> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/remediate-shadow-apps.md).
# Remediate shadow apps
DoControl provides your organization with an automated way to detect and mitigate risk on Google Workspace. Your organization can enforce automated security workflows across the SaaS application stack, and remediate the potential risk that sanctioned and unsanctioned applications might pose.
{% hint style="success" %}
* You can remove shadow apps or users from apps **in bulk** up to a maximum of 10,000 user tokens within a 24-hour period.
* DoControl removes up to 3000 user tokens in a single workflow execution. If you want to remove more than 3000 user tokens, they will be removed in separate workflow executions. These workflow executions are displayed together in your [workflow activity](/docontrol-user-guide/workflows/activity-dashboard.md#workflow-activity).\
**For example**: If you remove 9,000 user tokens, 3 workflow executions will run to remove 3000 user tokens each.
{% endhint %}
Use the following inventory actions to remediate Google Workspace apps:
* [Remove app](#remove-app)
* [Remove user from app](#remove-user-from-app)
## Remove app
For shadow apps that are unsanctioned or banned, you can manually remove them from your organization's Google Workspace with an inventory action. You can remove apps either [one-by-one](#remove-app-one-by-one) or [in bulk](#remove-app-in-bulk).
{% hint style="warning" %}
When you remove an app, data is deleted for all users.
{% endhint %}
### Remove app one-by-one
1. Go to **Shadow apps > Google Workspace**.
2. Click the **Remediate** icon next to the app you wish to remove.
3. Select **Remove app**.
4. Select the relevant workflow. If you don't have one, [create a workflow ](/docontrol-user-guide/workflows/create-a-workflow.md)based on the relevant playbook.
5. Click **Trigger workflow**.
After confirmation, the app is removed from your organization's workspace for all users.
### Remove apps in bulk
{% hint style="success" %}
* You can remove shadow apps **in bulk** for up to a maximum of 10,000 user tokens within a 24-hour period.
* DoControl removes up to 3000 user tokens in a single workflow execution. If you want to remove more than 3000 user tokens, they will be removed in separate workflow executions. These workflow executions are displayed together in your [workflow activity](/docontrol-user-guide/workflows/activity-dashboard.md#workflow-activity).\
**For example**: If you remove 9,000 user tokens, 3 workflow executions will run to remove 3000 user tokens each.
{% endhint %}
1. Go to **Shadow apps > Google Workspace**.
2. Select the apps you wish to remove.
3. Click the **Remediate** icon next to the shadow apps you wish to remove, OR click **Remove apps**.
4. Select the relevant workflow, and click **Remove apps**.
After confirmation, the selected apps are removed from your organization's workspace for all users. All user data is deleted.
#### Troubleshooting
Cannot click the **Remediate** icon to remove a specific shadow app.
**How to solve this issue**
There is a daily removal limit of 10,000 user tokens across all apps. If you try to remove apps with a total of more than 10,000 user tokens across apps, you'll need to repeat the **Remove app** action after the 24-hour period has elapsed.
## Remove user from app
You can manually remove specific users from an unauthorized shadow app in Google Workspace with an inventory action. You can remove user app tokens either [one-by-one](#remove-user-app-token-one-by-one) or [in bulk](#remove-user-app-token-in-bulk).
{% hint style="warning" %}
After you remove a user app token, data is deleted for the selected users.
{% endhint %}
### Remove user from app one-by-one
1. Go to **Shadow apps > Google Workspace**.
2. Next to the relevant shadow app, click the **Ellipsis** button at the end of the row to **View users**, or click the number of **Users**.
3. Click the **Remediate** icon next to the user you wish to remove.
4. Select **Remove user from app**.
5. Select the relevant workflow and click **Trigger workflow**.
After confirmation, the app user token is removed from the shadow app, and all user data is deleted.
### Remove users from app in bulk
{% hint style="success" %}
* You can remove users from shadow apps **in bulk** for up to a maximum of 10,000 user tokens within a 24-hour period.
* DoControl removes up to 3000 user tokens in a single workflow execution. If you want to remove more than 3000 user tokens, they will be removed in separate workflow executions. These workflow executions are displayed together in your [workflow activity](/docontrol-user-guide/workflows/activity-dashboard.md#workflow-activity).\
**For example**: If you remove 9,000 user tokens, 3 workflow executions will run to remove 3000 user tokens each.
{% endhint %}
1. Go to **Shadow apps > Google Workspace**.
2. Next to the relevant shadow app, click the **Ellipsis** button at the end of the row to **View users**, or click the number of **Users**.
3. Select the users you wish to remove.
4. Click **Remediate > Remove user from app**.
5. Click **Trigger workflow**.\
After confirmation, the selected app user tokens are removed from the shadow app, and all user data is deleted.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/remediate-shadow-apps.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
icon next to the shadow apps you wish to remove, OR click **Remove apps**.
button at the end of the row to **View users**, or click the number of **Users**.
3. Click the **Remediate** icon next to the user you wish to remove.
4. Select **Remove user from app**.
