 can’t sign in to any unconfigured third-party apps. If a user under 18 tries to sign in to an unconfigured third-party app with their Google Account, they’ll be blocked, but have the option to request access. You’ll be notified about this request in the Admin console, and if appropriate, can configure settings for the app so the user can access the app.
- Allow users to access third-party apps that only ask for Google sign in info
  Users under 18 can sign in to an unconfigured app if it requests only basic profile information required for signing in with Google - their Google Account name, email address, and profile picture, if any. Users under 18 can’t sign in to an unconfigured app if it requests access to any more info (for example, access to Google Drive files) - though they can still request access, as described above, and you can configure settings to allow access.
  
  Learn about settings for unconfigured apps
If you change the setting to the second option - Allow users to access third-party apps that only ask for Google sign-in info - you’ll need to confirm your selection.
As a reminder: For users under the age of 18, your organization is responsible for obtaining parental consent, if required by applicable law, before allowing these users to access third-party apps.
Click Next to go to second step, Confirm settings for configured third party apps.

Confirm setting for configured third-party apps

In this second step, you need to review and confirm access settings that have already been configured for third-party apps. An app’s access setting determines whether users can sign in to the app with their account, and which data the app can request from the user’s Google account.

IMPORTANT: Before October 23, 2023, confirm access settings for any third-party app users under 18 will continue to need. Starting October 23, users under 18 can no longer access third-party apps that aren’t marked confirmed.

As a reminder, for users under the age of 18, your organization is responsible for obtaining parental consent, if required by applicable law, before allowing these users to access third-party apps.

Review the apps and their settings in the Access (for top-level org unit) column.
Note: In the guided experience, the Access column only shows the setting for your top-level org unit. This is the setting that applies for all users, unless you’ve configured different settings for sub-org units. If you’ve configured different settings for sub-org units, you’ll see an icon next to the app name. Click the app name to see which org units have different settings.
To confirm access settings for apps, select the app(s), then click Confirm access setting at the bottom.
(Optional) To change access settings for apps before confirming, select the app(s) and click Trust, Limit, or Block at the top. Access setting changes you make in the guided experience will be automatically reflected in Configured apps (under SecurityAccess and data controlAPI ControlsApp access control), and you can also change the setting there anytime.
Review the confirmation information, then click Confirm.
If you’ve confirmed access settings for all of your configured apps, you’ll see a final message that says “You’re all set!” If you choose to confirm settings for just a subset of apps, you won’t see that final message. That’s ok - just make sure to double-check apps in both the Unconfirmed and Confirmed lists.
- For Unconfirmed apps—Starting October 23, 2023, users under 18 will no longer be able to use their accounts for apps that remain unconfirmed.
- For Confirmed apps—Starting October 23, 2023, these are the only third-party apps that users under 18 will be able to access with their accounts.

If you’re satisfied with the apps that appear in both lists, you’re all set.

Tips for reviewing this apps list

If you know which apps your students need, consider searching for apps using the Search for app box in the top right. You can then review and confirm access settings just for those apps.
You can filter the table by Access, so you can review apps with a specific access setting like trusted, limited, or blocked.
If you want to download this list to review and share with others, go to the Configured apps list under SecurityAccess and data controlAPI ControlsApp access controls. Click Download list at the top. Just note that this downloaded list may not have the same columns. In particular, the Access column will show the number of org units that have access settings configured, rather than just the access configured for the top-level org unit.

Tips on selecting apps

Select individual apps by clicking the checkbox next to each app name.
Select all apps on the current page by clicking the box next to App name in the top left.
Select all the configured apps by clicking Select apps on all pages in the upper right.
If you’ve filtered your table, you can still select individual apps, all apps on the page, or all configured apps that match the filter using the same approach.

Once you take one of these steps and confirm apps, the apps will move from the Unconfirmed app list to the Confirmed app list. You can check these lists as you go to check progress.

FAQs: Confirming setting for unconfigured third-party apps

Expand section | Collapse all

What are configured vs. unconfigured third-party apps?

In the Admin console, you can configure a third-party app access setting as Trusted, Limited, or Blocked. Learn about configuring access settings

Configured apps are third-party apps with an access setting (trusted, limited or blocked).

Unconfigured apps are third-party apps that aren’t configured with an access setting (trusted, limited, or blocked).

How does this affect configured apps?

Changing settings for unconfigured third-party apps doesn’t change user access for any configured apps (apps that already have a trusted, limited, or blocked setting). This affects which unconfigured apps users can access with their account, going forward.

What info could third-party apps ask for?

When a user uses the Sign in with Google feature to access third-party apps, the app always requests access to basic Google sign-in info, which is required for allowing sign-in with Google. Google sign-info consists of the user’s name, email address, and profile picture, if any.

In Settings for unconfigured apps, if you choose Allow users to access third-party apps that only ask for Google sign-in info, you’re allowing users under 18 to sign in with Google to any app that asks just for this level of information.

But to enable certain features, a third-party app might request further access to data within different products in a user’s Google Account, like their Gmail, Drive, Calendar, and more. For example, a third-party scheduling app might request access to a user’s Calendar data to unlock helpful app features. Learn more about how data is shared

Note: Users under 18 are never allowed to sign in to an app that asks for more than the basic level of information unless you’ve configured an appropriate access setting for the app.

Tip:

To check which data an app has previously requested from Google users, use the following steps:

Sign in to your Google Admin console.
Sign in using an account with super administrator privileges (does not end in @gmail.com).

You must have security privileges for this task.
On the home page, find the App Access Control card, and click Review apps.
Under Requestable services, you’ll see which data that app has previously requested from Google users.

What can I expect with each option?

In Settings for unconfigured apps, if you select Don’t allow users to access any third-party apps, users under 18 can’t sign in to any unconfigured third-party app and must request access for all unconfigured apps they want to use.

In Settings for unconfigured apps, if you choose Allow users to access third-party apps that only ask for Google sign in info, users under 18 only need to request access to an app if the app asks for more than the basic info required for signing in with Google (name, email, and profile picture, if any). You’ll need to review just those apps that ask for more data, and if appropriate, configure access for them.

Learn about settings for unconfigured apps

How do users under 18 request access to an app? How am I notified?

When a user under 18 tries to sign in to an unconfigured third-party, they get a message that access is blocked. The user can then request access.

In the App access control card on your Admin console homepage⬀, you can see the number of apps users requested by clicking Review apps. At Apps pending review, you can configure access settings for apps you want to make accessible to users under 18. Learn about settings for unconfigured apps

What third-party apps require an access policy configuration by admins and/or require admins to confirm?

All third-party apps that a user designated as under 18 uses with their Google Workspace for Education accounts are impacted by this change. Admins are required to confirm the access policy for users designated as under 18 to continue to use those apps with their Google Workspace for Education account. If the third-party app is used with a non-Google Workspace for Education account, it is not impacted by this change.

FAQs: Confirm settings for configured third-party apps

Expand section | Collapse all

Can I change access or confirm settings for multiple apps at once?

In the guided experience:
You can change access for multiple apps with these steps.

Select multiple apps at once. Learn how to select multiple apps
At the top, click Trust, Limit, or Block.
Review information in the Confirm app access setting box, then click Confirm.
Note: You can also change access settings for multiple apps using the bulk update feature on the Configured apps page in the Admin Console. Access setting changes you make using bulk update will be reflected in this guided experience automatically. When you update settings using bulk update, you still need to confirm the settings. Learn how to change settings in bulk

You can confirm settings for multiple apps with these steps:

Select multiple apps at once. Learn how to select multiple apps
Review information in the Confirm app access setting box, then click Confirm.

What if I configured different settings for an app based on organizational unit?

The Access (for top-level org unit) shows the app’s access setting for your top-level org unit. If you configured different settings for other sub-org units, you’ll see an icon next to the app name. To see which sub-org units already have access settings configured for the app, click the app name.

If you make any changes to access settings in the guided experience, they apply only to your top-level organizational unit. Settings you previously configured for sub-org units won’t get overridden.

What do trusted, limited, and blocked mean?

Here’s what each means:

Trusted—Users can sign in with Google to the third-party app, and the app can request access to all Google data (both restricted and unrestricted Google services).
Limited—Users can sign in with Google to the third-party app, and the app can request access only to unrestricted Google data.
Blocked—Users can’t sign in with Google to the third-party app, and the app can’t request access to any Google data.

What are restricted and unrestricted Google services?

This is up to you, depending on which services are set as restricted and unrestricted on the Google services page. You might select Restricted if data for a Google service is more sensitive and you want to allow only a small number of apps - apps marked Trusted - to request access to data for that Google service. Or, you might select Unrestricted if data for a service is less sensitive, and you want to allow more third-party apps - apps marked Trusted and Limited - to request access to data for that Google service. Learn more about managing Google service access.

Example

Let’s say in the Google services page you marked:

Gmail and Drive as Restricted
All other apps (like Calendar, Chat) as Unrestricted

This means:

Apps you configure as Trusted can request user data from all Google services, including Gmail and Drive.
Apps you configure as Limited can request user data from all Google services on that page except Gmail and Drive.

Can I change access settings for apps in the guided experience?

Yes.

Select apps to change access settings for.
Click Trust, Limit, or Block in the upper right.
Review information in the Confirm app access setting box, then click Confirm.

Access setting changes you make here will automatically be reflected in the Configured apps page, and can always be changed again there.

What happens to apps I don’t confirm?

Users designated as under 18 will not be able to sign in to any apps you leave unconfirmed after October 23, 2023. Make sure to confirm apps your students need before that date.

How do I download this list?

To download your list of configured apps to review and share with others, go to Configured apps under SecurityAccess and data controlAPI ControlsApp access controls. Click Download list at the top.

Note: The downloaded list might not have the same information as the list in the guided experience. In particular, the Access column will show the number of organizational units that have had access settings configured, rather than the access configured for the top-level organizational unit.

How are users over 18 affected by this process?

For users designated as over 18, access to third-party apps isn’t affected by this process, unless you make changes to app access settings at the top level org unit (for all users). If you don’t confirm app access settings for a third-party app, users over 18 can continue to access them as usual. Only users under 18 will be blocked.

How do you know which users are under 18?

In age-based access settings, you can specify which organizational units have users under 18. When you do, any user in that organizational unit will be considered under 18. So, third-party apps with settings that aren’t confirmed by October 23,2023 will no longer be accessible for any organizational units you indicated have some or all users under 18.

Was this helpful?

How can we improve it?