A connected apps review examines services you have authorised to interact with a social account. A scheduling tool, a publishing service or a convenience sign-in may create a relationship that remains relevant after the day you connected it. Start from the account provider’s official settings. Your aim is to recognise the service, understand the access it has and decide whether that access still supports a task you want performed.
1. Start a connected apps review at the account level
Use the provider’s current documentation to locate third-party apps or connected services. This is separate from the list of applications installed on your phone. Checking social sign-in before connecting an app provides related questions about the original authorisation. Work through one account at a time and note the identity of the service being reviewed. Avoid making decisions based only on whether its icon looks familiar.
2. Identify the purpose and owner of each connection
Ask what task the service performs and whether you or another authorised person still uses it. For a shared project, check who created the connection and who depends on its output. An unfamiliar name may be a legitimate publisher’s service, but that needs verification rather than a guess. A connected apps review should leave you with an explanation you can understand, not merely a shorter list.
3. Read the permissions the provider describes
Inspect the stated access available for the connection, such as reading account information or performing supported actions. Exact capabilities depend on the platform and integration. X, for example, documents different third-party app permission arrangements. Do not assume every social sign-in grants permission to publish. Equally, do not assume a connection is harmless because you used it only once to test a convenient feature.
4. Check active sessions as a separate relationship
A browser or phone being signed in is different from a third-party service holding authorisation. Reviewing active app sessions and devices provides related checks, while our social account security checklist explains the broader access review. Uninstalling a phone app or ending a browser session should not be treated as proof that every account-level connection has been revoked. Inspect the specific control for the relationship you intend to change.
5. Preserve the sign-in and data routes you still need
Before disconnecting, check whether the service uses the social account to identify you and whether an alternative login is supported. Our social account recovery plan helps map that dependency. Save any needed work through the service’s documented export process where available. Do not remove a working connection simply to test what happens if doing so could interrupt access to important records you have not checked elsewhere.
6. Remove unnecessary access through the provider’s controls
If a connection no longer serves a recognised purpose, follow the account provider’s process to revoke or remove it. Read the consequences shown and test the ordinary account functions afterward. Revocation should not be assumed to delete information already held by the third-party service. Checking before deleting an app account explains a related but separate decision. Review the service’s own controls if you also want to close its account or address stored data.
7. Record the change and review other privacy layers
Keep a brief private note of the service, action and date, especially for a shared publishing workflow. App tracking controls concerns another privacy layer and should not be confused with the connection you just reviewed. If an expected function stops working, investigate that specific dependency before granting broad access again. Revisit the list when ending a trial, changing tools or removing a person’s role in a project.
Finish the connected apps review when you can explain which services remain, what they do and why you still need them. A recognised connection with an understood purpose is easier to maintain than an old authorisation whose owner and effect have been forgotten. Keep the review focused on account-level access while checking device, session and data-deletion decisions separately.