> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/shadow-apps/google-workspace-playbooks-for-shadow-apps.md).

# Google Workspace playbooks for shadow apps

To mitigate the risk associated with shadow apps in Google Workspace, you can define automated workflows for these use cases: 

* [Remove installed shadow app with risky permissions](#remove-installed-shadow-app-with-risky-permissions)
* [Remove unclassified shadow app](#remove-unclassified-shadow-app)
* [Remove user app token on-demand](#remove-user-app-token-on-demand)

## Remove installed shadow app with risky permissions

When a user installs an app with risky permissions on Google Workspace, the SecOps team is asked to approve the app installation. If they don't approve or there is no response, the user app token is automatically removed from the app.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Shadow apps category, and select the **Remove installed shadow app with risky permissions** playbook.
3. Give the workflow a description.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fe62L23ndl5VFvfWI6N0D%2FPrevent%20installing%20shadow%20app%20with%20risky%20scopes.png?alt=media&amp;token=f88ee2bc-d6ee-46be-9cca-f854227ee605" alt=""><figcaption></figcaption></figure>
4. The **App installed** trigger is automatically populated with the conditions for risky app scopes. At least one app scope contains a drive, gmail or docs API scope.
5. Add any relevant conditions.
6. Customize the **Approval** action to send to the SecOps team:\
   `A new app with highly sensitive scopes was recently installed by a user in your organization.`

   `App name: <Get app name>`

   `Installed by: <Get actor>`&#x20;

   `This app can be reviewed in the DoControl inventory:`

   `https://app.docontrol.io/inventory/shadow-apps`

   `Do you approve installing this app?`
7. Depending on the SecOp response to the **Approval** request:
   * If **yes** - The workflow ends with a success status.
   * If **no** or is there no response - The user app token is automatically removed.

## Remove unclassified shadow app

When an unclassified shadow app is installed on Google Workspace, the user is asked for approval: If approved, the workflow ends. If not approved or the request times out, the user app token is removed.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to shadow apps, and select the **Remove unclassified shadow app** playbook.&#x20;
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPx7tgCqJyz8Hhscp6SDr%2Funclassified%20shadow%20app%20playbook.png?alt=media&amp;token=e13a282a-5667-44f5-b6b0-07020ec9ab8a" alt=""><figcaption></figcaption></figure>
4. Under the **App installed** event, add the relevant conditions:
   * `Get actor` is in a `trusted domain`
   * App is unclassified
   * Add any relevant conditions
5. Customize the **Approval** step to send an email or Slack message to the actor or actor's manager asking for approval:\
   \
   `You recently installed a new app on Google Workspace.`

   `Do you approve the installation of this application: <app name>?`

   * **Yes** - End the workflow.
   * **Timeout** or **No** - Customize the **Wait** step time period; for example, 3 days.
   * **No** - Customize the **Remove user app token** step to remove the unauthorized app. Make sure the `app ID` and `user ID` macros are selected.
6. Specify how to continue the workflow in the case of an error.

## Remove user app token on-demand

When a user triggers a DoControl inventory action to remove a Google Workspace user app token, the app is automatically removed. This workflow is event-aggregated, so it can be run for multiple events.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to shadow apps, and select the **Remove user app token on-demand** playbook.&#x20;
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FupuQtNihwjcotOQSxR5D%2FIT%20playbook%20Google%20remove%20app%20token.png?alt=media&amp;token=236472ca-a75f-4316-8830-9e4612aeafca" alt=""><figcaption></figcaption></figure>
4. Under the **Revoke user app token** action, make sure the `app ID` and `user ID` macros are selected.
5. Specify how to continue the workflow in the case of an error.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/shadow-apps/google-workspace-playbooks-for-shadow-apps.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.