iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To remove an outside app from your email account, open your provider’s security or connected-app controls, inspect the app’s permissions, and revoke the authorization or delete its app password. Google, Yahoo, and Microsoft 365 use different controls. Revocation stops future access through that authorization, but it does not necessarily erase data the app already copied.
What third-party email access means
A third-party app is any service outside your email provider that has been allowed to sign in or use account data. Examples include a calendar tool reading messages, a mobile mail client using an app password, or an organization-approved integration accessing a Microsoft 365 mailbox.
Modern services commonly use delegated authorization. Instead of giving an app your account password, you approve a defined set of permissions, often called a scope. Google explains that a linked app can request access to Gmail and other Google products, including Drive, Calendar, Photos, and Contacts. The approval screen lists the requested data and services, and the scope determines what the app can do. A permission may allow reading or copying data, or managing it by editing, creating, or deleting account data. Review those capabilities rather than judging an app only by its name.
Free tools Windows power users keep installed
One-click scans. No signup required.
Some connections use an app-specific password instead of an OAuth-style authorization. Deleting that app password blocks the credential even when there is no conventional connected-app entry. This distinction is especially important in Yahoo’s documented account-security flow.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Revoking access is not the same as deleting an app or deleting your account. It prevents the app from obtaining additional data through that authorization. An app may still retain messages, contacts, files, or other information it copied earlier. Google advises contacting the developer if you want previously accessed data deleted; do not assume the provider can erase the developer’s copy.
Never give a third-party app your normal Google Account password. Google warns that password sharing can grant full account access and compromise the account. Use the provider’s authorization screen, and remove the authorization when it is no longer needed or trusted.
Prepare before you revoke anything
- Sign in to the correct account. Personal, school, work, and delegated accounts can show different app lists.
- Record what you recognize. Note the app name, developer, last-used date if shown, and the permissions before removing it. This helps identify a legitimate integration that later stops working.
- Check whether the app is still needed. A dormant connection is a reasonable candidate for removal, but confirm that it does not power an essential backup, archive, accessibility tool, or business workflow.
- Use a direct address. Type the provider’s address or use a saved bookmark. Do not open an unexpected security-alert link to review permissions.
- Have a recovery method available. If revocation exposes a broader account problem, you may need a current password, recovery email, phone, or administrator.
Google Account and Gmail
Google’s official account help describes linked apps and lets you review or remove them from the Google Account connected-apps page: Share some access to your Google Account data with apps from other developers. The labels can change, so use the linked account page itself rather than relying on an old menu path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review and remove a Google authorization
- Sign in directly to the Google Account that contains the Gmail mailbox.
- Open the Google Account linked-apps page from Google’s help guidance.
- Find the app or service. If several accounts are open in the browser, confirm the profile shown before changing anything.
- Open the app’s details and read every listed data type and service. Distinguish read or copy access from management access that could edit, create, or delete data.
- If the app is no longer needed or you do not trust it, choose the control to remove or revoke access and confirm the warning.
Removing the authorization stops that app from accessing the account through the revoked connection. It does not guarantee deletion of information already copied to the app’s servers. Send the developer a separate data-deletion request if that matters, and retain the request and any confirmation.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to judge Google permission scopes
| Permission shown by Google | What it can mean | Review decision |
|---|---|---|
| Read or view Gmail data | The app may inspect message content, headers, or attachments within the stated scope. | Keep only when the app’s function clearly requires mail reading. |
| Copy or export data | The app may move information into its own service, where a separate retention policy applies. | Ask how the service stores and deletes copied data. |
| Manage account data | The app may edit, create, or delete data allowed by the authorization. | Use a higher trust threshold and remove dormant connections. |
| Access to other Google products | The same authorization may cover Drive, Calendar, Photos, Contacts, or Gmail. | Review the entire scope, not just the Gmail portion. |
If a Google app is unfamiliar
Do not approve it merely because its name resembles a service you use. Check the developer, requested scope, and whether you initiated the connection. If you cannot account for it, revoke it, change the Google Account password, review recent account activity and signed-in devices, and inspect Gmail forwarding and filters. An unknown app can be an isolated old authorization, but it can also be evidence that someone gained access.
Yahoo Mail
Yahoo’s documented consumer help identifies third-party connections under External connections in Account Security and directs users to remove the relevant credential through App passwords. The official help reference is Find and remove unusual activity on your Yahoo account. Treat this as Yahoo’s documented app-password route, not as a universal OAuth procedure for every type of Yahoo integration.
Remove a Yahoo app password
- Sign in directly to the Yahoo account and open Account Security.
- Review External connections for services or devices you do not recognize or no longer use.
- Open App passwords, select the password associated with the relevant app, and delete it.
- Confirm that the app can no longer authenticate. If the app has another connection method, remove that separately or contact its support team.
Yahoo separately advises changing the account password immediately when security activity or connected apps appear suspicious. Deleting an app password blocks that credential; it does not establish whether a service retained mail it accessed before deletion. Ask the developer about deletion when necessary.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Microsoft 365 organizational accounts
Microsoft’s documented procedure applies to Microsoft 365 organizations, not automatically to personal Outlook.com, Hotmail, or Live accounts. The organizational guidance is Detect and remediate illicit consent grants. Do not use an enterprise administrator console as though it were a consumer mailbox setting.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What an organizational user can do
- Go directly to myapps.microsoft.com and sign in with the work or school identity.
- Review the applications assigned to you and open the details for any unfamiliar or unnecessary app.
- Inspect the consented scope, including whether the app can read, send, or otherwise act on organizational data.
- Use the available control to revoke the app’s privileges or remove your assignment, if your organization permits self-service removal.
- Tell your Microsoft 365 administrator when the grant looks illicit, affects shared data, or cannot be removed from the user portal.
Administrator investigation
An administrator can open the affected user in the Microsoft Entra admin center, view the user’s Applications page, and remove an illicit assignment. Microsoft also describes organization-wide PowerShell inventory and investigation of consent grants. Those operations require administrative privileges and are not appropriate steps for an ordinary personal-account user.
For a suspected illicit consent grant, administrators can investigate the Microsoft Purview audit log for affected users, time windows, and app permissions. The relevant mailbox and activity auditing must have been enabled beforehand; an audit search cannot recreate events that were never recorded. Preserve the app identifier, affected users, requested scopes, and timestamps before remediation when your incident process requires evidence.
Provider differences at a glance
| Provider and account type | Where to review | Removal mechanism | Scope and investigation notes |
|---|---|---|---|
| Google Account, including Gmail | Google Account linked-apps page | Remove the linked-app authorization | Review Gmail and other Google-product scopes; copied data may remain with the developer. |
| Yahoo consumer account | Account Security, including External connections | Delete the selected app password in App passwords | Yahoo’s documented route is credential-focused; change the account password if activity is suspicious. |
| Microsoft 365 organization | myapps.microsoft.com for users; Microsoft Entra admin center for administrators | Revoke privileges or remove the application assignment | Admin investigation can use PowerShell and Purview audit records; permissions are required. |
| Personal Outlook.com, Hotmail, or Live account | Not established by the Microsoft organizational guidance cited here | Do not substitute enterprise instructions | Use the personal account’s current Microsoft security help or contact support rather than assuming the Entra path applies. |
What to check when access looks suspicious
An unfamiliar app is only one possible sign of compromise. A joint advisory from the FBI, U.S. Cyber Command Cyber National Mission Force, U.S. Treasury, and the UK National Cyber Security Centre, dated September 27, 2024, lists “Connection of unknown devices, applications, or accounts to a victim account;” among indications of successful compromise. The advisory is available as a joint cybersecurity advisory PDF.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesInspect the surrounding account controls
- Devices and sessions: Look for phones, browsers, or locations you do not recognize and sign them out where the provider allows it.
- Mail forwarding: Remove forwarding addresses you did not add. An attacker may forward copies while leaving the inbox apparently normal.
- Filters and rules: Check rules that archive, delete, mark as read, or redirect security messages. Hidden rules can conceal password-reset notices.
- Other linked accounts: Review connected identities and recovery methods, especially if the mailbox is used to reset other services.
- Sent, deleted, and exported mail: Look for messages sent without your knowledge, bulk deletions, or evidence that mail was copied.
Respond without trusting the alert itself
The joint advisory recommends signing in directly to the account to review alerts instead of following links in unexpected security messages. Type the provider’s address yourself or use a known bookmark. If you suspect compromise, revoke unknown app access, change the account password from a trusted device, sign out other sessions, restore legitimate forwarding and rules, and enable stronger multifactor authentication. For a work account, notify the organization’s security or help-desk team so it can preserve logs and check other affected users.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
After revocation: close the remaining gaps
Ask for deletion of copied data
Revocation controls future access through the authorization. It does not force the developer to erase historical copies. Use the app’s privacy or support channel to request deletion, specify the account or workspace involved, and ask what data categories and backups are covered. Keep in mind that legal retention or backup schedules may affect when deletion is complete.
Strengthen sign-in protection
Change the account password if the app was unknown, the normal password was ever shared, or any other activity is suspicious. Turn on multifactor authentication supported by your provider. A FIDO2-compatible hardware security key is an optional additional sign-in safeguard where the account and devices support it. It is not required to review or revoke app access, does not remove permissions, and should be checked for exact compatibility before purchase.
Understand the Google Workspace change
Google Workspace guidance states that, beginning May 1, 2025, Workspace accounts no longer support third-party apps or devices that sign in using only a username and password; OAuth is required. The official reference is Set up Gmail with a third-party email client. This is an authentication-method change for Workspace. OAuth approval is still not proof that an app is trustworthy, so continue reviewing scopes and removing unused grants.
Troubleshooting common problems
The app disappears, but mail access continues
Check whether the service has a second authorization, an app password, a delegated mailbox permission, or a forwarding rule. Removing one credential does not remove a separate connection. In Yahoo, specifically inspect App passwords; in an organization, ask an administrator to check application assignments.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
You cannot remove the connection
Your account may be controlled by an administrator, the app may be required by an organization policy, or you may be viewing the wrong account profile. Capture the app name and scope, then contact the account administrator. Do not weaken security controls or share your password to force removal.
The app returns after you remove it
Some software immediately asks you to authorize it again after a sign-in or update. Decline the request, uninstall or disable the integration, and remove any saved app password. If it is a work-required application, have the administrator confirm its purpose and least-privilege scope.
The app says it still has my data
That is consistent with revocation: the authorization can be inactive while previously copied data remains in the developer’s systems. Submit a deletion request to the developer and review its privacy terms. If the data is sensitive or the access was illicit, involve your organization’s privacy or security team.
Recommended Free Tools
You are unsure whether an alert is genuine
Ignore links in the unexpected message, open the provider directly, and check the account’s security activity there. A genuine alert should be verifiable inside the account. Treat an unrecognized device, application, forwarding rule, or linked account as a reason to complete the broader compromise checks above.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
