topic Svar: Unconfigured third-party apps - I already got the new default settings! in Peer-Peer Topics

Unconfigured third-party apps - This already happened!

Kim_Nilsson — Wed, 25 Oct 2023 14:26:56 GMT

(Unpinning this next week, as it has already rolled out. We may still come back to it in the future.)

So, despite the deadline being "moved to October", you need to fix your settings NOW!

The default settings are in effect, and say that Under-18 can't use third-party apps!

Here comes a bunch of images from my testing.

At the top of the admin console we can now see the new date.

New deadline

There is also a new card on the front page.

New card on front page

If you click the Get started button new page opens the walk-through process of setting it up.

Get started

First you get to select the default setting for unconfigured (unknown or known) apps/services.

My recommendation has always been to keep the default "block all".

Confirm settings

Then you are offered the opportunity to confirm and/or change the access of apps & services already in use.

You will have to allow/trust the client_ids of the third-party (external) apps & services that you wish your users can use with their Workspace accounts. Luckily those currently used are already listed (can be several thousands if you have many users), and you can easily click and change their access. For the future you will have to gather the client_id on the first run of a new service (it will be denied, with error details containing the client_id) and add it as trusted.

After finding those apps & services where you already have a formal, preferably written, decision that people should use, stop touching the list! Yes, you will have some whiners complaining about not being able to use TikTok with their work account, but that's their problem.

Any other apps/services that are to be allowed must go through a proper vetting process with a documented decision on whether to allow it or not. Anything else will make it untenable and most likely illegal. Yeah, I say "illegal". Just because you didn't block everything before doesn't mean that not doing that was legal.

Confirm App access

Are you really sure? 🙂

Really confirm

Ta daaa!

Now you are prepared for the setting going into effect (in October, if we are to believe the first notification).

Ready

If you go to the API Access Control page manually, you can see there's a new card for pending reviews.

New Pending review page

And the API Control Settings page display your new settings.

New Settings page

When a user tries to use a new/untrusted service they will be denied, with the opportunity to send a request for access.

Request access

This is what the confirmation of the request looks like.

Request confirmation English

"In the olden days" the user had to click the error details and send you the client_id, so you could add it manually, but today the request is automatically added to the new Pending review page, where you can easily click to allow it or not.

Pending review

Nice, isn't it!?

However, a definite heads-up is warranted.

I have tested it, and my Under-18 test user is already being blocked... just saying... so perhaps it may come into effect before October. That's the user I created the SignIn and Request images with.

Update 2023-10-11 - My settings. Disabled Requests, and, of course, blocking everything for everyone.

Svar: Unconfigured third-party apps - I already got the new default settings!

Kim_Nilsson — Wed, 21 Jun 2023 12:47:22 GMT

If the same user tries to access the same app again, they are of course still denied, and if they send a new request, it will say a request has already been sent.

Svar: Unconfigured third-party apps - I already got the new default settings!

Kim_Nilsson — Wed, 21 Jun 2023 12:52:42 GMT

Oh, worth noting.

Staff (or really anyone not in an Under-18 OU) can't request access with that same method.

It's only available for Under-18.

Re: Unconfigured third-party apps - I already got the new default settings!

E8419 — Wed, 28 Jun 2023 20:57:41 GMT

I noticed this today. It would have been nice to get heads up from support. Also, when I run the wizard and look at the apps listed I only see 180 apps. This is in contrast to the 1000 apps accessed by users on my domain in the API section. I am not convinced that these 180 represent anything, but the apps that I have already "configured" . I think they need to be "confirmed" too by October?

Hope this makes sense.

Svar: Unconfigured third-party apps - I already got the new default settings!

Kim_Nilsson — Thu, 29 Jun 2023 10:17:52 GMT

Everyone should give feedback that we want TWO things here.

The ability to turn OFF the request feature completely! I don't want requests from students.
The ability to turn ON the request feature for Over-18. Yes, yes, I know, it's much better to have a completely separate Approval Process for this (that's what I recommend), but this should (as always) be an admin choice, and not hard-coded by Google!

Re: Unconfigured third-party apps - I already got the new default settings!

Kim_Nilsson — Thu, 29 Jun 2023 10:22:52 GMT

The guide can be ignored. It's just there to help ease those who never used API Access Control into the process.

So the "confirmation" only makes sure you have configured the necessary apps for OUs Under-18... while I keep saying this entire separate-Over/Under-18 thing was completely unnecessary.

What they should have done was just force change the setting to Block everything, and just tell everyone that they need to do the necessary work before the deadline.

NOBODY should be running with the setting Allow everything, regardless of user age.

Re: Unconfigured third-party apps - I already got the new default settings!

panderson — Thu, 29 Jun 2023 18:11:54 GMT

I am curious about what Google services people have restricted/unrestricted. I would like to set some of the apps to only be able to use Google sign-on (and maybe something else?), while others I want trusted to have access to everything. If I am not mistaken, that is the difference between "Limited" and "Trust".

Re: Unconfigured third-party apps - I already got the new default settings!

Kim_Nilsson — Thu, 29 Jun 2023 19:42:38 GMT

Exactly!

I have always run 100% Restricted, but I will actually switch the Google Sign-in service to Unrestricted, after confirming that my thoughts are correct.

Then perhaps I can set a new service to Limited and it'll only be allowed to access the unrestricted Google sign-in, even if it wants to use other restricted services.

That's what I have to test and verify before changing it globally.

Re: Unconfigured third-party apps - I already got the new default settings!

panderson — Thu, 29 Jun 2023 22:12:33 GMT

Thanks Kim! I think that makes a lot of sense, on mine there are a bunch that have 0 users using them, so I figure I can set those as restricted and wait until the point where someone is blocked to let me know. I am using "the forcing students" as the reason to push it for everyone and really tighten up all the extensions that staff were loading. Let us know if you can verify the limited theory, or if anyone else can comfirm.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

Kim_Nilsson — Fri, 30 Jun 2023 11:48:42 GMT

This new setting is also discussed in this separate thread.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

hanker — Thu, 06 Jul 2023 16:38:06 GMT

It's kind of confusing to look at some of these because I'm sure I have more people using some of these apps than what Google shows. I wonder what criteria it goes by to decide an app has a unique user.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

Kim_Nilsson — Thu, 06 Jul 2023 16:42:32 GMT

They actually have to log into it using their school account.

Not use username/password but click the Sign-in with Google button.

Re: Unconfigured third-party apps - I already got the new default settings!

E8419 — Thu, 06 Jul 2023 20:11:40 GMT

Id be interested in the outcomes of your experiments.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

Kim_Nilsson — Fri, 07 Jul 2023 09:53:24 GMT

First test running a tool as Limited only, but where the tool really wants to use more than that.

I use Crop Sheet since that is my favourite tool for Sheets.

Crop Sheet is allowed as a Marketplace app, and as such set as Trusted by Marketplace.

When I set it to Blocked in my test-ou, it stops working. As expected that overrides the general and inherited setting of Trusted.

But setting it as Limited does not actually limit anything. Crop Sheet is still allowed to do everything.

So for my next test I need to find something that isn't already allowed in Marketplace, but wants to use more than just login-information. Anyone have any suggestions for non-Marketplace tools that wants to access Workspace services?

Ahh, perhaps some of the graphics editors! they usually want to access Drive when logging in!

I'll get back with results from testing that.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

Brodie_McBeath — Tue, 11 Jul 2023 12:52:40 GMT

There has been a few times that there was an API access that we reviewed, it was not Google Certified, but was necessary for what it was needed for. On those few Apps I set the access to Limited, but I was always curious as to what it really limited.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

Kim_Nilsson — Tue, 11 Jul 2023 12:57:32 GMT

Limited means it can access all Google Services that are set to Unrestricted here.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

Brodie_McBeath — Tue, 11 Jul 2023 12:57:34 GMT

Kim, are you aware of a way to see who the Access Request came from? When I open the Request Screen and click on the request, I do see the OU in which the requestor is in, but not the name of the user. I suppose its not imperative, but its nice to know.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

Brodie_McBeath — Tue, 11 Jul 2023 12:58:10 GMT

Ah, thank you sir!

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

Kim_Nilsson — Tue, 11 Jul 2023 12:58:56 GMT

Nope, I don't know. I haven't tested.

It should definitely be included in the request, so you should give that as feedback.

Re: Unconfigured third-party apps - New settings already in effect! Yes, for real.

LydiaVanThiel — Tue, 11 Jul 2023 20:01:47 GMT

You can see who requested what by doing this:

My search shows almost exactly the same list.