topic Re: Third-party apps automatically configured/unconfigured in Peer-Peer Topics

Third-party apps automatically configured/unconfigured

JenWerder — Thu, 21 Sep 2023 16:17:03 GMT

I am really struggling with the third-party apps settings. I opened a support ticket with Google 3 weeks ago and we've had a lot of back and forth, but my issue is still unresolved.

Our "configured apps" list started with almost 700 apps. There were many non-educational apps that I did not configure and my initial ask to Google was how they were added to the configured list if an admin didn't configure them. (as an example, onlyfans was one of the "configured" apps) I still have no answer to that question.

This week we had an issue with Blooket. This was one of the apps that was automatically on the configured list (meaning it was *just there*, I didn't configure it). Yesterday I was inundated with calls from teachers wondering why their students couldn't get to Blooket. That app was no longer in the configured apps list, but I didn't remove it. I'm still waiting on an answer from Google on this question also.

I've checked through logs/reports and can't find anything related to these apps being configured/unconfigured, but I can see the log entries for the apps that I have manually blocked/configured. Is anybody else experiencing this issue with apps being automatically configured/unconfigured?

Re: Third-party apps automatically configured/unconfigured

Kim_Nilsson — Thu, 21 Sep 2023 16:36:02 GMT

Sadly, the answer is Yes.

It seems to have happened to quite a few organisations around the world.

I started blocking everything years ago, and I don't think our account has had unknown changes, but I know several who have.

@Kristal you should make the responsible team aware that this reflects very poorly on Google. Things have changed and nobody knows why, and nothing is logged.

Re: Third-party apps automatically configured/unconfigured

Kristal — Fri, 22 Sep 2023 12:50:53 GMT

I will definitely relay this information. Google definitely wants a smooth experience for all users. Thank you for raising this problem.

Kristal

Re: Third-party apps automatically configured/unconfigured

mfoley — Fri, 22 Sep 2023 14:26:48 GMT

Another, In the configured apps page, Why cant you see the configured access (Trusted, Blocked/Limited) from the configured apps screen? You need to download the CSV to view that detail

Re: Third-party apps automatically configured/unconfigured

cmaisano — Fri, 22 Sep 2023 16:54:02 GMT

We are having the same issue with Blooket. I contacted Google Support and they noted that this is a known issue specific to the Blooket app and they hope to have it resolved soon. Fingers crossed!

Re: Third-party apps automatically configured/unconfigured

ddelboccio — Fri, 22 Sep 2023 17:13:38 GMT

I contacted Blooket support as well this week. They gave me a different client ID to use in Google Workspace. the one already showing in Google workspace kept kicking me back an error.

Use this when adding the 3rd party app:

366017072728-fih7d2fq1jtgpj9ctrbg5mmp95r3gf7n.apps.googleusercontent.com

Re: Third-party apps automatically configured/unconfigured

Kristal — Fri, 22 Sep 2023 17:39:02 GMT

I reached out to the team managing this and they wanted me to convey the following:

Configured apps are third-party apps with an access setting (trusted, limited or blocked). An app’s access setting determines whether users can sign in to the app with their account, and which data the app can request from the user’s Google account. The guided experience is meant to surface to Admins 3P apps accessed by users in their organization. Admins need to review and confirm access settings by Oct 23 to avoid users designated as <18 losing access to any third party apps that were previously accessed. Admins can make changes to access policies for any previously accessed third party app in the guided experience as needed.

Regarding why you are not seeing all configured apps in the audit logs: Previously, only apps configured with trusted or block were logged into Admin audit logs. Moving forward, Admins will be able to see all access setting policies set by Admins including "limited".

Re: Third-party apps automatically configured/unconfigured

Kim_Nilsson — Sat, 23 Sep 2023 21:43:54 GMT

Thanks for relaying the issue, @Kristal and learning that more actions will be logged, but the other response from the team isn't factual.

The sudden appearance of hundreds of configured apps is just that, sudden and unexpected.

They are not something that us admins have forgotten that we have done. They were never configured by us, and then suddenly they appear as configured.

Accessed by users and Configured by admins are two wildly different things.

Re: Third-party apps automatically configured/unconfigured

Kim_Nilsson — Sat, 23 Sep 2023 21:51:11 GMT

Yeah, this UI restriction is annoying.

It is available one click away, though.

Mouse-over the row, and the option to View setting appears. Clicking the View link will open a sidebar with Access and OUs listed.

Re: Third-party apps automatically configured/unconfigured

Kristal — Mon, 25 Sep 2023 18:05:20 GMT

Regarding Blooklet, the developer has made some changes that require Admins to reconfigure the application. Please refer to the developer's announcement here.

Re: Third-party apps automatically configured/unconfigured

Kristal — Mon, 25 Sep 2023 18:05:31 GMT

Regarding Blooklet, the developer has made some changes that require Admins to reconfigure the application. Please refer to the developer's announcement here.

Re: Third-party apps automatically configured/unconfigured

Kristal — Mon, 25 Sep 2023 18:06:06 GMT

I will relay your response to that team.

Thank you!

Re: Third-party apps automatically configured/unconfigured

kcalderw — Tue, 26 Sep 2023 12:03:38 GMT

What do you all do in this instance?

Re: Third-party apps automatically configured/unconfigured

Kim_Nilsson — Tue, 26 Sep 2023 12:08:51 GMT

Well, according to their own documentation, only the bottom one is correct, and should be allowed/Trusted, and the top one should be safe to block. That should quickly move all users over to the new client_id, as soon as they are kicked out of the old one and authorises Blooket again.

Re: Third-party apps automatically configured/unconfigured

kcalderw — Tue, 26 Sep 2023 12:22:11 GMT

Are you using Limited for everything?

Also, changing the first Blooket to blocked fails with an invalid ID error.

Re: Third-party apps automatically configured/unconfigured

Kim_Nilsson — Tue, 26 Sep 2023 12:48:37 GMT

Oh, so the first one is actually completely broken now? You need to give that as feedback to Google support. Include the request to get an actual DELETE button, so we can completely remove rows that we don't want to have listed as configured and instead just auto-blocked, just because they are not configured.

Re: Third-party apps automatically configured/unconfigured

Kim_Nilsson — Tue, 26 Sep 2023 12:51:55 GMT

No, I usually choose Trusted for tools that we want people to use.

I have only used Limited for my testing, but in the future I may choose Limited more often, if tools are only supposed to be used to log into, and not actually give access to any other services.

For that purpose I have have loosened the restrictions on the Google Sign-in service to Unrestricted, while keeping Restricted on everything else.

Re: Third-party apps automatically configured/unconfigured

Kristal — Tue, 26 Sep 2023 21:32:53 GMT

Hi Jen,

I shared with the product team and they wanted me to provide you with the following information:

With these new enhanced controls, we are asking customers to review apps that users have accessed in the past to confirm they have the appropriate access setting. In order to minimize student disruption and allow Admins time to review and confirm access to third party apps, Admins see their entire apps list, which includes apps that admins configured as “trusted” or “blocked” as well as apps with an access policy of “limited” (apps your users have previously accessed). We recognize that references to “configured” apps may have introduced unintended confusion. After Oct 23, previously accessed apps that are not confirmed will be placed in an unconfigured state and no longer be accessible to users under 18.

Re: Third-party apps automatically configured/unconfigured

mcbride — Fri, 06 Oct 2023 14:07:43 GMT

Yes, this is incredibly frustrating. With the wizard, and the pending section and unconfigured/configured section, you get different info depending on where you access it from. That screen really need to include the Access status

Re: Third-party apps automatically configured/unconfigured

mcbride — Fri, 06 Oct 2023 14:11:17 GMT

We are seeing this same behavior and I'm so glad I decided to come back to this group after a while away. I was beginning to think I was losing my mind wondering why so many apps were already marked as configured when I knew I hadn't done it. Hate that it's messed up but glad to find out it wasn't just me.