Salesforce Connected Apps: Audit, Govern, Secure, Before They Own You

Every Salesforce org accumulates Connected Apps like a laptop accumulates browser tabs, and about as thoughtfully. Some were installed for a POC three years ago. Others are used daily and nobody knows by whom. Half have "Full Access" scopes and expired refresh tokens. This is the single most under-audited surface in a mature Salesforce org, and the most likely credential leak vector in 2026.

The 5-Category Audit You Have to Run

1. Ownership: every Connected App must have a named business owner and a named technical owner.
2. Scopes: what OAuth scopes are granted? "Full Access" and "Perform requests at any time" together should exist only where absolutely required.
3. Usage: when was the last successful token exchange? Anything unused for 90+ days is a candidate for retirement.
4. Auth flow: old JWT and web-server flows without PKCE are increasingly risky. Migrate to modern flows.
5. Rate limits: which apps consume the most API calls? A runaway integration can DoS your org during business hours.

The Governance Model That Sticks

Adopt a lightweight lifecycle:

• Request: new Connected App only via an intake form (owner, purpose, scopes justified, expected volume).
• Review: security team approves scopes.
• Deploy: tagged in metadata with owner + expiry date.
• Quarterly review: re-verify usage; archive unused apps.

What to Do About "Unknown" Apps

Every audit finds Connected Apps that predate the current team. Do not delete blindly:

• Turn on Login IP restriction and observe traffic for 7 days.
• If no logins, revoke. If logins, trace the source before touching.
• Document the outcome, the next auditor will thank you.

Automating the Audit

Salesforce Shield Event Monitoring streams every Connected App login and API call. Pipe those into Splunk, Datadog or a native dashboard. Combine with our Health Check guide for full org security posture.

Regional Notes

• EU (France, Germany, Belgium, Luxembourg, Switzerland): Connected Apps that access personal data must be in the record of processing activities (ROPA). See our GDPR guide.
• US & Canada: SOC 2 and ISO 27001 audits explicitly test Connected App governance in 2026.

Frequently Asked Questions

How often should we audit Connected Apps?

Full audit once a year. Quarterly checks on high-scope apps. Continuous monitoring via Event Monitoring where budget allows.

Can we block new Connected Apps from being installed?

Yes, set installed package and app installation policies to require admin approval. Do this on day one.

What is the biggest risk category?

Apps with "Full Access" plus a refresh token older than 90 days and no active user tied to it.

Do I need Salesforce Shield for this?

Not to start. Shield adds continuous monitoring; the initial audit uses standard reports and Setup screens.

Get a Fixed-Fee Connected Apps Audit

Our Salesforce audit includes a Connected Apps inventory, scope review and governance policy in 2 weeks. Book a 30-minute call.