> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-workspace-remediation.md).
# Google Workspace remediation
DoControl provides your organization with an automated way to detect and mitigate risk on Google Workspace. Your organization can enforce automated security workflows across the SaaS application stack, and remediate the potential risk that sanctioned and unsanctioned applications might pose.
{% hint style="info" %}
To leverage DoControl's remediation actions for Google Workspace apps, you require the Shadow Apps premium module.
{% endhint %}
## Remove user app token
You can define workflows to automatically remove users from specific shadow apps that are considered risky, or unsanctioned.
{% hint style="info" %}
To remediate your current installations of unsanctioned apps, you can implement inventory actions to [remove shadow apps](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-workspace-inventory-actions.md#remove-apps-in-bulk) or [remove users from shadow apps](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-workspace-inventory-actions.md#remove-users-from-app-in-bulk).
{% endhint %}
#### To remove a user from a shadow app:
1. In Workflows, select **New workflow** or **Playbooks > Google Workspace**.
2. Select a playbook, for example: **Remove unclassified shadow app**.
3. Give an action name.
4. Under the **App installed** event, add the relevant conditions:
* `Get actor` is in a `trusted domain`
* App is unclassified
* Add any relevant conditions
5. Customize the **Approval** step to send an email or Slack message to the actor or actor's manager asking for approval: `You recently installed a new app on Google Workspace.`
`Do you approve the installation of this application: ?`
* **Yes** - End the workflow.
* **Timeout** or **No** - Customize the **Wait** step time period; for example, 3 days.
* **No** - Customize the **Remove user app token** step to remove the unauthorized app. Make sure the `app ID` and `user ID` macros are selected.
6. Specify how to continue the workflow in the case of an error.
\
After confirmation, the selected app user tokens are removed from the shadow app, and all user data is deleted.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-workspace-remediation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
