Somewhere in your Microsoft 365 tenant, an app you connected two years ago still has access to your inbox. The employee who set it up has since left. The vendor trial expired. Nobody revoked anything. The token still works.
This is not a hypothetical. It is the standard condition of most small-business Microsoft 365 environments, and it creates a category of exposure that regulators, cyber insurers, and auditors have begun examining closely.
The short version: Every third-party app connected to Microsoft 365 via OAuth receives a standing credential — not a one-time handshake — that persists until someone explicitly revokes it. Forgotten integrations with standing access to email, files, and contacts represent unreviewed vendor relationships with no expiration date.
How the access gets created
When a user clicks "Allow" on a permission screen — to connect an e-signature tool, sync a CRM, enable a marketing platform, or install a productivity add-in — Microsoft issues that application an OAuth token. That token grants the app the permissions the user approved: read email, access files, view contacts, send on your behalf.
The token does not expire automatically. It does not disappear when the vendor relationship ends. It does not get reviewed during your annual audit unless you build a process that requires it.
In a tenant without admin consent controls, any employee can complete this process without IT involvement. That means your accounting assistant, your receptionist, and the summer intern who helped set up a newsletter tool may each have independently extended access to your organization's data.
What category of apps creates the most exposure
The integrations that tend to be forgotten fastest are also the ones that were granted the broadest permissions:
- Accounting and billing tools that sync invoices or contacts often request read/write access to calendars and email.
- E-signature platforms connected via Outlook add-in typically request access to compose and send email on the user's behalf.
- Marketing and CRM platforms regularly request full contact list access and, in some configurations, the ability to read inbox threads to log communications.
- Browser extensions — particularly those claiming to improve productivity or password management — can request permissions that capture data from any page rendered in the browser, including pages displaying your Microsoft 365 session.
- File-sharing and collaboration tools that were used for a single project and never disconnected retain access to SharePoint and OneDrive.
Why this is a compliance problem, not just an IT problem
If your organization operates under HIPAA, handles client funds, stores personally identifiable information, or holds data subject to state privacy law, the apps connected to your tenant are part of your data environment. A breach at any one of those vendors — or a malicious or negligently coded app — can result in unauthorized access to data you are legally responsible for protecting.
Cyber insurers have added explicit questions about third-party integrations and OAuth consent controls to their renewal questionnaires. Auditors conducting SOC 2 or HIPAA assessments treat unreviewed vendor access as a finding. The risk is documented and the scrutiny is increasing.
The compliance exposure runs in both directions. If a vendor is breached and your token was active, you may have a reportable incident even though your own systems were never directly compromised. The data left through a door you left open.