Salesforce Connected Apps Audit: How to Reduce OAuth Sprawl Before It Becomes a Breach

Every Salesforce integration, every third-party tool, every AI agent that connects to your org does so through a connected app with OAuth credentials. Over time, these accumulate. A vendor you trialed for three months and never purchased? Its connected app is still there. The previous marketing automation platform you migrated away from two years ago? Still connected.

This is OAuth sprawl, and it is one of the most underestimated risks in a Salesforce org. Each connected app is an access point. The more access points you have, the larger your attack surface.

How to audit your connected apps

Go to Setup, then Connected Apps OAuth Usage. This page shows every connected app that has been granted OAuth access, the number of users connected, and the last access time. Export this list. For each app, note: the app name, the vendor, the last access date, the number of active users, and the permissions granted (scopes).

Flag any app that meets these criteria: last accessed more than 90 days ago, belongs to a vendor you no longer use, has broader permissions than its function requires, or was created by a user who is no longer with the company.

Revoking access safely

Do not mass-revoke connected apps without checking dependencies. Some apps have active data syncs that will break if revoked. For each flagged app, check: is there an active integration that depends on it? Are there scheduled jobs or flows that reference it?

For apps with no active dependencies, revoke access and document the change. For apps with uncertain dependencies, disable the app temporarily (block new logins but do not revoke existing tokens) and monitor for sync failures over a two-week window.

The AI governance angle

As AI agents like Agentforce become more common, connected app governance becomes even more critical. An AI agent operates within your org's permission model. If the agent inherits access through a connected app with over-broad permissions, it can read data it should not or create audit trail gaps.

Review the permission sets and profiles associated with your AI agents. Apply the principle of least privilege: the agent should have access to exactly the objects and fields it needs, and nothing more.

Governance and Access is one of six dimensions in the AI-Ready RevOps Framework, weighted at 15% of the Readiness Index. In a post-breach environment, this is not an IT concern. It is a revenue operations concern.

Try it free →Free Assessment

Frequently asked questions

How many connected apps should a Salesforce org have?

Any connected app that has not been used in 90+ days, or that belongs to a vendor you no longer use, should be reviewed for deactivation. Most mid-market orgs can reduce their connected app count by 30-50% after an audit.

What is OAuth sprawl?

OAuth sprawl is the accumulation of connected apps with API access to your Salesforce org over time. Each connected app is an access point. When these accumulate without regular review, the attack surface expands, and former vendor integrations retain access they no longer need.

---

← All articles