Learn
Guide
The Admin console’s app-access review only covers apps that pass through Google’s OAuth and API controls. An account an employee creates with a work email and a password never passes through those controls, so the console’s app review cannot see it. That leaves unlinked accounts: logins inside third-party apps that are not tied back to a verified Google Workspace identity, which means nobody can confirm who owns them, whether they should still be active or what data they can touch. For a company running Google Workspace as its core identity system, this is one of the quieter ways risk builds up in a growing SaaS stack.
TL;DR
The Admin console’s app review only covers apps that have requested access to Google data through OAuth, such as “Sign in with Google.”
Accounts created with an email and password never touch that layer, so the console cannot flag them.
Admins can classify connected apps into access levels such as Trusted, Limited or Blocked, but that classification does not reach accounts the console never sees.
An unlinked account inside a known app is a reconciliation problem, not a discovery problem: match every account to a real person.
Closing the gap takes app discovery plus account-to-person reconciliation, not manual audits alone.
How Do Unlinked Accounts Get Created?
Most unlinked accounts come from ordinary behavior: someone signs up for a trial with a work email and a password, or a manager invites a contractor straight into a tool, with no IT step involved. Nobody is trying to go around the rules; the tool simply never asks Google to vouch for the account.
Why Do These Accounts Slip Past Google Workspace Admins?
Unlinked accounts slip past admins because the Admin console only sees what connects through Google’s own identity layer. Admins manage third-party app access under Security, then Access and data control, then API controls. From there they can review which apps have requested access, configure OAuth permissions and set apps to access levels such as Trusted, Limited or Blocked for specific organizational units.
That review works well, but only for apps that have requested access to Google data through OAuth, such as those an employee joined with “Sign in with Google.” If an employee created a separate username and password instead, the account never passes through Google’s OAuth layer, so it never appears on that screen. The console cannot flag a risk it was never told exists.
Think of a building with one keycard system on the front entrance. Security can see exactly who badges in through that door. If someone installs a side door with its own lock and never tells building management, that door is invisible to the access log, even though it leads into the same building. The keycard system isn’t broken. It is working within a scope it was never meant to cover alone.
This is why relying on Google Workspace admin tools alone leaves a blind spot. They are necessary for Google Workspace security, but they were not designed to be a full app discovery system. The result is one symptom of identity sprawl, the broader concept of logins, permissions and credentials growing unchecked across a company’s SaaS tools. The Learn article “What Is Identity Sprawl” covers that wider picture.
How Is an Unlinked Account Different from a Known Shadow App?
An unlinked account is a special case of shadow IT: the app itself may be approved, but the individual account inside it is not tied to the employee’s real identity. Shadow IT usually refers to apps nobody in IT or operations knows about at all. An unlinked account can exist inside an app everyone knows is in use.
The distinction matters because it changes how the problem gets fixed:
Scenario | What’s known | What’s missing |
|---|---|---|
Unknown shadow app | Nothing | The app’s existence entirely |
Known app, unlinked account | The app is approved and in use | Which specific person owns a given account |
Known app, account linked via SSO | The app, the account and the owner | Nothing. This is the target state. |
Fixing unknown shadow apps is a discovery problem. Fixing unlinked accounts within known apps is a reconciliation problem: matching every existing login against a verified employee roster, then moving the account onto Google Workspace SSO or removing it.
What’s the Real Risk of an Unlinked App Account?
The practical risk is that nobody can act on the account when it matters, most obviously at offboarding, when a checklist built around disabling the Google identity misses it. An account no one owns can also keep access to company data long after the person it belonged to has moved on, and nobody will think to review it. The Learn article “The Risks of Orphaned Accounts in Google Workspace” covers that risk in depth.
How Should a Growing Company Close This Gap?
Start by making Google Workspace SSO the default way into every app that supports it. With SSO, the app trusts Google to verify the person instead of keeping its own password database, so each login traces back to a real identity. One caveat: suspending the Google identity blocks new SSO sign-ins, but it does not remove the account inside the third-party app and may not end sessions that are already open. Offboarding still has to remove the account in the app itself.
For apps that can’t use SSO, the Learn article “Provisioning Apps Without SCIM” covers the options.
Two steps close most of the gap:
Inventory first. Run an app discovery pass to find every tool in use, not just the ones IT or operations already know about.
Reconcile accounts to people. For each app, match every account against the current employee roster. Flag anything that doesn’t match a name, email or active employee, then move it onto SSO or remove it.
ShiftControl covers discovery for every app connected to your Workspace. As a SaaS management platform made for Google Workspace, it pairs app discovery with Permissions Insights so admins can see every app and OAuth scope connected to their Workspace, alongside SaaS spend management so app costs sit in the same place. Reconciling password-created accounts against the employee roster stays a step for the app owner. It is built for the non-technical operator, no IT team required.
Frequently Asked Questions
What is an unlinked app account?
It’s an account inside a third-party app that has no verified connection to an employee’s identity in Google Workspace, often because it was created with a separate password instead of SSO.
Why doesn’t the Google Workspace Admin console catch unlinked accounts automatically?
The console’s app review tools only see apps connected through Google’s own OAuth layer. Accounts created with an email and password never pass through that layer, so they never appear in the review.
Is this the same thing as shadow IT?
It overlaps but isn’t identical. Shadow IT usually means IT doesn’t know an app exists at all. An unlinked account can exist inside an app everyone already knows about and uses.
Does suspending a Google account disable its SSO apps?
Not fully. Suspending the Google identity blocks new SSO sign-ins, but the account inside the third-party app is not removed and sessions already open there may continue. Remove the account in the app as part of offboarding.
Does this matter for compliance?
Yes. Compliance efforts built around SOC 2 or ISO frameworks generally expect a clear, auditable link between identities and the systems they can access, along with a trail showing when access was granted and revoked.
Is this only a risk for large companies?
No. Smaller companies without a dedicated IT function are often more exposed, since there is rarely anyone whose job is to reconcile accounts against the employee roster on a regular basis.
What’s the first step to find unlinked accounts today?
Start with an app discovery scan across the organization, then, alongside discovery, manually cross-check high-risk apps (finance, HR, code repositories) against the current employee list to find any account that doesn’t trace back to a verified name.
About ShiftControl
ShiftControl is a SaaS management platform made for Google Workspace, built for the non-technical operator, no IT team required. It combines provisioning and access, SaaS spend management, app-permission visibility and incident response in one platform. ShiftControl is SOC 2 Type 2 compliant, ISO 27001 certified and signed the CISA Secure by Design Pledge in 2024. Cyber incident response, through a partnership with Blackpanda, is included in every subscription rather than sold as a separate add-on.
If unlinked accounts and app sprawl sound familiar, it’s worth seeing how much of this Google Workspace can already show you, and where ShiftControl fills in the rest. Start a 14-day free trial (no credit card required) or book a demo.
